relic-mcp 0.9.0 → 0.10.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
     {
       "name": "relic",
       "description": "Publish a file from your machine as an encrypted, shareable link. The agent encrypts locally, uploads only ciphertext, and hands back a URL whose fragment holds the key, so the service stores something it cannot read.",
-      "version": "0.9.0",
+      "version": "0.10.0",
       "source": "./",
       "author": {
         "name": "The Bushido Collective",
@@ -21,6 +21,6 @@
     }
   ],
   "metadata": {
-    "version": "0.9.0"
+    "version": "0.10.0"
   }
 }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "relic",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Publish a file from your machine as an encrypted, shareable link. The agent encrypts locally, uploads only ciphertext, and hands back a URL whose fragment holds the key, so the service stores something it cannot read.",
   "mcpServers": "./mcp-servers.json",
   "author": {

package/dist/relic-mcp.js

@@ -3540,7 +3540,7 @@ function validatePublishStateEntry(entry, relicId) {
     throw new Error(`publish state at ${publishStatePath()} holds a malformed entry for ` + `relic ${relicId}.`);
   }
   const candidate = entry;
-  if (typeof candidate["key"] !== "string" || typeof candidate["publish_token"] !== "string" || typeof candidate["version"] !== "number" || !Number.isSafeInteger(candidate["version"]) || candidate["version"] < 1 || candidate["source"] !== undefined && !isSourceIdentity(candidate["source"])) {
+  if (typeof candidate["key"] !== "string" || typeof candidate["publish_token"] !== "string" || typeof candidate["version"] !== "number" || !Number.isSafeInteger(candidate["version"]) || candidate["version"] < 1 || candidate["source"] !== undefined && !isSourceIdentity(candidate["source"]) || candidate["content_sha256"] !== undefined && (typeof candidate["content_sha256"] !== "string" || !/^[0-9a-f]{64}$/.test(candidate["content_sha256"]))) {
     throw new Error(`publish state at ${publishStatePath()} holds a malformed entry for ` + `relic ${relicId}.`);
   }
   return candidate;
@@ -3825,6 +3825,11 @@ async function publish(input, deps) {
   const filename = input.filename ?? source.basename;
   const normalizedTitle = normalizeTitle(input.title ?? filename);
   const rendererClass = deriveRendererClass(source.bytes, filename);
+  const digest = await contentDigest({
+    content: source.bytes,
+    filename,
+    title: normalizedTitle
+  });
   const retries = deps.maxCollisionRetries ?? 3;
   let lastCollision;
   for (let attempt = 0;attempt <= retries; attempt++) {
@@ -3870,6 +3875,7 @@ async function publish(input, deps) {
         version: 1,
         source: sourceLookup.source,
         filename,
+        content_sha256: digest,
         published_at: new Date().toISOString(),
         expires_at: relicExpiresAt
       });
@@ -3892,6 +3898,14 @@ async function publish(input, deps) {
   }
   throw lastCollision ?? new PublishError("service_unreachable", "could not obtain a grant");
 }
+async function contentDigest(input) {
+  const header = new TextEncoder().encode(`${JSON.stringify([input.filename, input.title])}\x00`);
+  const material = new Uint8Array(header.length + input.content.length);
+  material.set(header, 0);
+  material.set(input.content, header.length);
+  const digest = await crypto.subtle.digest("SHA-256", material.slice().buffer);
+  return Array.from(new Uint8Array(digest)).map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
 async function readSource(path, files) {
   const resolvedPath = files.resolve(path);
   const stat2 = await files.stat(resolvedPath);
@@ -5870,6 +5884,22 @@ async function republish(input, deps) {
       seen.add(entry.comment_id);
     }
   }
+  const source = await readSource(input.path, deps.files);
+  const filename = input.filename ?? source.basename;
+  const normalizedTitle = normalizeTitle(input.title ?? filename);
+  const rendererClass = deriveRendererClass(source.bytes, filename);
