kojee-mcp 0.5.2 → 0.5.3

package/README.md

@@ -220,6 +220,35 @@ in it is Hermes-specific — and it is **OFF by default**.
 | `KOJEE_WEBHOOK_SECRET` | HMAC-SHA256 key for the signature header. URL set but secret unset ⇒ sink **DISABLED with an error** (the proxy NEVER sends unsigned webhooks). |
 | `KOJEE_WEBHOOK_TIMEOUT_MS` | Per-attempt request timeout (default `5000`). |
 | `KOJEE_WEBHOOK_MAX_RETRIES` | Retries on a retryable failure — network / 5xx / 408 / 429 (default `4`). |
+| `KOJEE_WEBHOOK_SIGNATURE_HEADER` | Header name carrying the signature (default `X-Kojee-Signature`). |
+| `KOJEE_WEBHOOK_SIGNATURE_PREFIX` | Literal string prepended to the hex digest (default empty — bare hex). |
+| `KOJEE_WEBHOOK_SIGNATURE_FORMAT` | Optional preset. `github` ⇒ header `X-Hub-Signature-256`, prefix `sha256=` (the GitHub-webhook convention). Explicit `_HEADER`/`_PREFIX` vars override the preset's corresponding value. Unknown values are **warned about once and ignored** — never fatal. |
+
+**Signature emission is configurable (0.5.3)** — the HMAC *computation* never
+changes (hex SHA-256 HMAC of the raw body bytes, keyed by
+`KOJEE_WEBHOOK_SECRET`); only the header name and an optional digest prefix do.
+Defaults are byte-identical to 0.5.2. For a GitHub-convention receiver (Hermes
+and most off-the-shelf webhook verifiers):
+
+```bash
+export KOJEE_WEBHOOK_SIGNATURE_FORMAT=github
+# Each POST then carries:
+#   X-Hub-Signature-256: sha256=<hex HMAC-SHA256 of the raw body, keyed by KOJEE_WEBHOOK_SECRET>
+# which verifies with any GitHub-style check, e.g.:
+#   expected = "sha256=" + HMAC_SHA256_hex(secret, raw_body)
+#   timing_safe_equal(header, expected)
+```
+
+Or set the pieces individually (these override the preset):
+
+```bash
+export KOJEE_WEBHOOK_SIGNATURE_HEADER="X-Hub-Signature-256"
+export KOJEE_WEBHOOK_SIGNATURE_PREFIX="sha256="
+```
+
+The wizard can persist this non-interactively, e.g.
+`kojee-mcp init --runtime hermes --webhook-url https://… --webhook-signature-format github`
+(also `--webhook-signature-header` / `--webhook-signature-prefix`).
 
 **Receiver contract** (the single source of truth is `buildWebhookReceiverNote()`
 in `src/tandem/recipe.ts`, and the exact body shape is the `WEBHOOK_BODY_SHAPE`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kojee-mcp",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "type": "module",
   "main": "dist/index.js",
   "bin": {