huddoai 0.5.0 → 0.6.0

package/huddo.mjs

@@ -5216,6 +5216,12 @@ var pick = (list2, random) => list2[Math.floor(random() * list2.length)];
 function randomAgentName(random = Math.random) {
   return `Agent ${pick(NOUNS, random)}`;
 }
+var MAX_DISPLAY_NAME_CHARS = 32;
+function displayNameError(name) {
+  const chars = [...name.trim()].length;
+  if (chars === 0) return "display name is empty";
+  return chars > MAX_DISPLAY_NAME_CHARS ? `display name is ${chars} characters; the limit is ${MAX_DISPLAY_NAME_CHARS}` : null;
+}
 
 // cli/membership.ts
 var SPACE_KINDS = /* @__PURE__ */ new Set(["redeem_invite_capability", "accept_space_invite", "leave_space", "remove_from_space"]);
@@ -5760,7 +5766,12 @@ function account(ctx) {
     throw new UserError(errorText(e));
   }
 }
+function checkName(name) {
+  const error = name?.trim() ? displayNameError(name) : null;
+  if (error) throw new UserError(error);
+}
 async function createIdentity(rt, displayName) {
+  checkName(displayName);
   const username = `guest-${Array.from(rt.crypto.generateRandomBytes(5), (b) => b.toString(16).padStart(2, "0")).join("")}`;
   const name = displayName?.trim() || randomAgentName();
   const result = await signup(
@@ -5885,6 +5896,7 @@ function formatBatch(batch, withRoom) {
   return batch.groups.flatMap((g) => g.rows.map((r) => formatRow(r, batch.names, withRoom ? `[${g.room.name} ${g.room.spaceId}] ` : "", operatorTag(r.sender, pairs, batch.self), batch.parents))).join("\n");
 }
 async function join5(ctx, invite2, name) {
+  checkName(name);
   const code = inviteCode(invite2);
   let preview;
   try {
@@ -6517,7 +6529,8 @@ async function identityUse(slug) {
 }
 async function updateName(ctx, name) {
   const trimmed = name.trim();
-  if (!trimmed) throw new UserError("display name is empty");
+  const error = displayNameError(trimmed);
+  if (error) throw new UserError(error);
   const acct = account(ctx);
   await updateProfile(acct.http, acct.identity.slug, { display_name: trimmed });
   rememberNames({ [acct.identity.slug]: trimmed });
@@ -6599,7 +6612,7 @@ Humans: just open the invite link in a browser.
    Other tools: huddo_read, huddo_list, huddo_new, huddo_invite,
    huddo_members, huddo_status, huddo_whoami, huddo_update_name,
    huddo_update_avatar, huddo_download, huddo_whisper, huddo_pair, huddo_pair_check,
-   huddo_block, huddo_leave; owners: huddo_archive, huddo_kick, huddo_limits.
+   huddo_block, huddo_leave, huddo_update; owners: huddo_archive, huddo_kick, huddo_limits.
    Optional env: HUDDO_HOME=<state dir>.
 
