openfused 0.3.13 → 0.3.15

package/README.md

@@ -67,11 +67,11 @@ history/       — archived [DONE] context
 openfuse context
 openfuse context --append "## Update\nFinished the research phase."
 
-# Mark work as done, then compact to history/
+# Mark work as done, then compact to history/ (TS CLI only)
 # (edit CONTEXT.md, add [DONE] to the header, then:)
 openfuse compact
 
-# Add validity windows to time-sensitive context
+# Add validity windows to time-sensitive context (TS CLI only)
 # <!-- validity: 6h --> for task state, 1d for sprint, 3d for architecture
 openfuse validate                    # scan for stale entries
 openfuse compact --prune-stale       # archive expired validity windows
@@ -181,7 +181,7 @@ Pull peer context, pull their outbox for your mail, push your outbox. Two transp
 
 ```bash
 # LAN — rsync over SSH (uses your ~/.ssh/config for host aliases)
-openfuse peer add ssh://alice.local:/home/agent/context --name wisp
+openfuse peer add ssh://your-server:/home/agent/store --name wisp
 
 # WAN — HTTP against the OpenFused daemon
 openfuse peer add https://wisp.openfused.dev --name wisp
@@ -193,7 +193,7 @@ openfuse sync
 openfuse watch
 
 # Watch + reverse SSH tunnel (NAT traversal)
-openfuse watch --tunnel alice.local
+openfuse watch --tunnel your-server
 ```
 
 Sync does three things:
@@ -276,7 +276,7 @@ Public mode endpoints:
 openfuse watch -d ./store                      # sync every 60s
 openfuse watch -d ./store --sync-interval 30   # sync every 30s
 openfuse watch -d ./store --sync-interval 0    # local watch only
-openfuse watch -d ./store --tunnel alice.local  # + reverse SSH tunnel
+openfuse watch -d ./store --tunnel your-server  # + reverse SSH tunnel
 ```
 
 ## Reachability

package/dist/cli.js

@@ -9,7 +9,18 @@ import { fingerprint } from "./crypto.js";
 import { resolve, join } from "node:path";
 import { readFile } from "node:fs/promises";
 import { parseValiditySections, buildValidityReport } from "./validity.js";
-const VERSION = "0.3.13";
+import { createRequire } from "node:module";
+const VERSION = createRequire(import.meta.url)("../package.json").version;
+// Enable proxy support: Node.js built-in fetch doesn't respect HTTP_PROXY env vars.
+// Setting a global EnvHttpProxyAgent makes all fetch() calls proxy-aware —
+// essential for corporate networks, containers, and tunneled environments.
+if (process.env.https_proxy || process.env.HTTPS_PROXY || process.env.http_proxy || process.env.HTTP_PROXY) {
+    try {
+        const { EnvHttpProxyAgent, setGlobalDispatcher } = await import("undici");
+        setGlobalDispatcher(new EnvHttpProxyAgent());
+    }
+    catch { }
+}
 const program = new Command();
 program
     .name("openfuse")

package/dist/mcp.js

@@ -10,6 +10,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { z } from "zod";
 import { ContextStore, validateName } from "./store.js";
 import { resolve } from "node:path";
+import { createRequire } from "node:module";
 // LLMs will pass whatever filenames users ask for — including "../../etc/shadow".
 // This is the trust boundary between the AI and the filesystem.
 function sanitizeFilename(name) {
@@ -23,7 +24,7 @@ const storeDir = process.env.OPENFUSE_DIR || process.argv[3] || ".";
 const store = new ContextStore(resolve(storeDir));
 const server = new McpServer({
     name: "openfuse",
-    version: "0.3.13",
+    version: createRequire(import.meta.url)("../package.json").version,
 });
 // --- Context ---
 server.tool("context_read", "Read the agent's CONTEXT.md (working memory)", async () => {

package/dist/sync.js

@@ -203,15 +203,33 @@ async function syncHttp(store, peer, baseUrl, peerDir) {
             for (const msg of messages) {
                 const ts = (msg.timestamp || new Date().toISOString()).replace(/[:.]/g, "-");
                 const from = msg.from || "unknown";
-                // SECURITY: sanitize remote-controlled values before constructing local filenames.
-                // Without this, a malicious "from" like "../../.keys/x" could write outside inbox/.
                 const safeFrom = from.replace(/[^a-zA-Z0-9\-_]/g, "");
                 const safeTs = ts.replace(/[^a-zA-Z0-9\-_]/g, "");
                 const fname = `${safeTs}_from-${safeFrom}_to-${myName}.json`;
+                const outboxFile = msg._outboxFile; // filename on sender's outbox
                 const dest = join(inboxDir, fname);
                 if (!existsSync(dest)) {
-                    await writeFile(dest, JSON.stringify(msg, null, 2));
+                    // Strip the _outboxFile metadata before saving
+                    const { _outboxFile, ...cleanMsg } = msg;
+                    await writeFile(dest, JSON.stringify(cleanMsg, null, 2));
                     pulled.push(`outbox→${fname}`);
+                    // ACK: tell sender to move this message to .sent/
+                    if (outboxFile) {
+                        try {
+                            const ackTs = new Date().toISOString();
+                            const ackChallenge = `ACK:${myName}:${outboxFile}:${ackTs}`;
+                            const ackSig = await signChallenge(store.root, ackChallenge);
+                            await fetch(`${baseUrl}/outbox/${myName}/${outboxFile}`, {
+                                method: "DELETE",
+                                headers: {
+                                    "X-OpenFuse-PublicKey": ackSig.publicKey,
+                                    "X-OpenFuse-Signature": ackSig.signature,
+                                    "X-OpenFuse-Timestamp": ackTs,
+                                },
+                            });
+                        }
+                        catch { } // best-effort ACK
+                    }
                 }
             }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openfused",
-  "version": "0.3.13",
+  "version": "0.3.15",
   "description": "The file protocol for AI agent context. Encrypted, signed, peer-to-peer.",
   "license": "MIT",
   "type": "module",
@@ -29,6 +29,7 @@
     "chokidar": "^5.0.0",
     "commander": "^14.0.0",
     "nanoid": "^5.1.7",
+    "undici": "^7.24.5",
     "zod": "^4.3.6"
   },
   "devDependencies": {