sealnet-mcp 0.3.0 → 0.4.0

package/README.md

@@ -9,7 +9,7 @@ Model Context Protocol (MCP) server for **SEAL**.
 When an MCP-connected AI agent (Claude Desktop, Cursor, Cline, etc.) creates a SEAL via this server:
 
 - **handoff mode (default)**: the share link (the key is in its fragment, there is no password) is delivered to the human user via **system clipboard** (primary) or **0o600 local file** (fallback when clipboard is unavailable — headless, SSH, WSL without display). The `tool_result` returned to the model contains **only** an opaque handle and a human-readable receipt. The link is never written into the conversation; on the file channel the receipt names the file, and an agent that can read files on that machine can read it.
-- **forward mode (explicit opt-in)**: model receives `{ handle, share_url, expires_at, max_reads, mode }` in `tool_result`; the link opens only with the recipient's X25519 key. Requires short TTL (≤30m), `max_reads=1`, mandatory `to` (recipient pubkey). Every forward is audit-logged in the encrypted state file.
+- **forward mode (explicit opt-in)**: model receives `{ handle, share_url, expires_at, max_reads, mode, delivered }` in `tool_result`; the link opens only with the recipient's X25519 key and also lands in the recipient's inbox (`seal_inbox`). Requires short TTL (≤30m), `max_reads=1`, mandatory `to` (recipient address). Every forward is audit-logged in the encrypted state file.
 
 ## Tool surface
 
@@ -17,7 +17,8 @@ When an MCP-connected AI agent (Claude Desktop, Cursor, Cline, etc.) creates a S
 |------|---------|
 | `seal_share(path, mode='handoff'\|'forward', expire?, max_reads?, tier?)` / `seal_share(payment)` | Create a SEAL from a local file or folder (sent as one ZIP), streamed from disk. Default: handoff; without `expire`, 5m, or 1d for a handoff over 100 MB. Over 1 GB the user pays once by card (smallest tier that fits, or `tier`): the payment page goes through URL-mode elicitation, or comes back as `payment_url` and a second call with `payment` finishes the upload into the same seal |
 | `seal_request(what, kind='any'\|'secret'\|'file', where_url?, wait=true)` / `seal_request(request)` | Ask the user for a file or a secret without it passing through the chat. On the user's computer the `seal` CLI draws the system dialog (`seal request --local --json`); otherwise the user answers at `seal.net/i/<id>`, sealed to this server's key, shown with three emoji of that key. Returns the path of a 0600 file, never the value |
-| `seal_open(url, mode='metadata'\|'file'\|'inline', dir?)` | Read metadata (default — no download, no counter consumption), save to disk (`file`: streamed, verified before it gets its name, 0600, returns paths) or inline parse (whitelisted MIMEs only, ≤100 KB, refuses secrets, HTML and binary) |
+| `seal_open(url\|item, mode='metadata'\|'file'\|'inline', dir?)` | Read metadata (default — no download, no counter consumption), save to disk (`file`: streamed, verified before it gets its name, 0600, returns paths) or inline parse (whitelisted MIMEs only, ≤100 KB, refuses secrets, HTML and binary). `item` is an inbox handle instead of a link |
+| `seal_inbox(wait?)` | Seals other agents or people sent to this server's key (its address): handles, the sender's three emoji and name, never a link. `seal_share mode=forward to=<address>` puts a link there; `wait` (0 to 300 s) waits for something new |
 | `seal_list()` | List SEALs created by **this MCP server only** (scope: `state.json`; never reveals user's CLI seals) |
 | `seal_revoke(handle)` | Revoke by opaque handle (model never learns raw `seal_id`) |
 

