relic-mcp 0.12.0 → 0.13.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
     {
       "name": "relic",
       "description": "Publish a file from your machine as an encrypted, shareable link. The agent encrypts locally, uploads only ciphertext, and hands back a URL whose fragment holds the key, so the service stores something it cannot read.",
-      "version": "0.12.0",
+      "version": "0.13.0",
       "source": "./",
       "author": {
         "name": "The Bushido Collective",
@@ -21,6 +21,6 @@
     }
   ],
   "metadata": {
-    "version": "0.12.0"
+    "version": "0.13.0"
   }
 }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "relic",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Publish a file from your machine as an encrypted, shareable link. The agent encrypts locally, uploads only ciphertext, and hands back a URL whose fragment holds the key, so the service stores something it cannot read.",
   "mcpServers": "./mcp-servers.json",
   "author": {

package/README.md

@@ -25,23 +25,30 @@ For any client that takes a JSON config:
 ## What it does with your file
 
 1. Reads it from disk, in this process. It is never sent anywhere in plaintext.
+   A standard OpenTimelineIO directory (`.otiod`) is automatically packaged into
+   a deterministic standard `.otioz` archive; arbitrary directories are refused.
 2. Draws a 128-bit key and a 26-character relic id independently from your
    machine's CSPRNG. Neither derives from the other.
 3. Encrypts locally with AES-128-GCM under RFC 8188 `aes128gcm` framing.
 4. Uploads **only ciphertext**, straight to object storage under a signed URL.
    It does not pass through the Relic service.
-5. Tells the service four things: a coarse renderer class from an eight-value
-   list, this client's name, the ciphertext's byte length, and the title, which
-   defaults to the filename and is stored in the clear. By default, it also
-   renders a 1200x630 cover image of the file's first screen in local headless
-   Chrome and uploads it unencrypted via `POST /api/relics/{id}/cover` for link
-   preview cards (pass `cover: false` to decline). Not the mimetype, not the
-   contents.
+5. Tells the service four things: a coarse renderer class from a ten-value
+   list (`markdown`, `code`, `html`, `jsx`, `image`, `pdf`, `media`, `archive`,
+   `binary`, `otio`), this client's name, the ciphertext's byte length, and the
+   title, which defaults to the filename and is stored in the clear. By default,
+   it also renders a 1200x630 cover image of the file's first screen in local
+   headless Chrome and uploads it unencrypted via `POST /api/relics/{id}/cover`
+   for link preview cards (pass `cover: false` to decline). OpenTimelineIO
+   timeline relics (`otio`) skip unencrypted first-screen media rendering by
+   default, using a generic card carrying the title and format label to protect
+   private timeline cuts and media from leaking into unencrypted link previews.
+   Not the mimetype, not the contents.
 6. Records the relic's id, key, and publish token locally, in a 0600 file
    under your user config directory, so the relic can be republished from
-   this machine later. See [Republishing](#republishing). The service never
-   receives the key or the token plaintext; it keeps only a SHA-256 of the
-   token.
+   this machine later. See [Republishing](#republishing). Preserves logical
+   source identity for `.otiod` directories as the original directory path so
+   republishing detects the source across sessions. The service never receives
+   the key or the token plaintext; it keeps only a SHA-256 of the token.
 7. Returns a shareable URL whose fragment holds the decryption key. Fragments
    are never sent to a server by a browser.
 Call the `relic_describe_client` tool and it will tell you all of this itself,
@@ -147,15 +154,28 @@ Encryption has to happen where the plaintext is, so a hosted version of this
 would have to receive your file, which defeats the point. Nothing here is
 fetched from the network and executed.
 
-Because a local client is otherwise opaque, it ships as **readable source
-rather than a compiled binary**. `dist/relic-mcp.js` is a single unminified
-file and it is exactly what runs; the TypeScript it was built from is in the
-same package. The cover rendering page assets in `dist/cover/` contain the
+The client ships its JavaScript as readable source: `dist/relic-mcp.js` is a
+single unminified file and the TypeScript it was built from is in the same
+package. There is one narrow exception for automatic `.otiod` directory
+packaging. It uses a source-included Node-API secure-open helper, prebuilt in
+the npm tarball for macOS arm64 and x64 with a 15.0 binary deployment floor,
+plus glibc 2.28 or newer Linux on arm64 and x64. On either platform, before it
+reads a bundle, the helper verifies on the running kernel that beneath-root
+resolution refuses parent and absolute escapes from a held directory and that
+the no-symlink flag is accepted. Symlink refusal, held-descriptor behavior, and
+replacement behavior are verified by the CI probe on the listed versions. It
+never downloads a helper, invokes Python, or compiles at install or publish
+time. A missing packaged target or failed capability check refuses `.otiod`
+packaging rather than using a pathname fallback. Ordinary file publishing
+remains plain Node 18 or newer. The cover
+rendering page assets in `dist/cover/` contain the
 unminified cover bundle built from `@relic/viewer`, with vendored React, pdfjs,
 and sucrase for offline document rendering in local Chrome. Releases carry npm
 provenance, a cryptographic attestation binding the tarball to a specific commit
 and workflow.
 