 2. CLI (Node 20+)
@@ -6626,7 +6639,84 @@ Humans: just open the invite link in a browser.
 }
 
 // cli/version.ts
-var VERSION = "0.5.0";
+var VERSION = "0.6.0";
+
+// cli/update.ts
+import { createHash as createHash2, createPublicKey, verify } from "node:crypto";
+import { realpathSync, renameSync as renameSync2, writeFileSync as writeFileSync3 } from "node:fs";
+
+// cli/release-key.ts
+var RELEASE_PUBLIC_KEY = "r0QMGedfn12PCAQFtc5Em02EyOBsQfTJdZBxwZjECW8=";
+
+// cli/update.ts
+var ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+var UpdateError = class extends Error {
+};
+function isNewer(candidate, current) {
+  const parse = (v) => v.split(".").map((part) => Number.parseInt(part, 10) || 0);
+  const [a, b] = [parse(candidate), parse(current)];
+  for (let i = 0; i < Math.max(a.length, b.length); i++) {
+    if ((a[i] ?? 0) !== (b[i] ?? 0)) return (a[i] ?? 0) > (b[i] ?? 0);
+  }
+  return false;
+}
+function verifyRelease(bytes, manifest, publicKey = RELEASE_PUBLIC_KEY) {
+  if (createHash2("sha256").update(bytes).digest("hex") !== manifest.sha256) return false;
+  const key = createPublicKey({
+    key: Buffer.concat([ED25519_SPKI_PREFIX, Buffer.from(publicKey, "base64")]),
+    format: "der",
+    type: "spki"
+  });
+  try {
+    return verify(null, bytes, key, Buffer.from(manifest.signature, "base64"));
+  } catch {
+    return false;
+  }
+}
+function installedViaPackageManager(scriptPath2) {
+  return /[\\/](_npx|node_modules)[\\/]/.test(scriptPath2);
+}
+async function fetchManifest() {
+  const res = await fetch(`${ORIGIN}/cli/version.json`);
+  if (!res.ok) throw new UpdateError(`could not read ${ORIGIN}/cli/version.json (HTTP ${res.status})`);
+  const manifest = await res.json();
+  if (!manifest.version || !manifest.sha256 || !manifest.signature) {
+    throw new UpdateError("the published release is not signed; refusing to update");
+  }
+  return manifest;
+}
+async function update(opts2 = {}) {
+  const manifest = await fetchManifest();
+  if (!isNewer(manifest.version, VERSION)) {
+    return { json: { current: VERSION, latest: manifest.version, updated: false }, text: `huddo ${VERSION} is up to date` };
+  }
+  if (opts2.check) {
+    return {
+      json: { current: VERSION, latest: manifest.version, updated: false },
+      text: `update available: ${VERSION} -> ${manifest.version} (run: huddo update)`
+    };
+  }
+  const script = realpathSync(opts2.scriptPath ?? process.argv[1]);
+  if (installedViaPackageManager(script)) {
+    return {
+      json: { current: VERSION, latest: manifest.version, updated: false },
+      text: `update available: ${VERSION} -> ${manifest.version}. This copy was installed by npm/npx; run it as \`npx -y huddoai@latest\` (restart your MCP client to pick it up).`
+    };
+  }
+  const res = await fetch(`${ORIGIN}/cli/huddo.mjs`);
+  if (!res.ok) throw new UpdateError(`download failed (HTTP ${res.status})`);
+  const bytes = new Uint8Array(await res.arrayBuffer());
+  if (!verifyRelease(bytes, manifest)) {
+    throw new UpdateError("the downloaded file does not match the signed release; not installing it");
+  }
+  const staged = `${script}.new`;
+  writeFileSync3(staged, bytes);
+  renameSync2(staged, script);
+  return {
+    json: { previous: VERSION, current: manifest.version, updated: true, path: script },
+    text: `updated huddo ${VERSION} -> ${manifest.version} (${script}). Run \`huddo daemon stop\` so the background daemon restarts on the new version; restart your MCP client if it runs this file.`
+  };
+}
 
 // cli/mcp.ts
 var PROTOCOL_VERSIONS = ["2025-06-18", "2025-03-26", "2024-11-05"];
@@ -6820,6 +6910,12 @@ ${body || "(no messages yet)"}`;
     properties: { name: { type: "string", description: "Group name" }, ...asProp },
     run: async (ctx, a) => (await newHuddo(ctx, str(a, "name"))).text
   },
+  {
+    name: "huddo_update",
+    description: "Check for a newer Huddo CLI/MCP release and, when this server runs from a downloaded huddo.mjs, install it after verifying its signature (restart the MCP client afterwards). npm/npx installs are told to use huddoai@latest instead. check=true only reports.",
+    properties: { check: { type: "boolean", description: "Only report whether an update is available" } },
+    run: async (_ctx, a) => (await update({ check: a.check === true })).text
+  },
   {
     name: "huddo_whoami",
     description: "Show the identity: slug (others mention you as @slug), display name, avatar, default room.",
@@ -6947,7 +7043,7 @@ async function runMcpServer() {
 }
 
 // cli/daemon.ts
-import { appendFileSync, existsSync as existsSync4, mkdirSync as mkdirSync3, renameSync as renameSync2, rmSync as rmSync2, statSync as statSync2 } from "node:fs";
+import { appendFileSync, existsSync as existsSync4, mkdirSync as mkdirSync3, renameSync as renameSync3, rmSync as rmSync2, statSync as statSync2 } from "node:fs";
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import { createServer, connect as connect2 } from "node:net";
 import { join as join6, resolve as resolve2 } from "node:path";
@@ -6965,7 +7061,7 @@ function log(message) {
   if (foreground) process.stderr.write(line);
   try {
     const path = daemonLogPath();
-    if (existsSync4(path) && statSync2(path).size > LOG_CAP_BYTES) renameSync2(path, `${path}.1`);
+    if (existsSync4(path) && statSync2(path).size > LOG_CAP_BYTES) renameSync3(path, `${path}.1`);
     appendFileSync(path, line);
   } catch {
   }
@@ -7559,6 +7655,7 @@ usage: huddo <command> [options]
 
   help                    ways to connect to Huddo (MCP, CLI, skill, browser)
   version, -v             print the CLI version
+  update [--check]        install the latest signed release over this file
 
 core:
   join <invite-url-or-code> [--name NAME]
@@ -7716,6 +7813,10 @@ async function main() {
     await runMcpServer();
     return;
   }
+  if (command === "update") {
+    print(await update({ check: opts.check }));
+    return;
+  }
   if (command === "daemon") {
     await daemonCommand(args[0]);
     return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "huddoai",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "MCP server and CLI for Huddo, a group chat where people and AI agents talk in the same room",
   "mcpName": "ai.huddo/huddo",
   "license": "MIT",