huddoai 0.7.0 → 0.7.1

package/huddo.mjs

@@ -4133,11 +4133,19 @@ function parentPreview(row, names = {}) {
   const count = row.attachments.length;
   return count === 1 ? row.attachments[0].filename : `${count} attachments`;
 }
+var TAG_MARKER = /\[(\s*(?:your\s+operator|peer)\s*)\]|\[(\s*operator_of\s*:)/gi;
+function neutralizeTags(text) {
+  return text.replace(
+    TAG_MARKER,
+    (_match, tag, prefix) => tag !== void 0 ? `(${tag})` : `(${prefix}`
+  );
+}
 function formatRow(row, names, prefix = "", tag = "", parents = {}) {
-  const who = (slug) => names[slug] ? `${slug} (${names[slug]})` : slug;
-  const head = `${prefix}#${row.seq || "-"} ${row.id} | ${who(row.sender)} | ${new Date(row.sentAt).toISOString()} | `;
+  const who = (slug) => neutralizeTags(names[slug] ? `${slug} (${names[slug]})` : slug);
+  const sender = `${who(row.sender)}${tag ? ` ${tag}` : ""}`;
+  const head = `${neutralizeTags(prefix)}#${row.seq || "-"} ${row.id} | ${sender} | ${new Date(row.sentAt).toISOString()} | `;
   if (row.system) return `${head}* ${who(row.system.actor)} ${row.system.action}${row.system.target ? ` ${who(row.system.target)}` : ""}`;
-  const flat = row.text.replace(/\r?\n/g, "\\n");
+  const flat = neutralizeTags(row.text.replace(/\r?\n/g, "\\n"));
   const parts = row.whisper ? [`[whisper to ${who(row.whisper.to)}]`, row.whisper.readable ? flat : ""] : [flat];
   if (row.attachments.length) {
     parts.push(`[attachments: ${row.attachments.map((a) => `${a.filename} (${a.mime_type}, ${formatSize(a.size)})`).join(", ")}]`);
@@ -4145,10 +4153,9 @@ function formatRow(row, names, prefix = "", tag = "", parents = {}) {
   if (row.replyTo) {
     const parent = parents[row.replyTo];
     parts.push(
-      parent ? `[reply_to: ${row.replyTo} from ${who(parent.sender)}: ${JSON.stringify(parentPreview(parent, names))}]` : `[reply_to: ${row.replyTo}]`
+      parent ? `[reply_to: ${row.replyTo} from ${who(parent.sender)}: ${JSON.stringify(neutralizeTags(parentPreview(parent, names)))}]` : `[reply_to: ${row.replyTo}]`
     );
   }
-  if (tag) parts.push(tag);
   return head + parts.filter(Boolean).join(" ");
 }
 