package/dist/cli.cjs

@@ -2890,9 +2890,60 @@ var limits_default = {
     INTAKE_TTL_DEFAULT_SECONDS: 900,
     INTAKE_TTL_MAX_SECONDS: 86400,
     INTAKE_WAIT_MAX_SECONDS: 25,
-    PAYMENT_WAIT_MAX_SECONDS: 82800
+    PAYMENT_WAIT_MAX_SECONDS: 82800,
+    ADDRESS_PROOF_TTL_SECONDS: 300,
+    INBOX_MAX_ITEMS: 200
   }
 };
+var seal_address_v1_default = {
+  version: 1,
+  $comment: "Address of a key: who a seal is for, without a URL (audit/SPEC-ADDRESS.md). Numbers live in limits.json, error codes in error_codes.json.",
+  address: {
+    key: "X25519 public key, 32 bytes",
+    text: "base64url without padding, 43 characters",
+    emoji: "fingerprint_emoji.json over sha256(key)[0..3], the same picture as intake",
+    inbox_hash: "sha256(key), 32 bytes: the server finds an inbox by it"
+  },
+  seed: {
+    env: "SEAL_SEED",
+    text: "base64url without padding of the 32-byte X25519 secret, 43 characters",
+    same_as: [
+      "sealnet-mcp state.identity.x25519_secret_b64",
+      "seal identity.v1.json x25519_secret_b64url",
+      "sealnet (npm) KeyPair.secretKey",
+      "sealnet (PyPI) keygen().secret_key"
+    ]
+  },
+  scopes: {
+    share_link: "seal_share",
+    owner_copy: "seal_owner",
+    address_proof: "seal_address_proof"
+  },
+  proof: {
+    header_address: "X-Seal-Address",
+    header_proof: "X-Seal-Proof",
+    proof_text: "<ts>.<token>: ts is the decimal Unix second from the challenge, token base64url of 32 bytes",
+    challenge: "sealed box of the 32-byte token to the address with scope (address_proof, decimal ts): ephemeral_pub(32) || nonce(12) || ciphertext(48), base64url, 123 characters",
+    token: "opaque to clients: unwrap it and send it back"
+  },
+  items: {
+    delivery: {
+      id: "s.<seal_id>.<share_code>",
+      is: "a share link addressed to this key; fragment = its key wrapped to the address (x25519:, targeted_x25519_v1, scope share_link)"
+    }
+  },
+  request_kinds: ["secret", "file", "any"],
+  vectors: [
+    {
+      comment: "generated once by backend_crypto.sealed_box.seal_key_for_recipient; every client must unwrap it",
+      secret: "BwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwc",
+      address: "E75P6uryBMf9M1j8nAByGIHRdCeBKCJ-xnTzf3_pe20",
+      ts: 179e7,
+      challenge: "4Oel-UMfgP_1dBhmf13yZiujhPDouCIQ6sSx1nY1qy-vyzFqDqb9jARbJ0e5A8vv4EDELDS5OPqBQMcsmDA-C_lXO95y_CVUyYtSu-1fltsy5ZihOFDp0T-C9Ro",
+      token: "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8"
+    }
+  ]
+};
 var upload_default = {
   version: 1,
   upload: {
@@ -3224,13 +3275,24 @@ var SealApi = class _SealApi {
     });
     return { etag: resp.headers.get("ETag") };
   }
-  /** `POST /seal/{id}/share` — mint a share link, returns its code. */
+  /**
+   * `POST /seal/{id}/share` — mint a share link, returns its code. With an
+   * address the link also lands in that key's inbox, in the same request.
+   */
   async createShareLink(sealId, ownerToken, encryptedBlobB64, opts = {}) {
+    const headers = _SealApi.ownerHeaders(ownerToken, true);
+    const body = { encrypted_blob: encryptedBlobB64 };
+    if ("to" in opts) {
+      body.to = opts.to;
+      body.fragment = opts.fragment;
+      if (opts.label) body.label = opts.label;
+      if (opts.sender) Object.assign(headers, proofHeaders(opts.sender));
+    }
     const resp = await this.request(`/seal/${encode(sealId)}/share`, {
       what: `POST /seal/${sealId}/share`,
       method: "POST",
-      headers: _SealApi.ownerHeaders(ownerToken, true),
-      body: JSON.stringify({ encrypted_blob: encryptedBlobB64 }),
+      headers,
+      body: JSON.stringify(body),
       signal: opts.signal
     });
     const data = await resp.json();
@@ -3413,8 +3475,57 @@ var SealApi = class _SealApi {
     });
     return await resp.json();
   }
+  // ---------------------------------------------------------------------------
+  // Inbox (SPEC-ADDRESS F2): the share links addressed to a key
+  // ---------------------------------------------------------------------------
+  /** `POST /intake/proof` — a challenge sealed to `address`. */
+  async requestAddressProof(address, opts = {}) {