+  const digest = await contentDigest({
+    content: source.bytes,
+    filename,
+    title: normalizedTitle
+  });
+  if (state.content_sha256 !== undefined && state.content_sha256 === digest) {
+    throw new PublishError("duplicate_version", `version ${state.version} of relic ${input.relic_id} already holds ` + "exactly this content, under this name and title, so a new version " + "would show a reader nothing they are not already reading at the " + "same link. Change the file, or leave the relic where it is.", {
+      relic_id: input.relic_id,
+      version: state.version,
+      content_sha256: digest
+    });
+  }
   const commentResult = await readComments(input.relic_id, deps, {
     version: "*"
   });
@@ -5907,10 +5937,6 @@ async function republish(input, deps) {
       }))
     });
   }
-  const source = await readSource(input.path, deps.files);
-  const filename = input.filename ?? source.basename;
-  const normalizedTitle = normalizeTitle(input.title ?? filename);
-  const rendererClass = deriveRendererClass(source.bytes, filename);
   const container2 = await encryptRelic({
     content: source.bytes,
     filename,
@@ -5933,6 +5959,7 @@ async function republish(input, deps) {
       ...state,
       version,
       filename,
+      content_sha256: digest,
       updated_at: new Date().toISOString()
     });
   } catch (error) {
@@ -5981,7 +6008,7 @@ var RESOLVE_COMMENT_TOOL_NAME = "relic_resolve_comment";
 var COMMENT_MACHINE_BOUNDARY = "Only works for a relic this machine published: the comment key is derived " + "from that relic's key, which lives in local publish state and nowhere the " + "service can reach.";
 var MAX_TTL_DAYS = 3650;
 var VERSION_HISTORY_DISCLOSURE = "Anyone holding a relic's link can fetch every version it has ever held, " + "so republishing does not withdraw earlier content.";
-var REPUBLISH_DISCIPLINE_DISCLOSURE = " Before publishing, it reads the relic's comments, on every version, and " + "refuses if any are unanswered. Clear open comments either by replying with " + "`relic_comment`, by resolving them with `relic_resolve_comment`, or by " + "passing `addresses: [{ comment_id, note }]` here to acknowledge them " + "in the new version. A resolved comment counts as handled. Unreadable " + "comments block republishing. This is workflow " + "discipline in the client, not a boundary: the machine holding the publish " + "token can call the HTTP API directly, and the service cannot enforce this " + "because it cannot read comments.";
+var REPUBLISH_DISCIPLINE_DISCLOSURE = " A version whose content, name and title are identical to the one already " + "live is refused locally, before any request: it would tell recipients to " + "look again at what they are already reading. Change the file rather than " + "retrying." + " Before publishing, it reads the relic's comments, on every version, and " + "refuses if any are unanswered. Clear open comments either by replying with " + "`relic_comment`, by resolving them with `relic_resolve_comment`, or by " + "passing `addresses: [{ comment_id, note }]` here to acknowledge them " + "in the new version. A resolved comment counts as handled. Unreadable " + "comments block republishing. This is workflow " + "discipline in the client, not a boundary: the machine holding the publish " + "token can call the HTTP API directly, and the service cannot enforce this " + "because it cannot read comments.";
 var TOOL_DEFINITION = {
   name: TOOL_NAME,
   title: "Publish a relic",
@@ -6828,7 +6855,7 @@ var DESCRIBE_TOOL_DEFINITION = {
     additionalProperties: false
   }
 };
-var SERVER_VERSION = "0.9.0";
+var SERVER_VERSION = "0.10.0";
 var SERVER_INFO = {
   name: "relic",
   title: "Relic",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "relic-mcp",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Publish a file as an encrypted relic. The key is generated on your machine and never sent to the service.",
   "license": "MIT",
   "type": "module",

