sealnet-mcp 0.2.2 → 0.2.4

package/README.md

@@ -35,7 +35,7 @@ All state lives encrypted at `${XDG_CONFIG_HOME}/seal-mcp/state.json` (mode `0o6
 
 Passphrase delivery, in priority order:
 
-1. **OS keychain** (default) — `keytar` (optional dependency) reads from libsecret / macOS Keychain / wincred. The first `serve` stores a random passphrase there itself; `sealnet-mcp init` lets you choose one instead.
+1. **OS keychain** (default) — `@napi-rs/keyring` (optional dependency) reads from the Secret Service on Linux / macOS Keychain / Windows Credential Manager. The first `serve` stores a random passphrase there itself; `sealnet-mcp init` lets you choose one instead.
 2. **`SEAL_MCP_PASSPHRASE` env var** — explicit opt-in for CI/headless. Warning logged.
 3. **Cleartext on disk** — explicit refusal even if user tries `--passphrase-file …`.
 

package/dist/cli.cjs

@@ -7099,6 +7099,7 @@ async function probeStateLock(stateDir, deps = {}) {
 }
 
 // src/passphrase.ts
+var import_node_child_process = require("child_process");
 var import_node_crypto2 = require("crypto");
 var SERVICE_NAME = "seal-mcp";
 var ACCOUNT_NAME = "state";
@@ -7122,23 +7123,50 @@ var PassphraseNotFoundError = class extends Error {
     this.name = "PassphraseNotFoundError";
   }
 };
+function keyringEntry(keyring, platform, service, account) {
+  return platform === "win32" ? keyring.AsyncEntry.withTarget(`${service}/${account}`, service, account) : new keyring.AsyncEntry(service, account, { linux: { store: "secret-service" } });
+}
+function readKeytarLinuxEntry(service, account) {
+  return new Promise((resolve5) => {
+    (0, import_node_child_process.execFile)("secret-tool", ["lookup", "service", service, "account", account], { timeout: 5e3 }, (err2, stdout) => {
+      const value = err2 ? "" : stdout.replace(/\n$/, "");
+      resolve5(value.length > 0 ? value : null);
+    });
+  });
+}
+function keytarOverKeyring(keyring, platform = process.platform, readLegacy = readKeytarLinuxEntry) {
+  const entry = (service, account) => keyringEntry(keyring, platform, service, account);
+  const store = (service, account, password) => entry(service, account).setSecret(Buffer.from(password, "utf8"));
+  return {
+    async getPassword(service, account) {
+      const secret = await entry(service, account).getSecret();
+      if (secret !== void 0) return Buffer.from(secret).toString("utf8");
+      const legacy = platform === "linux" ? await readLegacy(service, account) : null;
+      if (legacy !== null) await store(service, account, legacy).catch(() => void 0);
+      return legacy;
+    },
+    setPassword: store,
+    deletePassword: (service, account) => entry(service, account).deleteCredential()
+  };
+}
 var keytarCache = void 0;
 async function loadKeytar() {
   if (keytarCache !== void 0) return keytarCache;
   try {
-    const mod = await import("keytar");
-    keytarCache = mod.default ?? mod;
-    return keytarCache;
+    const mod = await import("@napi-rs/keyring");
+    const keyring = mod.default ?? mod;
+    keyringEntry(keyring, process.platform, SERVICE_NAME, ACCOUNT_NAME);
+    keytarCache = keytarOverKeyring(keyring);
   } catch {
     keytarCache = null;
-    return null;
   }
+  return keytarCache;
 }
 async function loadKeytarOrThrow() {
   const k = await loadKeytar();
   if (k === null) {
     throw new KeytarUnavailableError(
-      "failed to load `keytar` native module. On Debian/Ubuntu install `libsecret-1-0`; on Fedora install `gnome-keyring`; on macOS/Windows this should never happen \u2014 file a bug."
+      "no OS keychain. On Linux start a Secret Service (gnome-keyring or KWallet); on macOS/Windows this should never happen \u2014 file a bug."
     );
   }
   return k;
@@ -11342,6 +11370,10 @@ var seal_mcp_v1_default = {
     server_info: "name `sealnet-mcp` (the npm package and its binary); version = `package.json::version`, injected at build time (tsup `define`), never a source literal. The state directory, the keychain service and the handoff directory keep the name `seal-mcp`: they are where existing state lives.",
     progress: "When a `tools/call` carries `_meta.progressToken`, `seal_share` and `seal_open mode=file` send `notifications/progress` with `progress` = ciphertext bytes done (upload: confirmed by storage) and `total` = ciphertext bytes in all; at most one per second, `progress` strictly increasing, the last one at `progress = total`."
   },
+  server_instructions: {
+    text: "SEAL moves files and secrets between people and agents without their content entering this conversation. When someone wants a file, folder or secret sent to them, to another machine or to another agent, call seal_share with its path and do not open, print or Read it first. When you need an API key, password, file or folder from the user, or they offer or ask how to give you one, call seal_request right away instead of explaining other ways or asking them to paste or upload it. Open a SEAL link someone gave you with seal_open (mode=file for secrets and large files).",
+    note: "The `instructions` of the `initialize` result (SPEC-AGENTS \xA78.1). Hosts that defer MCP tools behind a tool search (Claude Code) show the model only tool names until it searches, but put these instructions into the system prompt: this is the one text a model reads before it decides to look for a tool, or reads the file it was asked to send."
+  },
   tools: {
     seal_share: {
       title: "Share a file via SEAL",
@@ -11793,7 +11825,7 @@ var seal_mcp_v1_default = {
       {
         rank: 1,
         method: "os_keychain",
-        implementation: "keytar (libsecret on Linux, macOS Keychain, Windows Credential Manager), an OPTIONAL dependency loaded lazily: its absence never fails install or start. Service id: 'seal-mcp', account: 'state'. Set during `sealnet-mcp init` (chosen by the user), or by the first `sealnet-mcp serve` without state, which generates a random 32-byte passphrase itself \u2014 no prompt, no `init` step. Read on every subsequent process start.",
+        implementation: "@napi-rs/keyring (the Secret Service on Linux, never the kernel keyring, which forgets on reboot; macOS Keychain; Windows Credential Manager), an OPTIONAL dependency loaded lazily: its absence never fails install or start. It replaced keytar in 0.2.4 and finds the entry keytar wrote (Windows credential `seal-mcp/state`, the passphrase as UTF-8 bytes; on Linux the old entry is read once through `secret-tool` and stored anew). Service id: 'seal-mcp', account: 'state'. Set during `sealnet-mcp init` (chosen by the user), or by the first `sealnet-mcp serve` without state, which generates a random 32-byte passphrase itself \u2014 no prompt, no `init` step. Read on every subsequent process start.",
         default: true
       },
       {
@@ -12941,7 +12973,7 @@ async function sealProFileGet(source, input) {
 }
 