+The manual release workflow requires an exact SemVer 2.0.0 version, accepts prerelease and build metadata, validates it before release metadata changes, and passes it as environment data rather than executable shell source.
+
 ### Cover rendering and local Chrome requirement
 
 By default, publishing or republishing renders a 1200x630 cover image in an
@@ -180,10 +200,10 @@ relic plaintext leaves the machine during rendering.
 | `relic_lookup_source` | `path` | Reads local state to find whether this machine already published that file, and returns the exact `relic_republish` call. Calls no server. |
 | `relic_list` | optional `limit`, `include_expired`, `verify`, `refresh` | Every relic this machine published, newest first. The only tool that enumerates: lookup answers only from the file a relic came from. A name this machine never recorded is recovered by decrypting the relic's own envelope in one 64 KB range request, or comes back `null` with the reason. A relic the service will not serve is listed with which of removed, expired, exhausted, or unreachable it is. Each row carries the share URL, fragment included, so each row is a credential. Reaching the service spends one of a relic's finite opens; recovered names are cached, so a repeat listing spends none. |
 | `relic_show` | `relic_id`, optional `include_content` | One relic in detail, including how many versions the service holds against how many this machine recorded, and with `include_content` the current decrypted content. Read it before republishing anything you did not just write: republish replaces what the link serves, so without the read-back the edit is blind. Content that is not valid UTF-8 is reported as size and type rather than mangled text. |
-| `relic_republish` | `relic_id`, `path`, optional `filename`, `title`, `cover`, `ttl_days`, `addresses`, `notify` | Publishes a new version under the same key, so the share URL is unchanged. Replaces the plaintext title (defaults to the new filename; pass `""` to remove it). Replaces the cover image with a newly rendered cover, or clears it if `cover: false` is passed. Sends a change notice email to everyone following the relic unless `notify: false` is passed. Works only on the machine holding that relic's key and publish token; a taken-down relic can never be revived. |
-| `relic_share` | `relic_id`, `emails` | Send a relic this machine published to named people. Registers up to 20 email addresses with the service for change notices on future versions, and returns a composed share email and mailto link to draft in the sharer's own mailbox. Addresses are stored in the clear by the service, linked to the relic id. Relic never sends the share email. Readers holding the link can also share from the viewer once this client version has published or republished the relic. |
+| `relic_republish` | `relic_id`, `path`, optional `filename`, `title`, `cover`, `ttl_days`, `addresses`, `notify` | Publishes a new version under the same key, so the share URL is unchanged. Replaces the plaintext title (defaults to the new filename; pass `""` to remove it). Replaces the cover image with a newly rendered cover, or clears it if `cover: false` is passed. Sends a change notice email to everyone following the relic unless `notify: false` is passed. At most one email per person per relic per 10 minutes is sent, and one stop link stops every email about that relic. Works only on the machine holding that relic's key and publish token; a taken-down relic can never be revived. |
+| `relic_share` | `relic_id`, `emails` | Send a relic this machine published to named people. Registers up to 20 email addresses with the service for change and comment notices, and returns a composed share email and mailto link to draft in the sharer's own mailbox. Addresses are stored in the clear by the service, linked to the relic id. A new comment emails everyone on the list except the author, naming the commenter's address (or 'The publisher'). At most one email per person per relic per 10 minutes, and one stop link stops every email about that relic. Relic never sends the share email. Readers holding the link can also share from the viewer once this client version has published or republished the relic. |
 | `relic_read_comments` | `relic_id` | Returns the relic's comments oldest first, decrypted locally, with the author and a count of any that would not decrypt. Works only on the machine that published. |
-| `relic_comment` | `relic_id`, `body`, optional `display_name` | Leaves a comment, encrypted on this machine, authorized by the publish token and attributed as `publisher`. Body caps at 4096 bytes of UTF-8. |
+| `relic_comment` | `relic_id`, `body`, optional `display_name` | Leaves a comment, encrypted on this machine, authorized by the publish token and attributed as `publisher`. Warning: posting emails everyone following the relic, naming 'The publisher'. At most one email per person per relic per 10 minutes, and one stop link stops every email about that relic. Body caps at 4096 bytes of UTF-8. |
 | `relic_describe_client` | none | Explains the encryption path. Reads nothing, sends nothing. |
 
 ## Environment
@@ -209,6 +229,20 @@ that does outlive a call is the per-machine publish state file described
 above. The handshake-based revisions (`2025-11-25` and earlier) are still
 answered.
 
-Requires Node 18 or newer.
+Requires Node 18 or newer. Automatic `.otiod` packaging additionally requires
+one of four packaged targets: macOS arm64 or x64 with a 15.0 binary deployment
+floor, or Linux glibc 2.28+ arm64 or x64. On either platform, before it reads
+a bundle, the helper verifies on the running kernel that beneath-root
+resolution refuses parent and absolute escapes from a held directory and that
+the no-symlink flag is accepted. Symlink refusal, held-descriptor behavior, and
+replacement behavior are verified by the CI probe on the listed versions. A
+target or kernel that cannot satisfy that requirement refuses directory
+conversion without reducing ordinary file publishing.
+
+Tested on macOS: CI native probes in dry run `39652819003` on macOS 15.7.9
+(`24G830`), Darwin 24.6.0 (`xnu-11417.140.69.711.44~1`) on arm64 and x64, with
+Xcode 26.0.1 and SDK 26.0 plus Xcode 16.4 and SDK 15.5; local macOS 27.0.1
+(`26A434`), Darwin 27.0.0 arm64, Homebrew clang 22.1.8, and SDK 27. An earlier
+historical local probe used Xcode clang 21.0.0 and SDK 27.
 
 MIT licensed. Source: https://github.com/TheBushidoCollective/relic