enigma-memory 0.1.17 → 0.1.22

package/packages/mcp-server/README.md

@@ -7,16 +7,32 @@
 Pick the client you use:
 
 ```sh
-npm install -g enigma-memory && enigma setup --client claude-desktop --write-connectors --overwrite
-npm install -g enigma-memory && enigma setup --client cursor --write-connectors --overwrite
-npm install -g enigma-memory && enigma setup --client kimi-code --write-connectors --overwrite
-npm install -g enigma-memory && enigma setup --client vscode-cline --write-connectors --overwrite
+PASSPHRASE_FILE="$HOME/.enigma/passphrase"
+test -s "$PASSPHRASE_FILE" || { printf '%s\n' 'Create the protected passphrase file before setup.' >&2; exit 1; }
+npm install -g enigma-memory && enigma setup --passphrase-file "$PASSPHRASE_FILE" --client claude-desktop --write-connectors --overwrite
+npm install -g enigma-memory && enigma setup --passphrase-file "$PASSPHRASE_FILE" --client cursor --write-connectors --overwrite
+npm install -g enigma-memory && enigma setup --passphrase-file "$PASSPHRASE_FILE" --client kimi-code --write-connectors --overwrite
+npm install -g enigma-memory && enigma setup --passphrase-file "$PASSPHRASE_FILE" --client vscode-cline --write-connectors --overwrite
 ```
 
 To write only MCP configs that already exist on the machine:
 
 ```sh
-npm install -g enigma-memory && enigma setup --client auto --connect-installed --overwrite
+npm install -g enigma-memory && enigma setup --passphrase-file "$HOME/.enigma/passphrase" --client auto --connect-installed --overwrite
 ```
 
-The generated server entry uses command `enigma-mcp`, no args, and `ENIGMA_BUNDLE` pointing at the local bundle. Existing sibling MCP servers are preserved.
+The generated server entry uses command `enigma-mcp`, no args, and `ENIGMA_BUNDLE` pointing at the local bundle. Existing sibling MCP servers are preserved. For an encrypted bundle, the client process must receive `ENIGMA_PASSPHRASE` from an approved OS credential manager or secure launcher; never paste the value into MCP JSON, source, shell arguments, or documentation.
+
+## Private-session handoff
+
+For a sensitive prompt, the host should call `enigma_start_private_session` with only a short non-sensitive intent such as `private code question`. The tool returns an `enigma://private` OS-app URL and the script-free MCP App resource `ui://enigma/private-session.html`. Electron resolves that protocol onto its own dynamic authenticated localhost origin; MCP does not guess a port.
+
+The boundary is precise:
+
+- text typed into the MCP host chat and ordinary tool arguments is host-visible;
+- text typed after the Enigma workspace opens is not returned to the MCP host;
+- the configured provider adapter receives the prompt and retrieved context prepared by Enigma;
+- Anchor Guard can mask documented email, wallet, IPv4, and formatted-phone patterns, but it is not semantic provider secrecy;
+- the workspace transcript stays in page memory and disappears on refresh unless the user explicitly saves an answer to encrypted Enigma memory.
+
+Use `enigma_routing_contract` before choosing between ordinary host-visible memory tools and private handoff. `enigma_private_handoff_health` directly probes only a known loopback CLI host supplied through `ENIGMA_DESKTOP_URL`, and accepts only the `enigma.desktop.health.v1` response—not an arbitrary HTTP 200. Normal Electron launch and discovery use the `enigma://` OS protocol.

package/packages/mcp-server/bin/enigma-mcp.mjs

@@ -13,7 +13,8 @@ function isMainModule(metaUrl) {
 }
 
 if (isMainModule(import.meta.url)) {
-  startStdioServer();
+  const server = startStdioServer();
+  server.done.then(() => process.exit(0), () => process.exit(1));
 }
 
 export { startStdioServer };