 // src/tools/request.ts
-var import_node_child_process = require("child_process");
+var import_node_child_process2 = require("child_process");
 var import_node_fs3 = require("fs");
 var import_promises5 = require("fs/promises");
 var import_node_os5 = require("os");
@@ -12960,7 +12992,7 @@ function runSealCli(args) {
   const cli = findSealCli();
   if (!cli) return Promise.resolve(null);
   return new Promise((resolve5) => {
-    (0, import_node_child_process.execFile)(cli, [...args], { maxBuffer: 1024 * 1024 }, (_err, stdout) => {
+    (0, import_node_child_process2.execFile)(cli, [...args], { maxBuffer: 1024 * 1024 }, (_err, stdout) => {
       try {
         resolve5(JSON.parse(stdout));
       } catch {
@@ -13933,7 +13965,7 @@ function proFileGetOutputToWire(out) {
 }
 
 // src/server.ts
-var SERVER_VERSION = "0.2.2";
+var SERVER_VERSION = "0.2.4";
 var toolMeta = (name) => {
   const { title, description, annotations } = seal_mcp_v1_default.tools[name];
   return { title, description, annotations };
@@ -14001,7 +14033,7 @@ async function createServer(options) {
   };
   const mcp = new import_mcp.McpServer(
     { name: "sealnet-mcp", version: SERVER_VERSION },
-    { capabilities: { tools: {} } }
+    { capabilities: { tools: {} }, instructions: seal_mcp_v1_default.server_instructions.text }
   );
   const disableClipboard = process.env.SEAL_MCP_DISABLE_CLIPBOARD === "1";
   mcp.registerTool(
@@ -14309,7 +14341,7 @@ async function runInit(opts) {
       if (err2 instanceof KeytarUnavailableError) {
         logStderr(`${PROGRAM_NAME} init: warning: ${err2.message}`);
         logStderr(
-          `${PROGRAM_NAME} init: state.json IS encrypted, but you must export ${PASSPHRASE_ENV_VAR} before every \`${PROGRAM_NAME} serve\` until keytar works.`
+          `${PROGRAM_NAME} init: state.json IS encrypted, but you must export ${PASSPHRASE_ENV_VAR} before every \`${PROGRAM_NAME} serve\` until the OS keychain works.`
         );
       } else {
         throw err2;
@@ -14483,7 +14515,7 @@ async function runDoctor(opts) {
   }
   if (!kc.available) {
     logStderr(
-      `hint: keychain unavailable. Install \`libsecret-1-0\` (Debian/Ubuntu) or \`gnome-keyring\` (Fedora), or rely on ${PASSPHRASE_ENV_VAR}; with neither, \`serve\` runs ephemeral (handles live until restart).`
+      `hint: keychain unavailable. On Linux start a Secret Service (gnome-keyring or KWallet), or rely on ${PASSPHRASE_ENV_VAR}; with neither, \`serve\` runs ephemeral (handles live until restart).`
     );
   } else if (stateExists && !kc.hasEntry && !report.env_passphrase_set) {
     logStderr(`hint: keychain has no entry and ${PASSPHRASE_ENV_VAR} is unset \u2014 \`serve\` will fail.`);

