sealnet-mcp 0.2.3 → 0.2.5

package/README.md

@@ -8,7 +8,7 @@ Model Context Protocol (MCP) server for **SEAL**.
 
 When an MCP-connected AI agent (Claude Desktop, Cursor, Cline, etc.) creates a SEAL via this server:
 
-- **handoff mode (default)**: the share link (the key is in its fragment, there is no password) is delivered to the human user via **system clipboard** (primary) or **0o600 local file** (fallback when clipboard is unavailable — headless, SSH, WSL without display). The `tool_result` returned to the model contains **only** an opaque handle and a human-readable receipt. The model cannot exfiltrate the link because it never sees it.
+- **handoff mode (default)**: the share link (the key is in its fragment, there is no password) is delivered to the human user via **system clipboard** (primary) or **0o600 local file** (fallback when clipboard is unavailable — headless, SSH, WSL without display). The `tool_result` returned to the model contains **only** an opaque handle and a human-readable receipt. The link is never written into the conversation; on the file channel the receipt names the file, and an agent that can read files on that machine can read it.
 - **forward mode (explicit opt-in)**: model receives `{ handle, share_url, expires_at, max_reads, mode }` in `tool_result`; the link opens only with the recipient's X25519 key. Requires short TTL (≤30m), `max_reads=1`, mandatory `to` (recipient pubkey). Every forward is audit-logged in the encrypted state file.
 
 ## Tool surface
@@ -35,7 +35,7 @@ All state lives encrypted at `${XDG_CONFIG_HOME}/seal-mcp/state.json` (mode `0o6
 
 Passphrase delivery, in priority order:
 
-1. **OS keychain** (default) — `keytar` (optional dependency) reads from libsecret / macOS Keychain / wincred. The first `serve` stores a random passphrase there itself; `sealnet-mcp init` lets you choose one instead.
+1. **OS keychain** (default) — `@napi-rs/keyring` (optional dependency) reads from the Secret Service on Linux / macOS Keychain / Windows Credential Manager. The first `serve` stores a random passphrase there itself; `sealnet-mcp init` lets you choose one instead.
 2. **`SEAL_MCP_PASSPHRASE` env var** — explicit opt-in for CI/headless. Warning logged.
 3. **Cleartext on disk** — explicit refusal even if user tries `--passphrase-file …`.
 

