sealnet-mcp 0.2.4 → 0.2.5

package/README.md

@@ -8,7 +8,7 @@ Model Context Protocol (MCP) server for **SEAL**.
 
 When an MCP-connected AI agent (Claude Desktop, Cursor, Cline, etc.) creates a SEAL via this server:
 
-- **handoff mode (default)**: the share link (the key is in its fragment, there is no password) is delivered to the human user via **system clipboard** (primary) or **0o600 local file** (fallback when clipboard is unavailable — headless, SSH, WSL without display). The `tool_result` returned to the model contains **only** an opaque handle and a human-readable receipt. The model cannot exfiltrate the link because it never sees it.
+- **handoff mode (default)**: the share link (the key is in its fragment, there is no password) is delivered to the human user via **system clipboard** (primary) or **0o600 local file** (fallback when clipboard is unavailable — headless, SSH, WSL without display). The `tool_result` returned to the model contains **only** an opaque handle and a human-readable receipt. The link is never written into the conversation; on the file channel the receipt names the file, and an agent that can read files on that machine can read it.
 - **forward mode (explicit opt-in)**: model receives `{ handle, share_url, expires_at, max_reads, mode }` in `tool_result`; the link opens only with the recipient's X25519 key. Requires short TTL (≤30m), `max_reads=1`, mandatory `to` (recipient pubkey). Every forward is audit-logged in the encrypted state file.
 
 ## Tool surface

package/dist/cli.cjs

@@ -11371,13 +11371,13 @@ var seal_mcp_v1_default = {
     progress: "When a `tools/call` carries `_meta.progressToken`, `seal_share` and `seal_open mode=file` send `notifications/progress` with `progress` = ciphertext bytes done (upload: confirmed by storage) and `total` = ciphertext bytes in all; at most one per second, `progress` strictly increasing, the last one at `progress = total`."
   },
   server_instructions: {
-    text: "SEAL moves files and secrets between people and agents without their content entering this conversation. When someone wants a file, folder or secret sent to them, to another machine or to another agent, call seal_share with its path and do not open, print or Read it first. When you need an API key, password, file or folder from the user, or they offer or ask how to give you one, call seal_request right away instead of explaining other ways or asking them to paste or upload it. Open a SEAL link someone gave you with seal_open (mode=file for secrets and large files).",
+    text: "SEAL moves files and secrets between people and agents without their content entering this conversation. When someone wants a file, folder or secret sent to them, to another machine or to another agent, call seal_share with its path and do not open, print or Read it first. When you need an API key, password, file or folder from the user, or they offer or ask how to give you one, call seal_request right away instead of explaining other ways or asking them to paste or upload it. Open a SEAL link someone gave you with seal_open (mode=file for secrets and large files). Never read or print a SEAL handoff file.",
     note: "The `instructions` of the `initialize` result (SPEC-AGENTS \xA78.1). Hosts that defer MCP tools behind a tool search (Claude Code) show the model only tool names until it searches, but put these instructions into the system prompt: this is the one text a model reads before it decides to look for a tool, or reads the file it was asked to send."
   },
   tools: {
     seal_share: {
       title: "Share a file via SEAL",