package/dist/cli.js

@@ -7071,6 +7071,7 @@ async function probeStateLock(stateDir, deps = {}) {
 }
 
 // src/passphrase.ts
+import { execFile } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
 var SERVICE_NAME = "seal-mcp";
 var ACCOUNT_NAME = "state";
@@ -7094,23 +7095,50 @@ var PassphraseNotFoundError = class extends Error {
     this.name = "PassphraseNotFoundError";
   }
 };
+function keyringEntry(keyring, platform, service, account) {
+  return platform === "win32" ? keyring.AsyncEntry.withTarget(`${service}/${account}`, service, account) : new keyring.AsyncEntry(service, account, { linux: { store: "secret-service" } });
+}
+function readKeytarLinuxEntry(service, account) {
+  return new Promise((resolve5) => {
+    execFile("secret-tool", ["lookup", "service", service, "account", account], { timeout: 5e3 }, (err2, stdout) => {
+      const value = err2 ? "" : stdout.replace(/\n$/, "");
+      resolve5(value.length > 0 ? value : null);
+    });
+  });
+}
+function keytarOverKeyring(keyring, platform = process.platform, readLegacy = readKeytarLinuxEntry) {
+  const entry = (service, account) => keyringEntry(keyring, platform, service, account);
+  const store = (service, account, password) => entry(service, account).setSecret(Buffer.from(password, "utf8"));
+  return {
+    async getPassword(service, account) {
+      const secret = await entry(service, account).getSecret();
+      if (secret !== void 0) return Buffer.from(secret).toString("utf8");
+      const legacy = platform === "linux" ? await readLegacy(service, account) : null;
+      if (legacy !== null) await store(service, account, legacy).catch(() => void 0);
+      return legacy;
+    },
+    setPassword: store,
+    deletePassword: (service, account) => entry(service, account).deleteCredential()
+  };
+}
 var keytarCache = void 0;
 async function loadKeytar() {
   if (keytarCache !== void 0) return keytarCache;
   try {
-    const mod = await import("keytar");
-    keytarCache = mod.default ?? mod;
-    return keytarCache;
+    const mod = await import("@napi-rs/keyring");
+    const keyring = mod.default ?? mod;
+    keyringEntry(keyring, process.platform, SERVICE_NAME, ACCOUNT_NAME);
+    keytarCache = keytarOverKeyring(keyring);
   } catch {
     keytarCache = null;
-    return null;
   }
+  return keytarCache;
 }
 async function loadKeytarOrThrow() {
   const k = await loadKeytar();
   if (k === null) {
     throw new KeytarUnavailableError(
-      "failed to load `keytar` native module. On Debian/Ubuntu install `libsecret-1-0`; on Fedora install `gnome-keyring`; on macOS/Windows this should never happen \u2014 file a bug."
+      "no OS keychain. On Linux start a Secret Service (gnome-keyring or KWallet); on macOS/Windows this should never happen \u2014 file a bug."
     );
   }
   return k;
@@ -11314,6 +11342,10 @@ var seal_mcp_v1_default = {
     server_info: "name `sealnet-mcp` (the npm package and its binary); version = `package.json::version`, injected at build time (tsup `define`), never a source literal. The state directory, the keychain service and the handoff directory keep the name `seal-mcp`: they are where existing state lives.",
     progress: "When a `tools/call` carries `_meta.progressToken`, `seal_share` and `seal_open mode=file` send `notifications/progress` with `progress` = ciphertext bytes done (upload: confirmed by storage) and `total` = ciphertext bytes in all; at most one per second, `progress` strictly increasing, the last one at `progress = total`."
   },
+  server_instructions: {
+    text: "SEAL moves files and secrets between people and agents without their content entering this conversation. When someone wants a file, folder or secret sent to them, to another machine or to another agent, call seal_share with its path and do not open, print or Read it first. When you need an API key, password, file or folder from the user, or they offer or ask how to give you one, call seal_request right away instead of explaining other ways or asking them to paste or upload it. Open a SEAL link someone gave you with seal_open (mode=file for secrets and large files).",
+    note: "The `instructions` of the `initialize` result (SPEC-AGENTS \xA78.1). Hosts that defer MCP tools behind a tool search (Claude Code) show the model only tool names until it searches, but put these instructions into the system prompt: this is the one text a model reads before it decides to look for a tool, or reads the file it was asked to send."
+  },
   tools: {
     seal_share: {
       title: "Share a file via SEAL",
@@ -11765,7 +11797,7 @@ var seal_mcp_v1_default = {
       {
         rank: 1,
         method: "os_keychain",
-        implementation: "keytar (libsecret on Linux, macOS Keychain, Windows Credential Manager), an OPTIONAL dependency loaded lazily: its absence never fails install or start. Service id: 'seal-mcp', account: 'state'. Set during `sealnet-mcp init` (chosen by the user), or by the first `sealnet-mcp serve` without state, which generates a random 32-byte passphrase itself \u2014 no prompt, no `init` step. Read on every subsequent process start.",
+        implementation: "@napi-rs/keyring (the Secret Service on Linux, never the kernel keyring, which forgets on reboot; macOS Keychain; Windows Credential Manager), an OPTIONAL dependency loaded lazily: its absence never fails install or start. It replaced keytar in 0.2.4 and finds the entry keytar wrote (Windows credential `seal-mcp/state`, the passphrase as UTF-8 bytes; on Linux the old entry is read once through `secret-tool` and stored anew). Service id: 'seal-mcp', account: 'state'. Set during `sealnet-mcp init` (chosen by the user), or by the first `sealnet-mcp serve` without state, which generates a random 32-byte passphrase itself \u2014 no prompt, no `init` step. Read on every subsequent process start.",
         default: true
       },
       {
@@ -12913,7 +12945,7 @@ async function sealProFileGet(source, input) {
 }
 