package/dist/cli.cjs

@@ -7099,6 +7099,7 @@ async function probeStateLock(stateDir, deps = {}) {
 }
 
 // src/passphrase.ts
+var import_node_child_process = require("child_process");
 var import_node_crypto2 = require("crypto");
 var SERVICE_NAME = "seal-mcp";
 var ACCOUNT_NAME = "state";
@@ -7122,23 +7123,50 @@ var PassphraseNotFoundError = class extends Error {
     this.name = "PassphraseNotFoundError";
   }
 };
+function keyringEntry(keyring, platform, service, account) {
+  return platform === "win32" ? keyring.AsyncEntry.withTarget(`${service}/${account}`, service, account) : new keyring.AsyncEntry(service, account, { linux: { store: "secret-service" } });
+}
+function readKeytarLinuxEntry(service, account) {
+  return new Promise((resolve5) => {
+    (0, import_node_child_process.execFile)("secret-tool", ["lookup", "service", service, "account", account], { timeout: 5e3 }, (err2, stdout) => {
+      const value = err2 ? "" : stdout.replace(/\n$/, "");
+      resolve5(value.length > 0 ? value : null);
+    });
+  });
+}
+function keytarOverKeyring(keyring, platform = process.platform, readLegacy = readKeytarLinuxEntry) {
+  const entry = (service, account) => keyringEntry(keyring, platform, service, account);
+  const store = (service, account, password) => entry(service, account).setSecret(Buffer.from(password, "utf8"));
+  return {
+    async getPassword(service, account) {
+      const secret = await entry(service, account).getSecret();
+      if (secret !== void 0) return Buffer.from(secret).toString("utf8");
+      const legacy = platform === "linux" ? await readLegacy(service, account) : null;
+      if (legacy !== null) await store(service, account, legacy).catch(() => void 0);
+      return legacy;
+    },
+    setPassword: store,
+    deletePassword: (service, account) => entry(service, account).deleteCredential()
+  };
+}
 var keytarCache = void 0;
 async function loadKeytar() {
   if (keytarCache !== void 0) return keytarCache;
   try {
-    const mod = await import("keytar");
-    keytarCache = mod.default ?? mod;
-    return keytarCache;
+    const mod = await import("@napi-rs/keyring");
+    const keyring = mod.default ?? mod;
+    keyringEntry(keyring, process.platform, SERVICE_NAME, ACCOUNT_NAME);
+    keytarCache = keytarOverKeyring(keyring);
   } catch {
     keytarCache = null;
-    return null;
   }
+  return keytarCache;
 }
 async function loadKeytarOrThrow() {
   const k = await loadKeytar();
   if (k === null) {
     throw new KeytarUnavailableError(
-      "failed to load `keytar` native module. On Debian/Ubuntu install `libsecret-1-0`; on Fedora install `gnome-keyring`; on macOS/Windows this should never happen \u2014 file a bug."
+      "no OS keychain. On Linux start a Secret Service (gnome-keyring or KWallet); on macOS/Windows this should never happen \u2014 file a bug."
     );
   }
   return k;
@@ -11343,13 +11371,13 @@ var seal_mcp_v1_default = {
     progress: "When a `tools/call` carries `_meta.progressToken`, `seal_share` and `seal_open mode=file` send `notifications/progress` with `progress` = ciphertext bytes done (upload: confirmed by storage) and `total` = ciphertext bytes in all; at most one per second, `progress` strictly increasing, the last one at `progress = total`."
   },
   server_instructions: {
-    text: "SEAL moves files and secrets between people and agents without their content entering this conversation. When someone wants a file, folder or secret sent to them, to another machine or to another agent, call seal_share with its path and do not open, print or Read it first. When you need an API key, password, file or folder from the user, or they offer or ask how to give you one, call seal_request right away instead of explaining other ways or asking them to paste or upload it. Open a SEAL link someone gave you with seal_open (mode=file for secrets and large files).",
+    text: "SEAL moves files and secrets between people and agents without their content entering this conversation. When someone wants a file, folder or secret sent to them, to another machine or to another agent, call seal_share with its path and do not open, print or Read it first. When you need an API key, password, file or folder from the user, or they offer or ask how to give you one, call seal_request right away instead of explaining other ways or asking them to paste or upload it. Open a SEAL link someone gave you with seal_open (mode=file for secrets and large files). Never read or print a SEAL handoff file.",