-      description: "Give the user or another agent a file or a secret WITHOUT it passing through this chat. Works for any size (folders, dumps, exports, builds, videos \u2014 up to 1 GB free, more after one card payment by the user). Default mode `handoff`: the link goes to the user's clipboard or a 0600 file and you get only a handle. Mode `forward`: a link only the holder of the given X25519 key can open \u2014 use it for another agent. Never paste secrets or huge content into the chat instead.",
+      description: "Give the user or another agent a file or a secret WITHOUT it passing through this chat. Works for large files (folders, dumps, exports, builds, videos \u2014 up to 1 GB free, more after one card payment by the user). Default mode `handoff`: the link goes to the user's clipboard and you get a handle. Where there is no clipboard it goes to a 0600 file and you get its path: do not read that file and do not print it. Mode `forward`: a link only the holder of the given X25519 key can open \u2014 use it for another agent. Never paste secrets or huge content into the chat instead.",
       annotations: { destructiveHint: false, openWorldHint: true },
       input: {
         properties: {
@@ -11427,7 +11427,9 @@ var seal_mcp_v1_default = {
           expires_at: { type: "string", format: "date-time", description: "ISO 8601 UTC expiry timestamp." }
         },
         MUST_NOT_contain: ["share_url", "url", "password", "passphrase", "link_key", "owner_token"],
-        rationale: "Anything in this object reaches the model. Any field that lets the model reconstruct or re-issue the share capability defeats handoff mode."
+        rationale: "Anything in this object reaches the model. Any field that lets the model reconstruct or re-issue the share capability defeats handoff mode.",
+        receipt_clipboard: "The seal link is on your clipboard. Paste it to the recipient.",
+        receipt_file: "The seal link is in {file} (mode 0600, removed automatically later). Give it to the recipient. Anyone who can read files on this machine as this user, this agent included, can read it. In a cloud or container session prefer mode=forward to the recipient\u2019s key."
       },
       output_forward: {
         type: "object",
@@ -13363,6 +13365,7 @@ function guessMimeFromName(name) {
 }
 var VALID_TTL = ["5m", "30m", "1h", "1d", "7d"];
 var EXPIRE_DEFAULT = seal_mcp_v1_default.tools.seal_share.expire_default;
+var HANDOFF_OUTPUT = seal_mcp_v1_default.tools.seal_share.output_handoff;
 var TIER_BYTES2 = limits_default2.limits.TIER_BYTES;
 var PAYMENT_RECEIPT = "The file is larger than 1 GB. Show the user the payment link; the upload continues after payment. Then call seal_share with `payment` set to this handle.";
 function defaultExpire(mode, size) {
@@ -13763,7 +13766,7 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
   appendAudit(ctx, "seal_share", handle, mode);
   delete ctx.state.pending[handle];
   await ctx.persist();
-  const delivered = handoff.channel === "clipboard" ? "The seal link is on your clipboard. Paste it to the recipient." : `The seal link is in ${handoff.file} (mode 0600, removed automatically later). Give it to the recipient.`;
+  const delivered = handoff.channel === "clipboard" ? HANDOFF_OUTPUT.receipt_clipboard : HANDOFF_OUTPUT.receipt_file.replace("{file}", handoff.file ?? "");
   const verified = uploaded.verification === "verified" ? delivered : `${delivered} The server has not finished verifying the file: for the next few seconds the recipient sees "not ready", after which the link works.`;
   const receipt = ctx.ephemeral ? `${verified} This server keeps no state on disk: the handle lives until it restarts; the seal's expiry does not depend on it.` : verified;
   return {
@@ -13965,7 +13968,7 @@ function proFileGetOutputToWire(out) {
 }
 