 // src/tools/request.ts
-import { execFile } from "child_process";
+import { execFile as execFile2 } from "child_process";
 import { existsSync } from "fs";
 import { mkdtemp as mkdtemp2 } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
@@ -12932,7 +12964,7 @@ function runSealCli(args) {
   const cli = findSealCli();
   if (!cli) return Promise.resolve(null);
   return new Promise((resolve5) => {
-    execFile(cli, [...args], { maxBuffer: 1024 * 1024 }, (_err, stdout) => {
+    execFile2(cli, [...args], { maxBuffer: 1024 * 1024 }, (_err, stdout) => {
       try {
         resolve5(JSON.parse(stdout));
       } catch {
@@ -13905,7 +13937,7 @@ function proFileGetOutputToWire(out) {
 }
 
 // src/server.ts
-var SERVER_VERSION = "0.2.2";
+var SERVER_VERSION = "0.2.4";
 var toolMeta = (name) => {
   const { title, description, annotations } = seal_mcp_v1_default.tools[name];
   return { title, description, annotations };
@@ -13973,7 +14005,7 @@ async function createServer(options) {
   };
   const mcp = new McpServer(
     { name: "sealnet-mcp", version: SERVER_VERSION },
-    { capabilities: { tools: {} } }
+    { capabilities: { tools: {} }, instructions: seal_mcp_v1_default.server_instructions.text }
   );
   const disableClipboard = process.env.SEAL_MCP_DISABLE_CLIPBOARD === "1";
   mcp.registerTool(
@@ -14281,7 +14313,7 @@ async function runInit(opts) {
       if (err2 instanceof KeytarUnavailableError) {
         logStderr(`${PROGRAM_NAME} init: warning: ${err2.message}`);
         logStderr(
-          `${PROGRAM_NAME} init: state.json IS encrypted, but you must export ${PASSPHRASE_ENV_VAR} before every \`${PROGRAM_NAME} serve\` until keytar works.`
+          `${PROGRAM_NAME} init: state.json IS encrypted, but you must export ${PASSPHRASE_ENV_VAR} before every \`${PROGRAM_NAME} serve\` until the OS keychain works.`
         );
       } else {
         throw err2;
@@ -14455,7 +14487,7 @@ async function runDoctor(opts) {
   }
   if (!kc.available) {
     logStderr(
-      `hint: keychain unavailable. Install \`libsecret-1-0\` (Debian/Ubuntu) or \`gnome-keyring\` (Fedora), or rely on ${PASSPHRASE_ENV_VAR}; with neither, \`serve\` runs ephemeral (handles live until restart).`
+      `hint: keychain unavailable. On Linux start a Secret Service (gnome-keyring or KWallet), or rely on ${PASSPHRASE_ENV_VAR}; with neither, \`serve\` runs ephemeral (handles live until restart).`
     );
   } else if (stateExists && !kc.hasEntry && !report.env_passphrase_set) {
     logStderr(`hint: keychain has no entry and ${PASSPHRASE_ENV_VAR} is unset \u2014 \`serve\` will fail.`);