     note: "The `instructions` of the `initialize` result (SPEC-AGENTS \xA78.1). Hosts that defer MCP tools behind a tool search (Claude Code) show the model only tool names until it searches, but put these instructions into the system prompt: this is the one text a model reads before it decides to look for a tool, or reads the file it was asked to send."
   },
   tools: {
     seal_share: {
       title: "Share a file via SEAL",
-      description: "Give the user or another agent a file or a secret WITHOUT it passing through this chat. Works for any size (folders, dumps, exports, builds, videos \u2014 up to 1 GB free, more after one card payment by the user). Default mode `handoff`: the link goes to the user's clipboard or a 0600 file and you get only a handle. Mode `forward`: a link only the holder of the given X25519 key can open \u2014 use it for another agent. Never paste secrets or huge content into the chat instead.",
+      description: "Give the user or another agent a file or a secret WITHOUT it passing through this chat. Works for large files (folders, dumps, exports, builds, videos \u2014 up to 1 GB free, more after one card payment by the user). Default mode `handoff`: the link goes to the user's clipboard and you get a handle. Where there is no clipboard it goes to a 0600 file and you get its path: do not read that file and do not print it. Mode `forward`: a link only the holder of the given X25519 key can open \u2014 use it for another agent. Never paste secrets or huge content into the chat instead.",
       annotations: { destructiveHint: false, openWorldHint: true },
       input: {
         properties: {
@@ -11399,7 +11427,9 @@ var seal_mcp_v1_default = {
           expires_at: { type: "string", format: "date-time", description: "ISO 8601 UTC expiry timestamp." }
         },
         MUST_NOT_contain: ["share_url", "url", "password", "passphrase", "link_key", "owner_token"],
-        rationale: "Anything in this object reaches the model. Any field that lets the model reconstruct or re-issue the share capability defeats handoff mode."
+        rationale: "Anything in this object reaches the model. Any field that lets the model reconstruct or re-issue the share capability defeats handoff mode.",
+        receipt_clipboard: "The seal link is on your clipboard. Paste it to the recipient.",
+        receipt_file: "The seal link is in {file} (mode 0600, removed automatically later). Give it to the recipient. Anyone who can read files on this machine as this user, this agent included, can read it. In a cloud or container session prefer mode=forward to the recipient\u2019s key."
       },
       output_forward: {
         type: "object",
@@ -11797,7 +11827,7 @@ var seal_mcp_v1_default = {
       {
         rank: 1,
         method: "os_keychain",
-        implementation: "keytar (libsecret on Linux, macOS Keychain, Windows Credential Manager), an OPTIONAL dependency loaded lazily: its absence never fails install or start. Service id: 'seal-mcp', account: 'state'. Set during `sealnet-mcp init` (chosen by the user), or by the first `sealnet-mcp serve` without state, which generates a random 32-byte passphrase itself \u2014 no prompt, no `init` step. Read on every subsequent process start.",
+        implementation: "@napi-rs/keyring (the Secret Service on Linux, never the kernel keyring, which forgets on reboot; macOS Keychain; Windows Credential Manager), an OPTIONAL dependency loaded lazily: its absence never fails install or start. It replaced keytar in 0.2.4 and finds the entry keytar wrote (Windows credential `seal-mcp/state`, the passphrase as UTF-8 bytes; on Linux the old entry is read once through `secret-tool` and stored anew). Service id: 'seal-mcp', account: 'state'. Set during `sealnet-mcp init` (chosen by the user), or by the first `sealnet-mcp serve` without state, which generates a random 32-byte passphrase itself \u2014 no prompt, no `init` step. Read on every subsequent process start.",
         default: true
       },
       {
@@ -12945,7 +12975,7 @@ async function sealProFileGet(source, input) {
 }
 