 // src/server.ts
-var SERVER_VERSION = "0.2.4";
+var SERVER_VERSION = "0.2.5";
 var toolMeta = (name) => {
   const { title, description, annotations } = seal_mcp_v1_default.tools[name];
   return { title, description, annotations };

package/dist/cli.js

@@ -11343,13 +11343,13 @@ var seal_mcp_v1_default = {
     progress: "When a `tools/call` carries `_meta.progressToken`, `seal_share` and `seal_open mode=file` send `notifications/progress` with `progress` = ciphertext bytes done (upload: confirmed by storage) and `total` = ciphertext bytes in all; at most one per second, `progress` strictly increasing, the last one at `progress = total`."
   },
   server_instructions: {
-    text: "SEAL moves files and secrets between people and agents without their content entering this conversation. When someone wants a file, folder or secret sent to them, to another machine or to another agent, call seal_share with its path and do not open, print or Read it first. When you need an API key, password, file or folder from the user, or they offer or ask how to give you one, call seal_request right away instead of explaining other ways or asking them to paste or upload it. Open a SEAL link someone gave you with seal_open (mode=file for secrets and large files).",
+    text: "SEAL moves files and secrets between people and agents without their content entering this conversation. When someone wants a file, folder or secret sent to them, to another machine or to another agent, call seal_share with its path and do not open, print or Read it first. When you need an API key, password, file or folder from the user, or they offer or ask how to give you one, call seal_request right away instead of explaining other ways or asking them to paste or upload it. Open a SEAL link someone gave you with seal_open (mode=file for secrets and large files). Never read or print a SEAL handoff file.",
     note: "The `instructions` of the `initialize` result (SPEC-AGENTS \xA78.1). Hosts that defer MCP tools behind a tool search (Claude Code) show the model only tool names until it searches, but put these instructions into the system prompt: this is the one text a model reads before it decides to look for a tool, or reads the file it was asked to send."
   },
   tools: {
     seal_share: {
       title: "Share a file via SEAL",
-      description: "Give the user or another agent a file or a secret WITHOUT it passing through this chat. Works for any size (folders, dumps, exports, builds, videos \u2014 up to 1 GB free, more after one card payment by the user). Default mode `handoff`: the link goes to the user's clipboard or a 0600 file and you get only a handle. Mode `forward`: a link only the holder of the given X25519 key can open \u2014 use it for another agent. Never paste secrets or huge content into the chat instead.",
+      description: "Give the user or another agent a file or a secret WITHOUT it passing through this chat. Works for large files (folders, dumps, exports, builds, videos \u2014 up to 1 GB free, more after one card payment by the user). Default mode `handoff`: the link goes to the user's clipboard and you get a handle. Where there is no clipboard it goes to a 0600 file and you get its path: do not read that file and do not print it. Mode `forward`: a link only the holder of the given X25519 key can open \u2014 use it for another agent. Never paste secrets or huge content into the chat instead.",
       annotations: { destructiveHint: false, openWorldHint: true },
       input: {
         properties: {
@@ -11399,7 +11399,9 @@ var seal_mcp_v1_default = {
           expires_at: { type: "string", format: "date-time", description: "ISO 8601 UTC expiry timestamp." }
         },
         MUST_NOT_contain: ["share_url", "url", "password", "passphrase", "link_key", "owner_token"],
-        rationale: "Anything in this object reaches the model. Any field that lets the model reconstruct or re-issue the share capability defeats handoff mode."
+        rationale: "Anything in this object reaches the model. Any field that lets the model reconstruct or re-issue the share capability defeats handoff mode.",
+        receipt_clipboard: "The seal link is on your clipboard. Paste it to the recipient.",
+        receipt_file: "The seal link is in {file} (mode 0600, removed automatically later). Give it to the recipient. Anyone who can read files on this machine as this user, this agent included, can read it. In a cloud or container session prefer mode=forward to the recipient\u2019s key."
       },
       output_forward: {
         type: "object",
@@ -13335,6 +13337,7 @@ function guessMimeFromName(name) {
 }
 var VALID_TTL = ["5m", "30m", "1h", "1d", "7d"];
 var EXPIRE_DEFAULT = seal_mcp_v1_default.tools.seal_share.expire_default;
+var HANDOFF_OUTPUT = seal_mcp_v1_default.tools.seal_share.output_handoff;
 var TIER_BYTES2 = limits_default2.limits.TIER_BYTES;
 var PAYMENT_RECEIPT = "The file is larger than 1 GB. Show the user the payment link; the upload continues after payment. Then call seal_share with `payment` set to this handle.";
 function defaultExpire(mode, size) {
@@ -13735,7 +13738,7 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
   appendAudit(ctx, "seal_share", handle, mode);
   delete ctx.state.pending[handle];
   await ctx.persist();
-  const delivered = handoff.channel === "clipboard" ? "The seal link is on your clipboard. Paste it to the recipient." : `The seal link is in ${handoff.file} (mode 0600, removed automatically later). Give it to the recipient.`;
+  const delivered = handoff.channel === "clipboard" ? HANDOFF_OUTPUT.receipt_clipboard : HANDOFF_OUTPUT.receipt_file.replace("{file}", handoff.file ?? "");
   const verified = uploaded.verification === "verified" ? delivered : `${delivered} The server has not finished verifying the file: for the next few seconds the recipient sees "not ready", after which the link works.`;
   const receipt = ctx.ephemeral ? `${verified} This server keeps no state on disk: the handle lives until it restarts; the seal's expiry does not depend on it.` : verified;
   return {
@@ -13937,7 +13940,7 @@ function proFileGetOutputToWire(out) {
 }
 
 // src/server.ts
-var SERVER_VERSION = "0.2.4";
+var SERVER_VERSION = "0.2.5";
 var toolMeta = (name) => {
   const { title, description, annotations } = seal_mcp_v1_default.tools[name];
   return { title, description, annotations };

