nattermatic 0.2.0 → 0.2.1

package/README.md

@@ -2,7 +2,8 @@
 
 # nattermatic
 
-Let AI agents on different Claude accounts — and different machines — message each other.
+**[nattermatic.com](https://nattermatic.com)** · Let AI agents message each other across different
+agents, accounts and machines.
 Claude Code's own messaging needs every session on one account; nattermatic doesn't. Address any
 agent as `name@host` (e.g. `reviewer@laptop.local`). An incoming message **wakes an idle Claude
 Code or Codex session**, just like agents talking on a single machine.

package/install.sh

@@ -110,7 +110,10 @@ install_app() {
       return 1
     fi
   else
-    if ! curl -fsSL "$RELEASES/nattermatic-macos-arm64.zip" -o "$TMP/app.zip" ||
+    # about 40 MB, so it can take a minute or two: say so, with a progress bar when there's a terminal to see it
+    echo "Downloading nattermatic.app (about 40 MB)..."
+    BAR=-s; [ -t 2 ] && BAR=-#
+    if ! curl -fSL "$BAR" "$RELEASES/nattermatic-macos-arm64.zip" -o "$TMP/app.zip" ||
        ! curl -fsSL "$RELEASES/nattermatic-macos-arm64.zip.sha256" -o "$TMP/app.sha256"; then
       no_app "from the latest release" && link_app && return 0
       return 1

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "nattermatic",
-  "version": "0.2.0",
-  "description": "Let AI agents on different Claude accounts and machines natter to each other — incoming messages wake idle Claude Code and Codex sessions",
+  "version": "0.2.1",
+  "description": "Let AI agents natter to each other across different agents, accounts and machines — incoming messages wake idle Claude Code and Codex sessions",
   "mcpName": "io.github.tombaldwin/nattermatic",
   "keywords": [
     "claude",

package/src/claude.js

@@ -202,11 +202,16 @@ export function register(dir) {
   if (wakeSupport().ok) installHook(dir)
 }
 
-/** @param {string} dir */
+/**
+ * Remove nattermatic from a Claude account. Returns false if Claude Code wasn't found to remove its
+ * MCP server registration (only the hook was removed).
+ * @param {string} dir
+ */
 export function unregister(dir) {
   const claude = claudeBin()
   if (claude) for (const name of ['nattermatic', 'agentlink']) spawnSync(claude, ['mcp', 'remove', '-s', 'user', name], { stdio: 'ignore', env: envFor(dir) })
   removeHook(dir)
+  return !!claude
 }
 
 // The hook that wakes idle sessions. It ends when it wakes the session, so each of these arms it

package/src/config.js

@@ -5,7 +5,7 @@ import crypto from 'node:crypto'
 import { execFileSync } from 'node:child_process'
 import { fingerprint } from './cert.js'
 
-export const VERSION = '0.2.0'
+export const VERSION = '0.2.1'
 
 export function homeDir() {
   return process.env.NATTERMATIC_HOME || path.join(os.homedir(), '.nattermatic')

package/src/legacy.js

@@ -49,6 +49,8 @@ export function removeOldService() {
  * still use the old path. Only for the usual home, and only if `home` doesn't exist yet or holds
  * nothing but what the installer has just put there (bin, pkg, node): entries already in `home`
  * win, and what's left of the old home is the old program, which the new one replaces.
+ * If ~/.agentlink is itself a link (to a folder on another disk, say), the data stays where it is:
+ * the installer's entries go into that folder and `home` becomes a link to it too.
  * Returns what happened, or null if there was nothing to move.
  * @param {string} home @returns {string | null}
  */
@@ -56,13 +58,32 @@ export function moveOldHome(home) {
   const old = oldHome()
   let st
   try { st = fs.lstatSync(old) } catch { return null }
-  if (!st.isDirectory() || path.resolve(home) === old) return null
+  /** @type {string | null} */
+  let target = null          // where a linked ~/.agentlink really is
+  if (st.isSymbolicLink()) {
+    try { target = fs.realpathSync(old) } catch { return `${old} was left alone: it is a link to a folder that isn't there` }
+    if (!fs.statSync(target).isDirectory()) return null
+    let real = null
+    try { real = fs.realpathSync(home) } catch {}
+    if (real === target) return null                 // moved already: both names lead to the same folder
+  } else if (!st.isDirectory()) return null
+  if (path.resolve(home) === old) return null
   const installed = new Set(['bin', 'pkg', 'node'])
   /** @type {string[]} */
   let have = []
   try { have = fs.readdirSync(home) } catch {}
   if (have.some(e => !installed.has(e))) return `${old} was left alone: ${home} is already in use`
   removeOldService()
+  if (target) {
+    // the new program replaces the old one in that folder; then home leads there
+    for (const e of have) {
+      fs.rmSync(path.join(target, e), { recursive: true, force: true })
+      moveEntry(path.join(home, e), path.join(target, e))
+    }
+    fs.rmSync(home, { recursive: true, force: true })
+    fs.symlinkSync(target, home)
+    return `linked ${home} to ${target}, where ${old} leads`
+  }
   if (!have.length) {
     fs.rmSync(home, { recursive: true, force: true })
     fs.renameSync(old, home)
@@ -74,6 +95,15 @@ export function moveOldHome(home) {
   return `moved ${old} to ${home}`
 }
 