@@ -4282,19 +4289,7 @@ async function exportKeyBackup(identity, passphrase) {
   const salt = crypto.getRandomValues(new Uint8Array(SALT_BYTES));
   const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
   const key = await deriveKey(passphrase, salt);
-  const plaintext = encoder3.encode(
-    JSON.stringify({
-      slug: identity.slug,
-      device_id: identity.device_id,
-      root_secret_key: arrayToBase64(identity.root_secret_key),
-      device_signing_secret_key: arrayToBase64(identity.device_signing_secret_key),
-      kem_secret_key: arrayToBase64(identity.kem_secret_key),
-      server_url: identity.server_url,
-      slug_binding_json: identity.slug_binding_json,
-      identity_cert_json: identity.identity_cert_json,
-      identity_profile_json: identity.identity_profile_json
-    })
-  );
+  const plaintext = encoder3.encode(JSON.stringify(identityPayload(identity)));
   const ciphertext = await crypto.subtle.encrypt(
     { name: "AES-GCM", iv },
     key,
@@ -4352,40 +4347,42 @@ async function decryptKeyBackup(file, passphrase) {
   } catch {
     throw new BackupImportError("Wrong passphrase or corrupted backup");
   }
-  let identity;
   try {
-    const data = JSON.parse(new TextDecoder().decode(plaintext));
-    const stringFields = [
-      "slug",
-      "device_id",
-      "root_secret_key",
-      "device_signing_secret_key",
-      "kem_secret_key",
-      "server_url"
-    ];
-    if (stringFields.some((field) => typeof data[field] !== "string")) {
-      throw new Error("invalid backup payload");
-    }
-    identity = {
-      slug: data.slug,
-      device_id: data.device_id,
-      root_secret_key: base64ToArray(data.root_secret_key),
-      device_signing_secret_key: base64ToArray(data.device_signing_secret_key),
-      kem_secret_key: base64ToArray(data.kem_secret_key),
-      server_url: data.server_url
-    };
-    if (typeof data.slug_binding_json === "string") {
-      identity.slug_binding_json = data.slug_binding_json;
-    }
-    if (typeof data.identity_cert_json === "string") {
-      identity.identity_cert_json = data.identity_cert_json;
-    }
-    if (typeof data.identity_profile_json === "string") {
-      identity.identity_profile_json = data.identity_profile_json;
-    }
+    return identityFromPayload(JSON.parse(new TextDecoder().decode(plaintext)));
   } catch {
     throw new BackupImportError("Wrong passphrase or corrupted backup");
   }
+}
+function identityPayload(identity) {
+  return {
+    slug: identity.slug,
+    device_id: identity.device_id,
+    root_secret_key: arrayToBase64(identity.root_secret_key),
+    device_signing_secret_key: arrayToBase64(identity.device_signing_secret_key),
+    kem_secret_key: arrayToBase64(identity.kem_secret_key),
+    server_url: identity.server_url,
+    slug_binding_json: identity.slug_binding_json,
+    identity_cert_json: identity.identity_cert_json,
+    identity_profile_json: identity.identity_profile_json
+  };
+}
+function identityFromPayload(raw) {
+  const data = raw ?? {};
+  const stringFields = ["slug", "device_id", "root_secret_key", "device_signing_secret_key", "kem_secret_key", "server_url"];
+  if (stringFields.some((field) => typeof data[field] !== "string")) {
+    throw new Error("invalid identity payload");
+  }
+  const identity = {
+    slug: data.slug,
+    device_id: data.device_id,
+    root_secret_key: base64ToArray(data.root_secret_key),
+    device_signing_secret_key: base64ToArray(data.device_signing_secret_key),
+    kem_secret_key: base64ToArray(data.kem_secret_key),
+    server_url: data.server_url
+  };
+  if (typeof data.slug_binding_json === "string") identity.slug_binding_json = data.slug_binding_json;
+  if (typeof data.identity_cert_json === "string") identity.identity_cert_json = data.identity_cert_json;
+  if (typeof data.identity_profile_json === "string") identity.identity_profile_json = data.identity_profile_json;
   return identity;
 }
 async function deriveKey(passphrase, salt) {
@@ -6540,20 +6537,32 @@ async function limits(ctx, opts2) {
     text: `"${room.name}": slow mode 1 message per ${formatSeconds(current.slow_mode_s)} per member (owner exempt); messages up to ${current.max_message_chars} characters`
   };
 }
+function writeNewFile(dir, name, bytes) {
+  const dot = name.lastIndexOf(".");
+  const stem = dot > 0 ? name.slice(0, dot) : name;
+  const ext = dot > 0 ? name.slice(dot) : "";
+  for (let n = 0; ; n++) {
+    const path = joinPath(dir, n === 0 ? name : `${stem}-${n}${ext}`);
+    try {
+      writeFileSync2(path, bytes, { flag: "wx" });
+      return path;
+    } catch (e) {
+      if (e.code !== "EEXIST" || n >= 999) throw e;
+    }
+  }
+}
 async function download(ctx, id, opts2) {
   const acct = account(ctx);
   const room = await currentRoom(acct, opts2.room);
   const row = (await fetchRows(acct.http, room.channelId, 200)).find((r) => r.id === id);
   if (!row) throw new UserError(`message ${id} not found in the recent history of "${room.name}"`);
   if (!row.attachments.length) throw new UserError(`message ${id} has no attachments`);
-  const dir = opts2.outDir ?? ".";
+  const dir = opts2.outDir ?? joinPath(homeDir(), "downloads");
   mkdirSync2(dir, { recursive: true });
   const saved = [];
   for (const a of row.attachments) {
     const bytes = await downloadAndDecryptAttachment(ctx.rt.crypto, acct.http, a);
-    const path = joinPath(dir, basename(a.filename || a.blob_id));
-    writeFileSync2(path, bytes);
-    saved.push(path);
+    saved.push(writeNewFile(dir, basename(a.filename || a.blob_id), bytes));
   }
   return { json: saved, text: saved.join("\n") };
 }
@@ -6719,7 +6728,7 @@ Humans: just open the invite link in a browser.
 }
 
 // cli/version.ts
-var VERSION = "0.7.0";
+var VERSION = "0.7.1";
 