package/dist/index.cjs

@@ -4137,6 +4137,10 @@ var seal_mcp_v1_default = {
     server_info: "name `sealnet-mcp` (the npm package and its binary); version = `package.json::version`, injected at build time (tsup `define`), never a source literal. The state directory, the keychain service and the handoff directory keep the name `seal-mcp`: they are where existing state lives.",
     progress: "When a `tools/call` carries `_meta.progressToken`, `seal_share` and `seal_open mode=file` send `notifications/progress` with `progress` = ciphertext bytes done (upload: confirmed by storage) and `total` = ciphertext bytes in all; at most one per second, `progress` strictly increasing, the last one at `progress = total`."
   },
+  server_instructions: {
+    text: "SEAL moves files and secrets between people and agents without their content entering this conversation. When someone wants a file, folder or secret sent to them, to another machine or to another agent, call seal_share with its path and do not open, print or Read it first. When you need an API key, password, file or folder from the user, or they offer or ask how to give you one, call seal_request right away instead of explaining other ways or asking them to paste or upload it. Open a SEAL link someone gave you with seal_open (mode=file for secrets and large files).",
+    note: "The `instructions` of the `initialize` result (SPEC-AGENTS \xA78.1). Hosts that defer MCP tools behind a tool search (Claude Code) show the model only tool names until it searches, but put these instructions into the system prompt: this is the one text a model reads before it decides to look for a tool, or reads the file it was asked to send."
+  },
   tools: {
     seal_share: {
       title: "Share a file via SEAL",
@@ -4588,7 +4592,7 @@ var seal_mcp_v1_default = {
       {
         rank: 1,
         method: "os_keychain",
-        implementation: "keytar (libsecret on Linux, macOS Keychain, Windows Credential Manager), an OPTIONAL dependency loaded lazily: its absence never fails install or start. Service id: 'seal-mcp', account: 'state'. Set during `sealnet-mcp init` (chosen by the user), or by the first `sealnet-mcp serve` without state, which generates a random 32-byte passphrase itself \u2014 no prompt, no `init` step. Read on every subsequent process start.",
+        implementation: "@napi-rs/keyring (the Secret Service on Linux, never the kernel keyring, which forgets on reboot; macOS Keychain; Windows Credential Manager), an OPTIONAL dependency loaded lazily: its absence never fails install or start. It replaced keytar in 0.2.4 and finds the entry keytar wrote (Windows credential `seal-mcp/state`, the passphrase as UTF-8 bytes; on Linux the old entry is read once through `secret-tool` and stored anew). Service id: 'seal-mcp', account: 'state'. Set during `sealnet-mcp init` (chosen by the user), or by the first `sealnet-mcp serve` without state, which generates a random 32-byte passphrase itself \u2014 no prompt, no `init` step. Read on every subsequent process start.",
         default: true
       },
       {
@@ -13788,7 +13792,7 @@ function proFileGetOutputToWire(out) {
 }
 
 // src/server.ts
-var SERVER_VERSION = "0.2.2";
+var SERVER_VERSION = "0.2.4";
 var toolMeta = (name) => {
   const { title, description, annotations } = seal_mcp_v1_default.tools[name];
   return { title, description, annotations };
@@ -13856,7 +13860,7 @@ async function createServer(options) {
   };
   const mcp = new import_mcp.McpServer(
     { name: "sealnet-mcp", version: SERVER_VERSION },
-    { capabilities: { tools: {} } }
+    { capabilities: { tools: {} }, instructions: seal_mcp_v1_default.server_instructions.text }
   );
   const disableClipboard = process.env.SEAL_MCP_DISABLE_CLIPBOARD === "1";
   mcp.registerTool(
@@ -14137,6 +14141,7 @@ function osDefaultDir(env, platform, home) {
 }
 