 // src/tools/request.ts
-var import_node_child_process = require("child_process");
+var import_node_child_process2 = require("child_process");
 var import_node_fs3 = require("fs");
 var import_promises5 = require("fs/promises");
 var import_node_os5 = require("os");
@@ -12964,7 +12994,7 @@ function runSealCli(args) {
   const cli = findSealCli();
   if (!cli) return Promise.resolve(null);
   return new Promise((resolve5) => {
-    (0, import_node_child_process.execFile)(cli, [...args], { maxBuffer: 1024 * 1024 }, (_err, stdout) => {
+    (0, import_node_child_process2.execFile)(cli, [...args], { maxBuffer: 1024 * 1024 }, (_err, stdout) => {
       try {
         resolve5(JSON.parse(stdout));
       } catch {
@@ -13335,6 +13365,7 @@ function guessMimeFromName(name) {
 }
 var VALID_TTL = ["5m", "30m", "1h", "1d", "7d"];
 var EXPIRE_DEFAULT = seal_mcp_v1_default.tools.seal_share.expire_default;
+var HANDOFF_OUTPUT = seal_mcp_v1_default.tools.seal_share.output_handoff;
 var TIER_BYTES2 = limits_default2.limits.TIER_BYTES;
 var PAYMENT_RECEIPT = "The file is larger than 1 GB. Show the user the payment link; the upload continues after payment. Then call seal_share with `payment` set to this handle.";
 function defaultExpire(mode, size) {
@@ -13735,7 +13766,7 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
   appendAudit(ctx, "seal_share", handle, mode);
   delete ctx.state.pending[handle];
   await ctx.persist();
-  const delivered = handoff.channel === "clipboard" ? "The seal link is on your clipboard. Paste it to the recipient." : `The seal link is in ${handoff.file} (mode 0600, removed automatically later). Give it to the recipient.`;
+  const delivered = handoff.channel === "clipboard" ? HANDOFF_OUTPUT.receipt_clipboard : HANDOFF_OUTPUT.receipt_file.replace("{file}", handoff.file ?? "");
   const verified = uploaded.verification === "verified" ? delivered : `${delivered} The server has not finished verifying the file: for the next few seconds the recipient sees "not ready", after which the link works.`;
   const receipt = ctx.ephemeral ? `${verified} This server keeps no state on disk: the handle lives until it restarts; the seal's expiry does not depend on it.` : verified;
   return {
@@ -13937,7 +13968,7 @@ function proFileGetOutputToWire(out) {
 }
 
 // src/server.ts
-var SERVER_VERSION = "0.2.3";
+var SERVER_VERSION = "0.2.5";
 var toolMeta = (name) => {
   const { title, description, annotations } = seal_mcp_v1_default.tools[name];
   return { title, description, annotations };
@@ -14313,7 +14344,7 @@ async function runInit(opts) {
       if (err2 instanceof KeytarUnavailableError) {
         logStderr(`${PROGRAM_NAME} init: warning: ${err2.message}`);
         logStderr(
-          `${PROGRAM_NAME} init: state.json IS encrypted, but you must export ${PASSPHRASE_ENV_VAR} before every \`${PROGRAM_NAME} serve\` until keytar works.`
+          `${PROGRAM_NAME} init: state.json IS encrypted, but you must export ${PASSPHRASE_ENV_VAR} before every \`${PROGRAM_NAME} serve\` until the OS keychain works.`
         );
       } else {
         throw err2;
@@ -14487,7 +14518,7 @@ async function runDoctor(opts) {
   }
   if (!kc.available) {
     logStderr(
-      `hint: keychain unavailable. Install \`libsecret-1-0\` (Debian/Ubuntu) or \`gnome-keyring\` (Fedora), or rely on ${PASSPHRASE_ENV_VAR}; with neither, \`serve\` runs ephemeral (handles live until restart).`
+      `hint: keychain unavailable. On Linux start a Secret Service (gnome-keyring or KWallet), or rely on ${PASSPHRASE_ENV_VAR}; with neither, \`serve\` runs ephemeral (handles live until restart).`
     );
   } else if (stateExists && !kc.hasEntry && !report.env_passphrase_set) {
     logStderr(`hint: keychain has no entry and ${PASSPHRASE_ENV_VAR} is unset \u2014 \`serve\` will fail.`);