package/src/publish.ts

@@ -81,6 +81,7 @@ export type ClientCode =
   | 'local_comment_addresses_invalid'
   | 'local_comment_addresses_too_long'
   | 'unaddressed_comments'
+  | 'duplicate_version'
   | 'empty_acknowledgement_note'
   | 'invalid_acknowledgement_comment_id'
   | 'duplicate_acknowledgement'
@@ -332,6 +333,13 @@ export async function publish(
   // model-attested, and the metric's second clause would then have an
   // unreliable narrator reporting its only input.
   const rendererClass = deriveRendererClass(source.bytes, filename);
+  // What this version's plaintext is, recorded so the next republish from
+  // this machine can tell a change from a re-upload of the same thing.
+  const digest = await contentDigest({
+    content: source.bytes,
+    filename,
+    title: normalizedTitle,
+  });
 
   const retries = deps.maxCollisionRetries ?? 3;
   let lastCollision: ServerRefusal | undefined;
@@ -425,6 +433,7 @@ export async function publish(
         version: 1,
         source: sourceLookup.source,
         filename,
+        content_sha256: digest,
         published_at: new Date().toISOString(),
         expires_at: relicExpiresAt,
       });
@@ -465,6 +474,39 @@ export async function publish(
   );
 }
 
+/**
+ * Name one version's plaintext, so the next one can be recognised as the
+ * same.
+ *
+ * Over the name and title as well as the bytes, because those two ride in
+ * the envelope and show on the card: retitling a relic changes what a
+ * recipient is handed even when the content does not, so it is a real
+ * version. The header is JSON and cannot contain a NUL, which is what keeps
+ * the separator unambiguous without a length prefix.
+ *
+ * Never sent anywhere. It is a local record of what this machine last put
+ * behind the link; the service is not asked and does not know.
+ */
+export async function contentDigest(input: {
+  readonly content: Uint8Array;
+  readonly filename: string;
+  readonly title: string;
+}): Promise<string> {
+  const header = new TextEncoder().encode(
+    `${JSON.stringify([input.filename, input.title])}\0`
+  );
+  const material = new Uint8Array(header.length + input.content.length);
+  material.set(header, 0);
+  material.set(input.content, header.length);
+  const digest = await crypto.subtle.digest(
+    'SHA-256',
+    material.slice().buffer as ArrayBuffer
+  );
+  return Array.from(new Uint8Array(digest))
+    .map((byte) => byte.toString(16).padStart(2, '0'))
+    .join('');
+}
+
 export async function readSource(
   path: string,
   files: FileReader

package/src/republish.ts

@@ -26,6 +26,7 @@ import {
   readComments,
 } from './comments.ts';
 import {
+  contentDigest,
   guessMimetype,
   type PublishDeps,
   PublishError,
@@ -178,6 +179,46 @@ export async function republish(
     }
   }
 
+  // The duplicate gate, still local: read the file, name what its plaintext
+  // is, and refuse when that is already what the link serves.
+  //
+  // A version is a thing recipients are told to look at again. One that
+  // changes nothing cannot be told apart from a real one until it has been
+  // read, and the reader has to hold both in their head to discover that
+  // nothing moved, so an identical version spends their attention and
+  // returns nothing. It is refused here rather than uploaded, because the
+  // service has no way to know: it holds ciphertext, and a fresh salt makes
+  // two encryptions of one file differ byte for byte.
+  //
+  // Before the comment read, which is the first thing here that touches the
+  // network. An identical file is also the likeliest reason comments are
+  // still open, so naming the duplicate first names the cause.
+  const source = await readSource(input.path, deps.files);
+  const filename = input.filename ?? source.basename;
+  const normalizedTitle = normalizeTitle(input.title ?? filename);
+  // Same rule as a first publish: the class comes from bytes in hand, never
+  // from a tool input, so the taxonomy stays machine-attested.
+  const rendererClass = deriveRendererClass(source.bytes, filename);
+  const digest = await contentDigest({
+    content: source.bytes,
+    filename,
+    title: normalizedTitle,
+  });
+  if (state.content_sha256 !== undefined && state.content_sha256 === digest) {
+    throw new PublishError(
+      'duplicate_version',
+      `version ${state.version} of relic ${input.relic_id} already holds ` +
+        'exactly this content, under this name and title, so a new version ' +
+        'would show a reader nothing they are not already reading at the ' +
+        'same link. Change the file, or leave the relic where it is.',
+      {
+        relic_id: input.relic_id,
+        version: state.version,
+        content_sha256: digest,
+      }
+    );
+  }
+
   // The comment gate: before publishing a new version, read the relic's
   // comments, decrypt them locally, and verify every comment has been
   // addressed. Unaddressed or unreadable comments refuse the republish.
@@ -254,13 +295,6 @@ export async function republish(
     );
   }
 