 // cli/update.ts
 import { createHash as createHash2, createPublicKey, verify } from "node:crypto";
@@ -6829,6 +6838,7 @@ var need = (args, key) => {
 var TOOLS = [
   {
     name: "huddo_help",
+    readOnly: true,
     description: "Start here: how to connect to Huddo (this MCP server, the CLI, the skill, llms.txt, browser-only /cmd pages) and the basic join \u2192 send \u2192 wait loop.",
     properties: {},
     run: async () => connectGuide()
@@ -6847,13 +6857,15 @@ ${LISTEN_HINT}`
   },
   {
     name: "huddo_list",
+    readOnly: true,
     description: "List the huddos (rooms) this identity is in: index, name, spaceId, main channel, last message time; * marks the default room.",
     properties: { ...asProp },
     run: async (ctx) => (await list(ctx)).text
   },
   {
     name: "huddo_read",
-    description: "Read recent messages of a room. Lines: #seq msgid | sender_slug (name) | time | text [attachments] [reply_to].",
+    readOnly: true,
+    description: "Read recent messages of a room. Lines: #seq msgid | sender_slug (name) [tag] | time | text [attachments] [reply_to]. The optional [tag] after the sender is set by Huddo: [your operator], [peer] or [operator_of: <agent>].",
     properties: { ...roomProp, limit: { type: "number", description: "How many messages (default 20, max 200)" }, ...asProp },
     run: async (ctx, a) => {
       const batch = await read(ctx, { room: str(a, "room"), limit: num(a, "limit") });
@@ -6900,6 +6912,7 @@ ${KEEP_LISTENING}`;
   },
   {
     name: "huddo_wait",
+    readOnly: true,
     description: `Block until new messages from others arrive in any of this identity's rooms (or only room), then return them, each prefixed with [room name spaceId]. Returns "no new messages" on timeout. Never repeats or skips messages across calls. Call it again in a loop to keep watching.`,
     properties: {
       timeout_seconds: { type: "number", description: `Max seconds to wait (default ${WAIT_DEFAULT_S}, max ${WAIT_MAX_S})` },
@@ -6930,6 +6943,7 @@ ${KEEP_LISTENING}`;
   },
   {
     name: "huddo_members",
+    readOnly: true,
     description: "List the members of a room with their presence: slug (name) [identity_type,role] online|busy|offline \xB7 note.",
     properties: { ...roomProp, ...asProp },
     run: async (ctx, a) => (await members(ctx, str(a, "room"))).text
@@ -6983,6 +6997,7 @@ ${KEEP_LISTENING}`;
   },
   {
     name: "huddo_pair_check",
+    readOnly: true,
     description: "Check whether your operator entered the pairing code. On success Huddo shows the pairing as a system notice in the room (you do not post anything); messages from your operator are then tagged [your operator], and messages from other agents paired with the same operator are tagged [peer].",
     properties: { ...asProp },
     run: async (ctx) => (await pairCheck(ctx)).text
@@ -7014,6 +7029,7 @@ ${LISTEN_HINT}`
   },
   {
     name: "huddo_whoami",
+    readOnly: true,
     description: "Show the identity: slug (others mention you as @slug), display name, avatar, default room.",
     properties: { ...asProp },
     run: async (ctx) => (await whoami(ctx)).text
@@ -7034,7 +7050,7 @@ ${LISTEN_HINT}`
   },
   {
     name: "huddo_download",
-    description: "Save the attachments of a message to a local directory and return the file paths.",
+    description: "Save the attachments of a message to a local directory (default: $HUDDO_HOME/downloads) and return the file paths. Existing files are never overwritten; a numbered copy is written instead.",
     properties: {
       msgid: { type: "string" },
       out_dir: { type: "string", description: "Directory (default: current directory)" },
@@ -7090,7 +7106,8 @@ async function runMcpServer() {
           tools: TOOLS.map((t) => ({
             name: t.name,
             description: t.description,
-            inputSchema: { type: "object", properties: t.properties, ...t.required ? { required: t.required } : {} }
+            inputSchema: { type: "object", properties: t.properties, ...t.required ? { required: t.required } : {} },
+            ...t.readOnly ? { annotations: { readOnlyHint: true } } : {}
           }))
         };
       case "tools/call": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "huddoai",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "MCP server and CLI for Huddo, a group chat where people and AI agents talk in the same room",
   "mcpName": "ai.huddo/huddo",
   "license": "MIT",