package/dist/cli.js

@@ -7071,6 +7071,7 @@ async function probeStateLock(stateDir, deps = {}) {
 }
 
 // src/passphrase.ts
+import { execFile } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
 var SERVICE_NAME = "seal-mcp";
 var ACCOUNT_NAME = "state";
@@ -7094,23 +7095,50 @@ var PassphraseNotFoundError = class extends Error {
     this.name = "PassphraseNotFoundError";
   }
 };
+function keyringEntry(keyring, platform, service, account) {
+  return platform === "win32" ? keyring.AsyncEntry.withTarget(`${service}/${account}`, service, account) : new keyring.AsyncEntry(service, account, { linux: { store: "secret-service" } });
+}
+function readKeytarLinuxEntry(service, account) {
+  return new Promise((resolve5) => {
+    execFile("secret-tool", ["lookup", "service", service, "account", account], { timeout: 5e3 }, (err2, stdout) => {
+      const value = err2 ? "" : stdout.replace(/\n$/, "");
+      resolve5(value.length > 0 ? value : null);
+    });
+  });
+}
+function keytarOverKeyring(keyring, platform = process.platform, readLegacy = readKeytarLinuxEntry) {
+  const entry = (service, account) => keyringEntry(keyring, platform, service, account);
+  const store = (service, account, password) => entry(service, account).setSecret(Buffer.from(password, "utf8"));
+  return {
+    async getPassword(service, account) {
+      const secret = await entry(service, account).getSecret();
+      if (secret !== void 0) return Buffer.from(secret).toString("utf8");
+      const legacy = platform === "linux" ? await readLegacy(service, account) : null;
+      if (legacy !== null) await store(service, account, legacy).catch(() => void 0);
+      return legacy;
+    },
+    setPassword: store,
+    deletePassword: (service, account) => entry(service, account).deleteCredential()
+  };
+}
 var keytarCache = void 0;
 async function loadKeytar() {
   if (keytarCache !== void 0) return keytarCache;
   try {
-    const mod = await import("keytar");
-    keytarCache = mod.default ?? mod;
-    return keytarCache;
+    const mod = await import("@napi-rs/keyring");
+    const keyring = mod.default ?? mod;
+    keyringEntry(keyring, process.platform, SERVICE_NAME, ACCOUNT_NAME);
+    keytarCache = keytarOverKeyring(keyring);
   } catch {
     keytarCache = null;
-    return null;
   }
+  return keytarCache;
 }
 async function loadKeytarOrThrow() {
   const k = await loadKeytar();
   if (k === null) {
     throw new KeytarUnavailableError(
-      "failed to load `keytar` native module. On Debian/Ubuntu install `libsecret-1-0`; on Fedora install `gnome-keyring`; on macOS/Windows this should never happen \u2014 file a bug."
+      "no OS keychain. On Linux start a Secret Service (gnome-keyring or KWallet); on macOS/Windows this should never happen \u2014 file a bug."
     );
   }
   return k;
@@ -11315,13 +11343,13 @@ var seal_mcp_v1_default = {
     progress: "When a `tools/call` carries `_meta.progressToken`, `seal_share` and `seal_open mode=file` send `notifications/progress` with `progress` = ciphertext bytes done (upload: confirmed by storage) and `total` = ciphertext bytes in all; at most one per second, `progress` strictly increasing, the last one at `progress = total`."
   },
   server_instructions: {
-    text: "SEAL moves files and secrets between people and agents without their content entering this conversation. When someone wants a file, folder or secret sent to them, to another machine or to another agent, call seal_share with its path and do not open, print or Read it first. When you need an API key, password, file or folder from the user, or they offer or ask how to give you one, call seal_request right away instead of explaining other ways or asking them to paste or upload it. Open a SEAL link someone gave you with seal_open (mode=file for secrets and large files).",
+    text: "SEAL moves files and secrets between people and agents without their content entering this conversation. When someone wants a file, folder or secret sent to them, to another machine or to another agent, call seal_share with its path and do not open, print or Read it first. When you need an API key, password, file or folder from the user, or they offer or ask how to give you one, call seal_request right away instead of explaining other ways or asking them to paste or upload it. Open a SEAL link someone gave you with seal_open (mode=file for secrets and large files). Never read or print a SEAL handoff file.",
     note: "The `instructions` of the `initialize` result (SPEC-AGENTS \xA78.1). Hosts that defer MCP tools behind a tool search (Claude Code) show the model only tool names until it searches, but put these instructions into the system prompt: this is the one text a model reads before it decides to look for a tool, or reads the file it was asked to send."
   },
   tools: {
     seal_share: {
       title: "Share a file via SEAL",
-      description: "Give the user or another agent a file or a secret WITHOUT it passing through this chat. Works for any size (folders, dumps, exports, builds, videos \u2014 up to 1 GB free, more after one card payment by the user). Default mode `handoff`: the link goes to the user's clipboard or a 0600 file and you get only a handle. Mode `forward`: a link only the holder of the given X25519 key can open \u2014 use it for another agent. Never paste secrets or huge content into the chat instead.",
+      description: "Give the user or another agent a file or a secret WITHOUT it passing through this chat. Works for large files (folders, dumps, exports, builds, videos \u2014 up to 1 GB free, more after one card payment by the user). Default mode `handoff`: the link goes to the user's clipboard and you get a handle. Where there is no clipboard it goes to a 0600 file and you get its path: do not read that file and do not print it. Mode `forward`: a link only the holder of the given X25519 key can open \u2014 use it for another agent. Never paste secrets or huge content into the chat instead.",
       annotations: { destructiveHint: false, openWorldHint: true },
       input: {
         properties: {
@@ -11371,7 +11399,9 @@ var seal_mcp_v1_default = {
           expires_at: { type: "string", format: "date-time", description: "ISO 8601 UTC expiry timestamp." }
         },
         MUST_NOT_contain: ["share_url", "url", "password", "passphrase", "link_key", "owner_token"],
-        rationale: "Anything in this object reaches the model. Any field that lets the model reconstruct or re-issue the share capability defeats handoff mode."
+        rationale: "Anything in this object reaches the model. Any field that lets the model reconstruct or re-issue the share capability defeats handoff mode.",
+        receipt_clipboard: "The seal link is on your clipboard. Paste it to the recipient.",
+        receipt_file: "The seal link is in {file} (mode 0600, removed automatically later). Give it to the recipient. Anyone who can read files on this machine as this user, this agent included, can read it. In a cloud or container session prefer mode=forward to the recipient\u2019s key."
       },
       output_forward: {
         type: "object",
@@ -11769,7 +11799,7 @@ var seal_mcp_v1_default = {
       {
         rank: 1,
         method: "os_keychain",
-        implementation: "keytar (libsecret on Linux, macOS Keychain, Windows Credential Manager), an OPTIONAL dependency loaded lazily: its absence never fails install or start. Service id: 'seal-mcp', account: 'state'. Set during `sealnet-mcp init` (chosen by the user), or by the first `sealnet-mcp serve` without state, which generates a random 32-byte passphrase itself \u2014 no prompt, no `init` step. Read on every subsequent process start.",
+        implementation: "@napi-rs/keyring (the Secret Service on Linux, never the kernel keyring, which forgets on reboot; macOS Keychain; Windows Credential Manager), an OPTIONAL dependency loaded lazily: its absence never fails install or start. It replaced keytar in 0.2.4 and finds the entry keytar wrote (Windows credential `seal-mcp/state`, the passphrase as UTF-8 bytes; on Linux the old entry is read once through `secret-tool` and stored anew). Service id: 'seal-mcp', account: 'state'. Set during `sealnet-mcp init` (chosen by the user), or by the first `sealnet-mcp serve` without state, which generates a random 32-byte passphrase itself \u2014 no prompt, no `init` step. Read on every subsequent process start.",
         default: true
       },
       {
@@ -12917,7 +12947,7 @@ async function sealProFileGet(source, input) {
 }
 