-  const source = await readSource(input.path, deps.files);
-  const filename = input.filename ?? source.basename;
-  const normalizedTitle = normalizeTitle(input.title ?? filename);
-  // Same rule as a first publish: the class comes from bytes in hand, never
-  // from a tool input, so the taxonomy stays machine-attested.
-  const rendererClass = deriveRendererClass(source.bytes, filename);
-
   // The stored key, not a fresh one. This is the line that keeps the
   // existing share URL decrypting the new version; a fresh key here would
   // silently cut every recipient off from content they were told this link
@@ -312,6 +346,7 @@ export async function republish(
       ...state,
       version,
       filename,
+      content_sha256: digest,
       updated_at: new Date().toISOString(),
     });
   } catch (error) {

package/src/server.ts

@@ -205,6 +205,10 @@ const VERSION_HISTORY_DISCLOSURE =
   "Anyone holding a relic's link can fetch every version it has ever held, " +
   'so republishing does not withdraw earlier content.';
 export const REPUBLISH_DISCIPLINE_DISCLOSURE =
+  ' A version whose content, name and title are identical to the one already ' +
+  'live is refused locally, before any request: it would tell recipients to ' +
+  'look again at what they are already reading. Change the file rather than ' +
+  'retrying.' +
   " Before publishing, it reads the relic's comments, on every version, and " +
   'refuses if any are unanswered. Clear open comments either by replying with ' +
   '`relic_comment`, by resolving them with `relic_resolve_comment`, or by ' +

package/src/state.ts

@@ -86,6 +86,23 @@ export interface PublishState {
   readonly published_at?: string | undefined;
   /** When this machine last published a new version, ISO 8601. */
   readonly updated_at?: string | undefined;
+  /**
+   * SHA-256, hex, of the plaintext of the newest version this machine
+   * published: its bytes, its name and its title together.
+   *
+   * It exists to refuse a republish that would put identical content behind
+   * the link a second time. A version is a thing recipients are told to look
+   * at again, so one that changes nothing is a false alarm they cannot tell
+   * from a real one until they have read it.
+   *
+   * Absent on every entry written before this client, and absence is legacy
+   * state rather than an error. It cannot be repaired from anywhere: the
+   * service holds ciphertext and would not hand a client the plaintext to
+   * hash even if it were asked. So an entry without it cannot take part in
+   * the check, its next republish is allowed on that ground, and the digest
+   * is recorded as that republish lands.
+   */
+  readonly content_sha256?: string | undefined;
   /**
    * The lifetime the first grant fixed, ISO 8601, or null for a relic kept
    * until it is deleted.
@@ -328,7 +345,14 @@ function validatePublishStateEntry(
     !Number.isSafeInteger(candidate['version']) ||
     candidate['version'] < 1 ||
     (candidate['source'] !== undefined &&
-      !isSourceIdentity(candidate['source']))
+      !isSourceIdentity(candidate['source'])) ||
+    // Checked rather than trusted, because the duplicate-version refusal
+    // compares against it: a digest of the wrong shape would match nothing,
+    // and that refusal would then fail open on every republish, with no
+    // word about it anywhere.
+    (candidate['content_sha256'] !== undefined &&
+      (typeof candidate['content_sha256'] !== 'string' ||
+        !/^[0-9a-f]{64}$/.test(candidate['content_sha256'])))
   ) {
     throw new Error(
       `publish state at ${publishStatePath()} holds a malformed entry for ` +