 // src/passphrase.ts
+var import_node_child_process2 = require("child_process");
 var import_node_crypto4 = require("crypto");
 var SERVICE_NAME = "seal-mcp";
 var ACCOUNT_NAME = "state";
@@ -14160,23 +14165,50 @@ var PassphraseNotFoundError = class extends Error {
     this.name = "PassphraseNotFoundError";
   }
 };
+function keyringEntry(keyring, platform, service, account) {
+  return platform === "win32" ? keyring.AsyncEntry.withTarget(`${service}/${account}`, service, account) : new keyring.AsyncEntry(service, account, { linux: { store: "secret-service" } });
+}
+function readKeytarLinuxEntry(service, account) {
+  return new Promise((resolve5) => {
+    (0, import_node_child_process2.execFile)("secret-tool", ["lookup", "service", service, "account", account], { timeout: 5e3 }, (err2, stdout) => {
+      const value = err2 ? "" : stdout.replace(/\n$/, "");
+      resolve5(value.length > 0 ? value : null);
+    });
+  });
+}
+function keytarOverKeyring(keyring, platform = process.platform, readLegacy = readKeytarLinuxEntry) {
+  const entry = (service, account) => keyringEntry(keyring, platform, service, account);
+  const store = (service, account, password) => entry(service, account).setSecret(Buffer.from(password, "utf8"));
+  return {
+    async getPassword(service, account) {
+      const secret = await entry(service, account).getSecret();
+      if (secret !== void 0) return Buffer.from(secret).toString("utf8");
+      const legacy = platform === "linux" ? await readLegacy(service, account) : null;
+      if (legacy !== null) await store(service, account, legacy).catch(() => void 0);
+      return legacy;
+    },
+    setPassword: store,
+    deletePassword: (service, account) => entry(service, account).deleteCredential()
+  };
+}
 var keytarCache = void 0;
 async function loadKeytar() {
   if (keytarCache !== void 0) return keytarCache;
   try {
-    const mod = await import("keytar");
-    keytarCache = mod.default ?? mod;
-    return keytarCache;
+    const mod = await import("@napi-rs/keyring");
+    const keyring = mod.default ?? mod;
+    keyringEntry(keyring, process.platform, SERVICE_NAME, ACCOUNT_NAME);
+    keytarCache = keytarOverKeyring(keyring);
   } catch {
     keytarCache = null;
-    return null;
   }
+  return keytarCache;
 }
 async function loadKeytarOrThrow() {
   const k = await loadKeytar();
   if (k === null) {
     throw new KeytarUnavailableError(
-      "failed to load `keytar` native module. On Debian/Ubuntu install `libsecret-1-0`; on Fedora install `gnome-keyring`; on macOS/Windows this should never happen \u2014 file a bug."
+      "no OS keychain. On Linux start a Secret Service (gnome-keyring or KWallet); on macOS/Windows this should never happen \u2014 file a bug."
     );
   }
   return k;

package/dist/index.d.cts

@@ -882,7 +882,7 @@ declare function resolveStateDir(opts?: ResolveOptions): PathResolution;
  *
  * Priority chain (per `shared/contracts/seal_mcp.v1.json::passphrase_delivery`):
  *
- *   1. OS keychain via `keytar` (service `'seal-mcp'`, account `'state'`).
+ *   1. OS keychain via `@napi-rs/keyring` (service `'seal-mcp'`, account `'state'`).
  *   2. `SEAL_MCP_PASSPHRASE` environment variable. Logs a warning to
  *      stderr because env vars are visible via `/proc/<pid>/environ`
  *      on Linux, `ps -E`/`procstat -e` on BSD, and via the process
@@ -890,10 +890,9 @@ declare function resolveStateDir(opts?: ResolveOptions): PathResolution;
  *   3. Cleartext on disk — REFUSED. Listed only to document the
  *      refusal; the resolver has no codepath that reads from a file.
  *
- * `keytar` is loaded lazily (same pattern as `clipboardy` in
- * `handoff.ts`) so headless environments lacking `libsecret-1.so.0`
- * (Linux) can still fall back to the env var without crashing the CLI
- * at import time.
+ * The keychain module is an optional dependency loaded lazily (same pattern
+ * as `clipboardy` in `handoff.ts`), so a machine without it, or without a
+ * keychain, falls back to the env var without crashing at import time.
  */
 declare const KEYCHAIN_SERVICE: "seal-mcp";
 declare const KEYCHAIN_ACCOUNT: "state";
@@ -904,8 +903,8 @@ interface ResolvedPassphrase {
     readonly source: PassphraseSource;
 }
 /**
- * Surface used by `passphrase.ts` — kept narrow on purpose so tests can
- * stub keytar without pulling in the native module.
+ * Surface used by `passphrase.ts` — `keytar`'s shape, kept narrow on purpose
+ * so tests can stub the keychain without pulling in the native module.
  */
 interface KeytarLike {
     getPassword(service: string, account: string): Promise<string | null>;