 // src/tools/request.ts
-import { execFile } from "child_process";
+import { execFile as execFile2 } from "child_process";
 import { existsSync } from "fs";
 import { mkdtemp as mkdtemp2 } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
@@ -12936,7 +12966,7 @@ function runSealCli(args) {
   const cli = findSealCli();
   if (!cli) return Promise.resolve(null);
   return new Promise((resolve5) => {
-    execFile(cli, [...args], { maxBuffer: 1024 * 1024 }, (_err, stdout) => {
+    execFile2(cli, [...args], { maxBuffer: 1024 * 1024 }, (_err, stdout) => {
       try {
         resolve5(JSON.parse(stdout));
       } catch {
@@ -13307,6 +13337,7 @@ function guessMimeFromName(name) {
 }
 var VALID_TTL = ["5m", "30m", "1h", "1d", "7d"];
 var EXPIRE_DEFAULT = seal_mcp_v1_default.tools.seal_share.expire_default;
+var HANDOFF_OUTPUT = seal_mcp_v1_default.tools.seal_share.output_handoff;
 var TIER_BYTES2 = limits_default2.limits.TIER_BYTES;
 var PAYMENT_RECEIPT = "The file is larger than 1 GB. Show the user the payment link; the upload continues after payment. Then call seal_share with `payment` set to this handle.";
 function defaultExpire(mode, size) {
@@ -13707,7 +13738,7 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
   appendAudit(ctx, "seal_share", handle, mode);
   delete ctx.state.pending[handle];
   await ctx.persist();
-  const delivered = handoff.channel === "clipboard" ? "The seal link is on your clipboard. Paste it to the recipient." : `The seal link is in ${handoff.file} (mode 0600, removed automatically later). Give it to the recipient.`;
+  const delivered = handoff.channel === "clipboard" ? HANDOFF_OUTPUT.receipt_clipboard : HANDOFF_OUTPUT.receipt_file.replace("{file}", handoff.file ?? "");
   const verified = uploaded.verification === "verified" ? delivered : `${delivered} The server has not finished verifying the file: for the next few seconds the recipient sees "not ready", after which the link works.`;
   const receipt = ctx.ephemeral ? `${verified} This server keeps no state on disk: the handle lives until it restarts; the seal's expiry does not depend on it.` : verified;
   return {
@@ -13909,7 +13940,7 @@ function proFileGetOutputToWire(out) {
 }
 
 // src/server.ts
-var SERVER_VERSION = "0.2.3";
+var SERVER_VERSION = "0.2.5";
 var toolMeta = (name) => {
   const { title, description, annotations } = seal_mcp_v1_default.tools[name];
   return { title, description, annotations };
@@ -14285,7 +14316,7 @@ async function runInit(opts) {
       if (err2 instanceof KeytarUnavailableError) {
         logStderr(`${PROGRAM_NAME} init: warning: ${err2.message}`);
         logStderr(
-          `${PROGRAM_NAME} init: state.json IS encrypted, but you must export ${PASSPHRASE_ENV_VAR} before every \`${PROGRAM_NAME} serve\` until keytar works.`
+          `${PROGRAM_NAME} init: state.json IS encrypted, but you must export ${PASSPHRASE_ENV_VAR} before every \`${PROGRAM_NAME} serve\` until the OS keychain works.`
         );
       } else {
         throw err2;
@@ -14459,7 +14490,7 @@ async function runDoctor(opts) {
   }
   if (!kc.available) {
     logStderr(
-      `hint: keychain unavailable. Install \`libsecret-1-0\` (Debian/Ubuntu) or \`gnome-keyring\` (Fedora), or rely on ${PASSPHRASE_ENV_VAR}; with neither, \`serve\` runs ephemeral (handles live until restart).`
+      `hint: keychain unavailable. On Linux start a Secret Service (gnome-keyring or KWallet), or rely on ${PASSPHRASE_ENV_VAR}; with neither, \`serve\` runs ephemeral (handles live until restart).`
     );
   } else if (stateExists && !kc.hasEntry && !report.env_passphrase_set) {
     logStderr(`hint: keychain has no entry and ${PASSPHRASE_ENV_VAR} is unset \u2014 \`serve\` will fail.`);