+/** rename, or copy and remove when the two are on different disks. @param {string} from @param {string} to */
+function moveEntry(from, to) {
+  try { fs.renameSync(from, to) } catch (e) {
+    if (/** @type {NodeJS.ErrnoException} */ (e).code !== 'EXDEV') throw e
+    fs.cpSync(from, to, { recursive: true, verbatimSymlinks: true })
+    fs.rmSync(from, { recursive: true, force: true })
+  }
+}
+
 /**
  * The database's old file name, renamed once nothing has it open: called by the node after it has
  * the port, so no other node of this machine is running.

package/src/local.js

@@ -9,7 +9,7 @@ import path from 'node:path'
 import { spawn } from 'node:child_process'
 import crypto from 'node:crypto'
 import { authedRequest, authedRaw, PinError, PROTO } from './tls.js'
-import { cmpVersion, ensureHomeDir, errMsg, rosterPath, sleep, VERSION } from './config.js'
+import { cmpVersion, ensureHomeDir, errMsg, readIdentity, rosterPath, sleep, VERSION } from './config.js'
 import { Roster } from './roster.js'
 import { selfCmd } from './claude.js'
 
@@ -55,6 +55,20 @@ export class Local {
     this.accept = new Map([[cfg.identity.fp, crypto.createPublicKey(cfg.identity.key)]])
   }
 
+  /**
+   * This machine's key as it is on disk now: `natter setup --new-network` (or joining another
+   * network) replaces it while long-lived clients, like MCP adapters, keep running, and the node
+   * they reach then proves the new key. Returns whether it changed.
+   */
+  reloadIdentity() {
+    let id = null
+    try { id = readIdentity(this.cfg.dir) } catch {}
+    if (!id || id.fp === this.cfg.identity.fp) return false
+    this.cfg.identity = id
+    this.accept = new Map([[id.fp, crypto.createPublicKey(id.key)]])
+    return true
+  }
+
   /** @param {{ path: string, method?: 'GET' | 'POST', body?: string, timeout?: number, signal?: AbortSignal }} o */
   // anyProto: after an upgrade the running node may be the previous version; setup must still reach it to stop it
   opts(o) { return { addr: this.addr, identity: this.cfg.identity, accept: this.accept, dks: readDks(this.cfg.dir), anyProto: true, ...o } }
@@ -74,9 +88,14 @@ export class Local {
    */
   async req(method, p, obj, query = '', timeout = 15_000) {
     let r
+    const send = () => authedRequest(this.opts({ method, path: p + query, body: obj === undefined ? '' : JSON.stringify(obj), timeout }), MAX_LOCAL_REPLY)
     try {
-      r = await authedRequest(this.opts({ method, path: p + query, body: obj === undefined ? '' : JSON.stringify(obj), timeout }), MAX_LOCAL_REPLY)
-    } catch (e) { throw this.wrap(e) }
+      r = await send()
+    } catch (e) {
+      // refused before anything was sent: if this machine's key was replaced meanwhile, try again with the new one
+      if (!(e instanceof PinError) || !this.reloadIdentity()) throw this.wrap(e)
+      try { r = await send() } catch (e2) { throw this.wrap(e2) }
+    }
     /** @type {any} */
     let data = {}
     try { data = r.text ? JSON.parse(r.text) : {} } catch {}
@@ -90,6 +109,13 @@ export class Local {
    * @returns {Promise<import('./types.js').Health | { foreign: true } | null>}
    */
   async health() {
+    const h = await this.health1()
+    // the node may be this machine's under a key replaced since this process started
+    return h && 'foreign' in h && this.reloadIdentity() ? this.health1() : h
+  }
+
+  /** @returns {Promise<import('./types.js').Health | { foreign: true } | null>} */
+  async health1() {
     try {
       const r = await authedRequest(this.opts({ path: '/health', timeout: 1000 }))
       return r.status === 200 ? JSON.parse(r.text) : { foreign: true }