package/dist/index.d.ts

@@ -882,7 +882,7 @@ declare function resolveStateDir(opts?: ResolveOptions): PathResolution;
  *
  * Priority chain (per `shared/contracts/seal_mcp.v1.json::passphrase_delivery`):
  *
- *   1. OS keychain via `keytar` (service `'seal-mcp'`, account `'state'`).
+ *   1. OS keychain via `@napi-rs/keyring` (service `'seal-mcp'`, account `'state'`).
  *   2. `SEAL_MCP_PASSPHRASE` environment variable. Logs a warning to
  *      stderr because env vars are visible via `/proc/<pid>/environ`
  *      on Linux, `ps -E`/`procstat -e` on BSD, and via the process
@@ -890,10 +890,9 @@ declare function resolveStateDir(opts?: ResolveOptions): PathResolution;
  *   3. Cleartext on disk — REFUSED. Listed only to document the
  *      refusal; the resolver has no codepath that reads from a file.
  *
- * `keytar` is loaded lazily (same pattern as `clipboardy` in
- * `handoff.ts`) so headless environments lacking `libsecret-1.so.0`
- * (Linux) can still fall back to the env var without crashing the CLI
- * at import time.
+ * The keychain module is an optional dependency loaded lazily (same pattern
+ * as `clipboardy` in `handoff.ts`), so a machine without it, or without a
+ * keychain, falls back to the env var without crashing at import time.
  */
 declare const KEYCHAIN_SERVICE: "seal-mcp";
 declare const KEYCHAIN_ACCOUNT: "state";
@@ -904,8 +903,8 @@ interface ResolvedPassphrase {
     readonly source: PassphraseSource;
 }
 /**
- * Surface used by `passphrase.ts` — kept narrow on purpose so tests can
- * stub keytar without pulling in the native module.
+ * Surface used by `passphrase.ts` — `keytar`'s shape, kept narrow on purpose
+ * so tests can stub the keychain without pulling in the native module.
  */
 interface KeytarLike {
     getPassword(service: string, account: string): Promise<string | null>;

package/dist/index.js

@@ -4065,6 +4065,10 @@ var seal_mcp_v1_default = {
     server_info: "name `sealnet-mcp` (the npm package and its binary); version = `package.json::version`, injected at build time (tsup `define`), never a source literal. The state directory, the keychain service and the handoff directory keep the name `seal-mcp`: they are where existing state lives.",
     progress: "When a `tools/call` carries `_meta.progressToken`, `seal_share` and `seal_open mode=file` send `notifications/progress` with `progress` = ciphertext bytes done (upload: confirmed by storage) and `total` = ciphertext bytes in all; at most one per second, `progress` strictly increasing, the last one at `progress = total`."
   },
+  server_instructions: {
+    text: "SEAL moves files and secrets between people and agents without their content entering this conversation. When someone wants a file, folder or secret sent to them, to another machine or to another agent, call seal_share with its path and do not open, print or Read it first. When you need an API key, password, file or folder from the user, or they offer or ask how to give you one, call seal_request right away instead of explaining other ways or asking them to paste or upload it. Open a SEAL link someone gave you with seal_open (mode=file for secrets and large files).",
+    note: "The `instructions` of the `initialize` result (SPEC-AGENTS \xA78.1). Hosts that defer MCP tools behind a tool search (Claude Code) show the model only tool names until it searches, but put these instructions into the system prompt: this is the one text a model reads before it decides to look for a tool, or reads the file it was asked to send."
+  },
   tools: {
     seal_share: {
       title: "Share a file via SEAL",
@@ -4516,7 +4520,7 @@ var seal_mcp_v1_default = {
       {
         rank: 1,
         method: "os_keychain",
-        implementation: "keytar (libsecret on Linux, macOS Keychain, Windows Credential Manager), an OPTIONAL dependency loaded lazily: its absence never fails install or start. Service id: 'seal-mcp', account: 'state'. Set during `sealnet-mcp init` (chosen by the user), or by the first `sealnet-mcp serve` without state, which generates a random 32-byte passphrase itself \u2014 no prompt, no `init` step. Read on every subsequent process start.",
+        implementation: "@napi-rs/keyring (the Secret Service on Linux, never the kernel keyring, which forgets on reboot; macOS Keychain; Windows Credential Manager), an OPTIONAL dependency loaded lazily: its absence never fails install or start. It replaced keytar in 0.2.4 and finds the entry keytar wrote (Windows credential `seal-mcp/state`, the passphrase as UTF-8 bytes; on Linux the old entry is read once through `secret-tool` and stored anew). Service id: 'seal-mcp', account: 'state'. Set during `sealnet-mcp init` (chosen by the user), or by the first `sealnet-mcp serve` without state, which generates a random 32-byte passphrase itself \u2014 no prompt, no `init` step. Read on every subsequent process start.",
         default: true
       },
       {
@@ -13716,7 +13720,7 @@ function proFileGetOutputToWire(out) {
 }
 