package/dist/index.cjs

@@ -4138,13 +4138,13 @@ var seal_mcp_v1_default = {
     progress: "When a `tools/call` carries `_meta.progressToken`, `seal_share` and `seal_open mode=file` send `notifications/progress` with `progress` = ciphertext bytes done (upload: confirmed by storage) and `total` = ciphertext bytes in all; at most one per second, `progress` strictly increasing, the last one at `progress = total`."
   },
   server_instructions: {
-    text: "SEAL moves files and secrets between people and agents without their content entering this conversation. When someone wants a file, folder or secret sent to them, to another machine or to another agent, call seal_share with its path and do not open, print or Read it first. When you need an API key, password, file or folder from the user, or they offer or ask how to give you one, call seal_request right away instead of explaining other ways or asking them to paste or upload it. Open a SEAL link someone gave you with seal_open (mode=file for secrets and large files).",
+    text: "SEAL moves files and secrets between people and agents without their content entering this conversation. When someone wants a file, folder or secret sent to them, to another machine or to another agent, call seal_share with its path and do not open, print or Read it first. When you need an API key, password, file or folder from the user, or they offer or ask how to give you one, call seal_request right away instead of explaining other ways or asking them to paste or upload it. Open a SEAL link someone gave you with seal_open (mode=file for secrets and large files). Never read or print a SEAL handoff file.",
     note: "The `instructions` of the `initialize` result (SPEC-AGENTS \xA78.1). Hosts that defer MCP tools behind a tool search (Claude Code) show the model only tool names until it searches, but put these instructions into the system prompt: this is the one text a model reads before it decides to look for a tool, or reads the file it was asked to send."
   },
   tools: {
     seal_share: {
       title: "Share a file via SEAL",
-      description: "Give the user or another agent a file or a secret WITHOUT it passing through this chat. Works for any size (folders, dumps, exports, builds, videos \u2014 up to 1 GB free, more after one card payment by the user). Default mode `handoff`: the link goes to the user's clipboard or a 0600 file and you get only a handle. Mode `forward`: a link only the holder of the given X25519 key can open \u2014 use it for another agent. Never paste secrets or huge content into the chat instead.",
+      description: "Give the user or another agent a file or a secret WITHOUT it passing through this chat. Works for large files (folders, dumps, exports, builds, videos \u2014 up to 1 GB free, more after one card payment by the user). Default mode `handoff`: the link goes to the user's clipboard and you get a handle. Where there is no clipboard it goes to a 0600 file and you get its path: do not read that file and do not print it. Mode `forward`: a link only the holder of the given X25519 key can open \u2014 use it for another agent. Never paste secrets or huge content into the chat instead.",
       annotations: { destructiveHint: false, openWorldHint: true },
       input: {
         properties: {
@@ -4194,7 +4194,9 @@ var seal_mcp_v1_default = {
           expires_at: { type: "string", format: "date-time", description: "ISO 8601 UTC expiry timestamp." }
         },
         MUST_NOT_contain: ["share_url", "url", "password", "passphrase", "link_key", "owner_token"],
-        rationale: "Anything in this object reaches the model. Any field that lets the model reconstruct or re-issue the share capability defeats handoff mode."
+        rationale: "Anything in this object reaches the model. Any field that lets the model reconstruct or re-issue the share capability defeats handoff mode.",
+        receipt_clipboard: "The seal link is on your clipboard. Paste it to the recipient.",
+        receipt_file: "The seal link is in {file} (mode 0600, removed automatically later). Give it to the recipient. Anyone who can read files on this machine as this user, this agent included, can read it. In a cloud or container session prefer mode=forward to the recipient\u2019s key."
       },
       output_forward: {
         type: "object",
@@ -4592,7 +4594,7 @@ var seal_mcp_v1_default = {
       {
         rank: 1,
         method: "os_keychain",
-        implementation: "keytar (libsecret on Linux, macOS Keychain, Windows Credential Manager), an OPTIONAL dependency loaded lazily: its absence never fails install or start. Service id: 'seal-mcp', account: 'state'. Set during `sealnet-mcp init` (chosen by the user), or by the first `sealnet-mcp serve` without state, which generates a random 32-byte passphrase itself \u2014 no prompt, no `init` step. Read on every subsequent process start.",
+        implementation: "@napi-rs/keyring (the Secret Service on Linux, never the kernel keyring, which forgets on reboot; macOS Keychain; Windows Credential Manager), an OPTIONAL dependency loaded lazily: its absence never fails install or start. It replaced keytar in 0.2.4 and finds the entry keytar wrote (Windows credential `seal-mcp/state`, the passphrase as UTF-8 bytes; on Linux the old entry is read once through `secret-tool` and stored anew). Service id: 'seal-mcp', account: 'state'. Set during `sealnet-mcp init` (chosen by the user), or by the first `sealnet-mcp serve` without state, which generates a random 32-byte passphrase itself \u2014 no prompt, no `init` step. Read on every subsequent process start.",
         default: true
       },
       {
@@ -13190,6 +13192,7 @@ function guessMimeFromName(name) {
 }
 var VALID_TTL = ["5m", "30m", "1h", "1d", "7d"];
 var EXPIRE_DEFAULT = seal_mcp_v1_default.tools.seal_share.expire_default;
+var HANDOFF_OUTPUT = seal_mcp_v1_default.tools.seal_share.output_handoff;
 var TIER_BYTES2 = limits_default2.limits.TIER_BYTES;
 var PAYMENT_RECEIPT = "The file is larger than 1 GB. Show the user the payment link; the upload continues after payment. Then call seal_share with `payment` set to this handle.";
 function defaultExpire(mode, size) {
@@ -13590,7 +13593,7 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
   appendAudit(ctx, "seal_share", handle, mode);
   delete ctx.state.pending[handle];
   await ctx.persist();
-  const delivered = handoff.channel === "clipboard" ? "The seal link is on your clipboard. Paste it to the recipient." : `The seal link is in ${handoff.file} (mode 0600, removed automatically later). Give it to the recipient.`;
+  const delivered = handoff.channel === "clipboard" ? HANDOFF_OUTPUT.receipt_clipboard : HANDOFF_OUTPUT.receipt_file.replace("{file}", handoff.file ?? "");
   const verified = uploaded.verification === "verified" ? delivered : `${delivered} The server has not finished verifying the file: for the next few seconds the recipient sees "not ready", after which the link works.`;
   const receipt = ctx.ephemeral ? `${verified} This server keeps no state on disk: the handle lives until it restarts; the seal's expiry does not depend on it.` : verified;
   return {
@@ -13792,7 +13795,7 @@ function proFileGetOutputToWire(out) {
 }
 