package/src/setup.js

@@ -50,11 +50,19 @@ export async function setup({ host, peers = [], noService, noClaude, noCodex, no
   if (join && (!pin || !token)) throw new Error('--join needs --pin and --token (use the line printed by `natter invite`)')
   if (join && !validAddr(join)) throw new Error(`--join: "${join}" is not a host:port address`)
   console.log(`natter setup`)
+  // a join first checks the machine at the invite's address presents the key the invite names (its
+  // invite key): before anything here is changed, so a used or expired invite leaves this machine as it was
+  /** @type {{ pem: string, fp: string } | undefined} */
+  let inviter
+  if (join) {
+    try { inviter = await peerCertificate(join) } catch (e) { throw new Error(`cannot reach ${join}: ${errMsg(e)}`) }
+    if (inviter.fp !== pin) throw new Error(`the machine at ${join} is not presenting this invite's key. Either the invite was already used, expired or was revoked (run \`natter invite\` on a member for a new one), or something else is answering at that address. Not joining.`)
+  }
   // a machine set up as agentlink, before the rename: it keeps its key, network and messages
   if (!homeElsewhere()) {
     try {
       const moved = moveOldHome(homeDir())
-      if (moved) (moved.startsWith('moved') ? ok : warn)(moved)
+      if (moved) (moved.includes('left alone') ? warn : ok)(moved)
       if (removeOldService()) ok('removed agentlink\'s background service')
       if (removeOldApp(appBundle())) ok('removed agentlink.app')
     } catch (e) { throw new Error(`could not move this machine's agentlink setup to nattermatic: ${errMsg(e)}`) }
@@ -97,10 +105,7 @@ export async function setup({ host, peers = [], noService, noClaude, noCodex, no
   let invite = false
 
   if (join) {
-    // 1. the machine at the invite's address must present the key the invite names (its invite key)
-    let inviter
-    try { inviter = await peerCertificate(join) } catch (e) { throw new Error(`cannot reach ${join}: ${errMsg(e)}`) }
-    if (inviter.fp !== pin) throw new Error(`the machine at ${join} is not presenting this invite's key. Either the invite was already used, expired or was revoked (run \`natter invite\` on a member for a new one), or something else is answering at that address. Not joining.`)
+    // 1. checked above: the machine at the invite's address presents the key the invite names
     // 2. keep this machine's key only if it is already a member of that same network (a key that
     // isn't carried between networks can't be used to link them)
     let same = member && !!netFp && roster?.net === netFp && !!identity
@@ -108,7 +113,7 @@ export async function setup({ host, peers = [], noService, noClaude, noCodex, no
     // 3. join: the inviter checks the token and adds our key under our name
     const ask = async () => {
       try {
-        return await pinnedRequest({ addr: join, method: 'POST', path: '/join', body: JSON.stringify({ token, host: myHost, cert: certDer(id.cert) }), trust: [{ pem: inviter.pem, fp: pin }], timeout: 20_000 })
+        return await pinnedRequest({ addr: join, method: 'POST', path: '/join', body: JSON.stringify({ token, host: myHost, cert: certDer(id.cert) }), trust: [/** @type {{ pem: string, fp: string }} */ (inviter)], timeout: 20_000 })
       } catch (e) { throw new Error(`could not join via ${join}: ${errMsg(e)}`) }
     }
     let r = await ask()
@@ -245,7 +250,12 @@ function restoreCert(roster) {
  */
 function leaveNetwork() {
   fs.rmSync(path.join(homeDir(), 'invite.key'), { force: true })
-  const file = path.join(homeDir(), 'nattermatic.db')
+  // agentlink.db: the database of a machine set up as agentlink, which the node renames when it next starts
+  for (const name of ['nattermatic.db', 'agentlink.db']) clearDb(path.join(homeDir(), name))
+}
+
+/** @param {string} file */
+function clearDb(file) {
   if (!fs.existsSync(file)) return
   try {
     const db = openStore(file)
@@ -430,9 +440,12 @@ export async function uninstall() {
   }
   if (homeElsewhere()) warn(`NATTERMATIC_HOME is ${homeDir()}, so the Claude accounts and shell files of ${os.homedir()} were left alone`)
   else {
+    let unfound = false
     for (const acct of claudeAccounts()) {
-      try { unregister(acct.dir) } catch (e) { warn(errMsg(e)) }     // one account's settings mustn't stop the rest
+      try { if (!unregister(acct.dir)) unfound = true } catch (e) { warn(errMsg(e)) }     // one account's settings mustn't stop the rest
     }
+    // its sessions would go on starting nattermatic's MCP server, which can only say it's uninstalled
+    if (unfound) warn('Claude Code was not found, so nattermatic is still registered with it: run `claude mcp remove -s user nattermatic` where claude is installed')
     removeShellBlock().forEach(warn)
     try { removeCodex() } catch (e) { warn(`Codex: ${errMsg(e)}`) }
   }