 // src/server.ts
-var SERVER_VERSION = "0.2.2";
+var SERVER_VERSION = "0.2.4";
 var toolMeta = (name) => {
   const { title, description, annotations } = seal_mcp_v1_default.tools[name];
   return { title, description, annotations };
@@ -13784,7 +13788,7 @@ async function createServer(options) {
   };
   const mcp = new McpServer(
     { name: "sealnet-mcp", version: SERVER_VERSION },
-    { capabilities: { tools: {} } }
+    { capabilities: { tools: {} }, instructions: seal_mcp_v1_default.server_instructions.text }
   );
   const disableClipboard = process.env.SEAL_MCP_DISABLE_CLIPBOARD === "1";
   mcp.registerTool(
@@ -14065,6 +14069,7 @@ function osDefaultDir(env, platform, home) {
 }
 
 // src/passphrase.ts
+import { execFile as execFile2 } from "child_process";
 import { randomBytes as randomBytes4 } from "crypto";
 var SERVICE_NAME = "seal-mcp";
 var ACCOUNT_NAME = "state";
@@ -14088,23 +14093,50 @@ var PassphraseNotFoundError = class extends Error {
     this.name = "PassphraseNotFoundError";
   }
 };
+function keyringEntry(keyring, platform, service, account) {
+  return platform === "win32" ? keyring.AsyncEntry.withTarget(`${service}/${account}`, service, account) : new keyring.AsyncEntry(service, account, { linux: { store: "secret-service" } });
+}
+function readKeytarLinuxEntry(service, account) {
+  return new Promise((resolve5) => {
+    execFile2("secret-tool", ["lookup", "service", service, "account", account], { timeout: 5e3 }, (err2, stdout) => {
+      const value = err2 ? "" : stdout.replace(/\n$/, "");
+      resolve5(value.length > 0 ? value : null);
+    });
+  });
+}
+function keytarOverKeyring(keyring, platform = process.platform, readLegacy = readKeytarLinuxEntry) {
+  const entry = (service, account) => keyringEntry(keyring, platform, service, account);
+  const store = (service, account, password) => entry(service, account).setSecret(Buffer.from(password, "utf8"));
+  return {
+    async getPassword(service, account) {
+      const secret = await entry(service, account).getSecret();
+      if (secret !== void 0) return Buffer.from(secret).toString("utf8");
+      const legacy = platform === "linux" ? await readLegacy(service, account) : null;
+      if (legacy !== null) await store(service, account, legacy).catch(() => void 0);
+      return legacy;
+    },
+    setPassword: store,
+    deletePassword: (service, account) => entry(service, account).deleteCredential()
+  };
+}
 var keytarCache = void 0;
 async function loadKeytar() {
   if (keytarCache !== void 0) return keytarCache;
   try {
-    const mod = await import("keytar");
-    keytarCache = mod.default ?? mod;
-    return keytarCache;
+    const mod = await import("@napi-rs/keyring");
+    const keyring = mod.default ?? mod;
+    keyringEntry(keyring, process.platform, SERVICE_NAME, ACCOUNT_NAME);
+    keytarCache = keytarOverKeyring(keyring);
   } catch {
     keytarCache = null;
-    return null;
   }
+  return keytarCache;
 }
 async function loadKeytarOrThrow() {
   const k = await loadKeytar();
   if (k === null) {
     throw new KeytarUnavailableError(
-      "failed to load `keytar` native module. On Debian/Ubuntu install `libsecret-1-0`; on Fedora install `gnome-keyring`; on macOS/Windows this should never happen \u2014 file a bug."
+      "no OS keychain. On Linux start a Secret Service (gnome-keyring or KWallet); on macOS/Windows this should never happen \u2014 file a bug."
     );
   }
   return k;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sealnet-mcp",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "mcpName": "net.seal/mcp",
   "description": "Model Context Protocol server for SEAL — model never holds capability by default (handoff mode); explicit opt-in to forward mode with strict TTL/recipient policy.",
   "type": "module",
@@ -59,7 +59,7 @@
     "commander": "^14.0.3"
   },
   "optionalDependencies": {
-    "keytar": "^7.9.0"
+    "@napi-rs/keyring": "^2.1.0"
   },
   "devDependencies": {
     "@types/node": "^20.10.0",