 // src/server.ts
-var SERVER_VERSION = "0.2.3";
+var SERVER_VERSION = "0.2.5";
 var toolMeta = (name) => {
   const { title, description, annotations } = seal_mcp_v1_default.tools[name];
   return { title, description, annotations };
@@ -14141,6 +14144,7 @@ function osDefaultDir(env, platform, home) {
 }
 
 // src/passphrase.ts
+var import_node_child_process2 = require("child_process");
 var import_node_crypto4 = require("crypto");
 var SERVICE_NAME = "seal-mcp";
 var ACCOUNT_NAME = "state";
@@ -14164,23 +14168,50 @@ var PassphraseNotFoundError = class extends Error {
     this.name = "PassphraseNotFoundError";
   }
 };
+function keyringEntry(keyring, platform, service, account) {
+  return platform === "win32" ? keyring.AsyncEntry.withTarget(`${service}/${account}`, service, account) : new keyring.AsyncEntry(service, account, { linux: { store: "secret-service" } });
+}
+function readKeytarLinuxEntry(service, account) {
+  return new Promise((resolve5) => {
+    (0, import_node_child_process2.execFile)("secret-tool", ["lookup", "service", service, "account", account], { timeout: 5e3 }, (err2, stdout) => {
+      const value = err2 ? "" : stdout.replace(/\n$/, "");
+      resolve5(value.length > 0 ? value : null);
+    });
+  });
+}
+function keytarOverKeyring(keyring, platform = process.platform, readLegacy = readKeytarLinuxEntry) {
+  const entry = (service, account) => keyringEntry(keyring, platform, service, account);
+  const store = (service, account, password) => entry(service, account).setSecret(Buffer.from(password, "utf8"));
+  return {
+    async getPassword(service, account) {
+      const secret = await entry(service, account).getSecret();
+      if (secret !== void 0) return Buffer.from(secret).toString("utf8");
+      const legacy = platform === "linux" ? await readLegacy(service, account) : null;
+      if (legacy !== null) await store(service, account, legacy).catch(() => void 0);
+      return legacy;
+    },
+    setPassword: store,
+    deletePassword: (service, account) => entry(service, account).deleteCredential()
+  };
+}
 var keytarCache = void 0;
 async function loadKeytar() {
   if (keytarCache !== void 0) return keytarCache;
   try {
-    const mod = await import("keytar");
-    keytarCache = mod.default ?? mod;
-    return keytarCache;
+    const mod = await import("@napi-rs/keyring");
+    const keyring = mod.default ?? mod;
+    keyringEntry(keyring, process.platform, SERVICE_NAME, ACCOUNT_NAME);
+    keytarCache = keytarOverKeyring(keyring);
   } catch {
     keytarCache = null;
-    return null;
   }
+  return keytarCache;
 }
 async function loadKeytarOrThrow() {
   const k = await loadKeytar();
   if (k === null) {
     throw new KeytarUnavailableError(
-      "failed to load `keytar` native module. On Debian/Ubuntu install `libsecret-1-0`; on Fedora install `gnome-keyring`; on macOS/Windows this should never happen \u2014 file a bug."
+      "no OS keychain. On Linux start a Secret Service (gnome-keyring or KWallet); on macOS/Windows this should never happen \u2014 file a bug."
     );
   }
   return k;