+    const resp = await this.request("/intake/proof", {
+      what: "POST /intake/proof",
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ address }),
+      signal: opts.signal
+    });
+    return await resp.json();
+  }
+  /**
+   * `GET /intake?to=` — every live item. `waitSeconds` holds the answer
+   * while the inbox is empty, or, with `seen`, while its version is still
+   * `seen`; one call waits at most `INTAKE_WAIT_MAX_SECONDS`, longer waits
+   * are the caller's loop.
+   */
+  async listInbox(proof, opts = {}) {
+    const params = new URLSearchParams({ to: proof.address });
+    if (opts.waitSeconds) {
+      params.set("wait", String(Math.min(opts.waitSeconds, limits_default.limits.INTAKE_WAIT_MAX_SECONDS)));
+    }
+    if (opts.seen) params.set("seen", opts.seen);
+    const resp = await this.request(`/intake?${params.toString()}`, {
+      what: "GET /intake",
+      headers: proofHeaders(proof),
+      signal: opts.signal
+    });
+    return await resp.json();
+  }
+  /** `DELETE /intake?to=&item=` — take one item out; the link keeps working. */
+  async dismissInboxItem(itemId, proof, opts = {}) {
+    const params = new URLSearchParams({ to: proof.address, item: itemId });
+    await this.request(`/intake?${params.toString()}`, {
+      what: "DELETE /intake",
+      method: "DELETE",
+      headers: proofHeaders(proof),
+      signal: opts.signal
+    });
+  }
 };
 var NOT_READY_DEFAULT_RETRY_AFTER_S = 3;
+function proofHeaders(proof) {
+  return {
+    [seal_address_v1_default.proof.header_address]: proof.address,
+    [seal_address_v1_default.proof.header_proof]: proof.proof
+  };
+}
 function abortableSleep(ms, signal) {
   return new Promise((resolve5, reject) => {
     if (signal?.aborted) {
@@ -6179,6 +6290,7 @@ function parseUrlType(pathname) {
 var TARGETED_PREFIX_V1 = "x25519:";
 var TARGETED_PREFIX_V2_RESERVED = "x25519v2:";
 var SCOPE_TYPE = "seal_share";
+var ADDRESS_PROOF_SCOPE = "seal_address_proof";
 var X25519_KEY_BYTES = 32;
 var LINK_KEY_BYTES2 = 32;
 var PACKED_BYTES_V1 = 92;
@@ -6285,6 +6397,11 @@ async function unwrapTargetedFragment(fragment, recipientSecret, sealId) {
   }
   return linkKey;
 }
+async function proveAddress(secret, challenge, ts) {
+  const wasm3 = await ensureWasm();
+  const token = wasm3.wasm_sealbox_unwrap(base64urlToBytes(challenge), secret, ADDRESS_PROOF_SCOPE, String(ts));
+  return `${ts}.${bytesToBase64url(token)}`;
+}
 var fingerprint_emoji_default = {
   version: 1,
   name: "FINGERPRINT_EMOJI",
@@ -6744,6 +6861,36 @@ async function waitForIntake(api, intakeId, opts = {}) {
     if (view.status === "fulfilled" && view.share_path) return view.share_path;
   }
 }
+var PROOF_MARGIN_MS = 3e4;
+var proofs = /* @__PURE__ */ new Map();
+async function addressProof(api, secret, opts = {}) {
+  const address = bytesToBase64url(await recipientPublicKey(secret));
+  const key = `${api.baseUrl} ${address}`;
+  const kept = proofs.get(key);
+  if (!opts.fresh && kept && kept.until > Date.now()) return kept.proof;
+  const challenge = await api.requestAddressProof(address, opts);
+  const proof = { address, proof: await proveAddress(secret, challenge.challenge, challenge.ts) };
+  proofs.set(key, { proof, until: Date.parse(challenge.expires_at) - PROOF_MARGIN_MS });
+  return proof;
+}
+async function withAddressProof(api, secret, signal, call) {
+  const request = signal ? { signal } : {};
+  try {
+    return await call(await addressProof(api, secret, request));
+  } catch (err2) {
+    if (!(err2 instanceof BackendError && err2.appCode === "intake.proof_required")) throw err2;
+    return call(await addressProof(api, secret, { ...request, fresh: true }));
+  }
+}
+async function readInbox(api, secret, opts = {}) {
+  return withAddressProof(api, secret, opts.signal, (proof) => api.listInbox(proof, opts));
+}
+async function removeFromInbox(api, secret, itemId, opts = {}) {
+  return withAddressProof(api, secret, opts.signal, (proof) => api.dismissInboxItem(itemId, proof, opts));
+}
+function inboxItemUrl(site, item) {
+  return `${site.replace(/\/+$/, "")}${item.path}#${item.fragment}`;
+}
 async function describeFile(file, fileKeys) {