package/dist/index.cjs

@@ -4138,13 +4138,13 @@ var seal_mcp_v1_default = {
     progress: "When a `tools/call` carries `_meta.progressToken`, `seal_share` and `seal_open mode=file` send `notifications/progress` with `progress` = ciphertext bytes done (upload: confirmed by storage) and `total` = ciphertext bytes in all; at most one per second, `progress` strictly increasing, the last one at `progress = total`."
   },
   server_instructions: {
-    text: "SEAL moves files and secrets between people and agents without their content entering this conversation. When someone wants a file, folder or secret sent to them, to another machine or to another agent, call seal_share with its path and do not open, print or Read it first. When you need an API key, password, file or folder from the user, or they offer or ask how to give you one, call seal_request right away instead of explaining other ways or asking them to paste or upload it. Open a SEAL link someone gave you with seal_open (mode=file for secrets and large files).",
+    text: "SEAL moves files and secrets between people and agents without their content entering this conversation. When someone wants a file, folder or secret sent to them, to another machine or to another agent, call seal_share with its path and do not open, print or Read it first. When you need an API key, password, file or folder from the user, or they offer or ask how to give you one, call seal_request right away instead of explaining other ways or asking them to paste or upload it. Open a SEAL link someone gave you with seal_open (mode=file for secrets and large files). Never read or print a SEAL handoff file.",
     note: "The `instructions` of the `initialize` result (SPEC-AGENTS \xA78.1). Hosts that defer MCP tools behind a tool search (Claude Code) show the model only tool names until it searches, but put these instructions into the system prompt: this is the one text a model reads before it decides to look for a tool, or reads the file it was asked to send."
   },
   tools: {
     seal_share: {
       title: "Share a file via SEAL",
-      description: "Give the user or another agent a file or a secret WITHOUT it passing through this chat. Works for any size (folders, dumps, exports, builds, videos \u2014 up to 1 GB free, more after one card payment by the user). Default mode `handoff`: the link goes to the user's clipboard or a 0600 file and you get only a handle. Mode `forward`: a link only the holder of the given X25519 key can open \u2014 use it for another agent. Never paste secrets or huge content into the chat instead.",
+      description: "Give the user or another agent a file or a secret WITHOUT it passing through this chat. Works for large files (folders, dumps, exports, builds, videos \u2014 up to 1 GB free, more after one card payment by the user). Default mode `handoff`: the link goes to the user's clipboard and you get a handle. Where there is no clipboard it goes to a 0600 file and you get its path: do not read that file and do not print it. Mode `forward`: a link only the holder of the given X25519 key can open \u2014 use it for another agent. Never paste secrets or huge content into the chat instead.",
       annotations: { destructiveHint: false, openWorldHint: true },
       input: {
         properties: {
@@ -4194,7 +4194,9 @@ var seal_mcp_v1_default = {
           expires_at: { type: "string", format: "date-time", description: "ISO 8601 UTC expiry timestamp." }
         },
         MUST_NOT_contain: ["share_url", "url", "password", "passphrase", "link_key", "owner_token"],
-        rationale: "Anything in this object reaches the model. Any field that lets the model reconstruct or re-issue the share capability defeats handoff mode."
+        rationale: "Anything in this object reaches the model. Any field that lets the model reconstruct or re-issue the share capability defeats handoff mode.",
+        receipt_clipboard: "The seal link is on your clipboard. Paste it to the recipient.",
+        receipt_file: "The seal link is in {file} (mode 0600, removed automatically later). Give it to the recipient. Anyone who can read files on this machine as this user, this agent included, can read it. In a cloud or container session prefer mode=forward to the recipient\u2019s key."
       },
       output_forward: {
         type: "object",
@@ -13190,6 +13192,7 @@ function guessMimeFromName(name) {
 }
 var VALID_TTL = ["5m", "30m", "1h", "1d", "7d"];
 var EXPIRE_DEFAULT = seal_mcp_v1_default.tools.seal_share.expire_default;
+var HANDOFF_OUTPUT = seal_mcp_v1_default.tools.seal_share.output_handoff;
 var TIER_BYTES2 = limits_default2.limits.TIER_BYTES;
 var PAYMENT_RECEIPT = "The file is larger than 1 GB. Show the user the payment link; the upload continues after payment. Then call seal_share with `payment` set to this handle.";
 function defaultExpire(mode, size) {
@@ -13590,7 +13593,7 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
   appendAudit(ctx, "seal_share", handle, mode);
   delete ctx.state.pending[handle];
   await ctx.persist();
-  const delivered = handoff.channel === "clipboard" ? "The seal link is on your clipboard. Paste it to the recipient." : `The seal link is in ${handoff.file} (mode 0600, removed automatically later). Give it to the recipient.`;
+  const delivered = handoff.channel === "clipboard" ? HANDOFF_OUTPUT.receipt_clipboard : HANDOFF_OUTPUT.receipt_file.replace("{file}", handoff.file ?? "");
   const verified = uploaded.verification === "verified" ? delivered : `${delivered} The server has not finished verifying the file: for the next few seconds the recipient sees "not ready", after which the link works.`;
   const receipt = ctx.ephemeral ? `${verified} This server keeps no state on disk: the handle lives until it restarts; the seal's expiry does not depend on it.` : verified;
   return {
@@ -13792,7 +13795,7 @@ function proFileGetOutputToWire(out) {
 }
 
 // src/server.ts
-var SERVER_VERSION = "0.2.4";
+var SERVER_VERSION = "0.2.5";
 var toolMeta = (name) => {
   const { title, description, annotations } = seal_mcp_v1_default.tools[name];
   return { title, description, annotations };