edge-book 0.2.0 → 0.2.2

package/README.md

@@ -1,10 +1,51 @@
 # Edge Book
 
-Run your own Edge Book agent and view it in the hosted reader.
+Run your own Edge Book agent and view it in the hosted reader. Your identity,
+contacts, grants, and shared objects live on **your** machine; the host relays
+signed envelopes and holds nothing of your social graph at rest.
+
+## Connect to the hosted reader
 
     npx edge-book init
     npx edge-book dialout --host wss://edge-book-host.fly.dev/agent/ws
     npx edge-book pair    --host wss://edge-book-host.fly.dev/agent/ws
 
-Then open https://edge-book-host.fly.dev/pair and enter the code.
-Your data stays on your machine; the host holds nothing at rest.
+Then open https://edge-book-host.fly.dev/pair and enter the code. Leave the
+`dialout` process running for the duration of your reader session.
+
+## Add a trusted contact
+
+Share an "Add me" invite link (it encodes your signed Agent Card):
+
+    npx edge-book card invite                       # prints edgebook:invite:...
+
+The other person imports it and the friend request is delivered over the host
+mailbox; you approve it to connect:
+
+    npx edge-book friend request <edgebook:invite:...> --deliver
+    npx edge-book friend accept  <their-agent-id>      --deliver
+
+## Share one object, gated by one revocable grant
+
+Edge Book's core is a **permissioned room**: nothing is shared by default. You
+post a single object (a request + at most one file) and grant exactly one
+contact read access. It appears in their hosted reader, and only theirs.
+
+    npx edge-book object create --title "Review the contract?" --body "Two clauses need eyes." --file ./contract.pdf
+    npx edge-book object share  <their-agent-id> <object-id> --deliver
+    # they now see it under "Shared with me" in the reader
+
+    npx edge-book object list                        # objects shared with you
+    npx edge-book object read  <object-id>           # read one (audited)
+    npx edge-book object revoke <their-agent-id> <object-id> --deliver   # forward-looking
+
+Every create / grant / access / revoke writes a signed entry to your local
+append-only audit log.
+
+## Notes
+
+- **Old-Node safe:** runs on Node 20+.
+- **Privacy posture:** envelopes are relayed through the host, which can in
+  principle read them in transit — there is no end-to-end encryption claim.
+- `npx edge-book --help` lists every command. `npx edge-book sessions revoke`
+  drops all hosted-reader sessions bound to your agent.

package/dist/edge-book.js

@@ -83,6 +83,12 @@ async function readJson(file, fallback) {
     return JSON.parse(await fs.readFile(file, "utf8"));
   } catch (error) {
     if (error.code === "ENOENT") return fallback;
+    if (error instanceof SyntaxError) {
+      try {
+        return JSON.parse(await fs.readFile(file, "utf8"));
+      } catch {
+      }
+    }
     throw error;
   }
 }
@@ -95,9 +101,16 @@ async function chmodBestEffort(file, mode) {
 }
 async function writeJson(file, value, mode) {
   await fs.mkdir(path.dirname(file), { recursive: true });
-  await fs.writeFile(file, `${JSON.stringify(value, null, 2)}
+  const tmp = `${file}.tmp-${crypto.randomBytes(6).toString("hex")}`;
+  try {
+    await fs.writeFile(tmp, `${JSON.stringify(value, null, 2)}
 `, "utf8");
-  if (mode !== void 0) await chmodBestEffort(file, mode);
+    if (mode !== void 0) await chmodBestEffort(tmp, mode);
+    await fs.rename(tmp, file);
+  } catch (error) {
+    await fs.rm(tmp, { force: true }).catch(() => void 0);
+    throw error;
+  }
 }
 async function appendJsonl(file, value) {
   await fs.mkdir(path.dirname(file), { recursive: true });
@@ -107,7 +120,15 @@ async function appendJsonl(file, value) {
 async function readJsonl(file) {
   try {
     const text = await fs.readFile(file, "utf8");
-    return text.split(/\n/).filter(Boolean).map((line) => JSON.parse(line));
+    const out = [];
+    for (const line of text.split(/\n/)) {
+      if (!line) continue;
+      try {
+        out.push(JSON.parse(line));
+      } catch {
+      }
+    }
+    return out;
   } catch (error) {
     if (error.code === "ENOENT") return [];
     throw error;
@@ -1305,7 +1326,7 @@ async function handleOwnerApi(req, res, url, adapters) {
     return true;
   }
   if (req.method === "GET" && url.pathname === "/api/invite") {
-    const card = await store.writeCard();
+    const card = await store.buildCard();
     const identity = await store.identity();
     const invite_url = `edgebook:invite:${Buffer.from(JSON.stringify(card), "utf8").toString("base64url")}`;
     sendJson(res, 200, { agent_id: identity.agent_id, display_name: identity.display_name, card_url: card.card_url, card, invite_url });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "edge-book",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Run your own Edge Book agent and connect it to the hosted reader.",
   "license": "MIT",
   "type": "module",