   const keyB64 = file.sha256_hex ? fileKeys[file.sha256_hex] : void 0;
   const base = { id: file.id, size: file.size, sha256Hex: file.sha256_hex };
@@ -11664,7 +11811,7 @@ var seal_mcp_v1_default = {
     progress: "When a `tools/call` carries `_meta.progressToken`, `seal_share` and `seal_open mode=file` send `notifications/progress` with `progress` = ciphertext bytes done (upload: confirmed by storage) and `total` = ciphertext bytes in all; at most one per second, `progress` strictly increasing, the last one at `progress = total`."
   },
   server_instructions: {
-    text: "SEAL moves files and secrets between people and agents without their content entering this conversation. When someone wants a file, folder or secret sent to them, to another machine or to another agent, call seal_share with its path and do not open, print or Read it first. When you need an API key, password, file or folder from the user, or they offer or ask how to give you one, call seal_request right away instead of explaining other ways or asking them to paste or upload it. Open a SEAL link someone gave you with seal_open (mode=file for secrets and large files). Never read or print a SEAL handoff file.",
+    text: "SEAL moves files and secrets between people and agents without their content entering this conversation. When someone wants a file, folder or secret sent to them, to another machine or to another agent, call seal_share with its path and do not open, print or Read it first. When you need an API key, password, file or folder from the user, or they offer or ask how to give you one, call seal_request right away instead of explaining other ways or asking them to paste or upload it. Open a SEAL link someone gave you with seal_open (mode=file for secrets and large files). Files sent to your key arrive in seal_inbox; open them with seal_open item. Never read or print a SEAL handoff file.",
     note: "The `instructions` of the `initialize` result (SPEC-AGENTS \xA78.1). Hosts that defer MCP tools behind a tool search (Claude Code) show the model only tool names until it searches, but put these instructions into the system prompt: this is the one text a model reads before it decides to look for a tool, or reads the file it was asked to send."
   },
   tools: {
@@ -11732,7 +11879,8 @@ var seal_mcp_v1_default = {
           share_url: { type: "string", format: "uri", description: "`targeted_x25519_v1` link: the wrapped key is in the fragment, useless without the recipient's X25519 secret; there is no separate password." },
           expires_at: { type: "string", format: "date-time" },
           max_reads: { type: "integer", const: 1 },
-          mode: { type: "string", const: "forward" }
+          mode: { type: "string", const: "forward" },
+          delivered: { type: "boolean", description: "The link also lies in the recipient's inbox (SPEC-ADDRESS F2): the server keeps its wrapped key in the link's row, and the holder of the key finds it with seal_inbox without being handed the URL." }
         },
         policy: {
           max_expire_minutes: 30,
@@ -11800,9 +11948,11 @@ var seal_mcp_v1_default = {
       annotations: { readOnlyHint: false, destructiveHint: false },
       annotations_note: "Set on the tool, not per mode: `inline` and `file` consume an open, so the tool as a whole is not read-only.",
       input: {
-        required: ["url"],
+        one_of: ["url", "item"],
+        one_of_note: "Exactly one of `url` and `item`; `server.ts` takes both as optional and the handler refuses anything else with `url_invalid`.",
         properties: {
           url: { type: "string", format: "uri", description: "Full SEAL share URL including fragment." },
+          item: { type: "string", pattern: "^in_", description: "An inbox handle from seal_inbox (`in_\u2026`), instead of a URL." },
           mode: { type: "string", enum: ["metadata", "inline", "file"], default: "metadata", description: "`metadata` reads nothing; `file` saves to disk; `inline` returns small text." },
           dir: { type: "string", description: "mode=file: directory to save into; default ~/Downloads, created if missing. An existing file is never overwritten: the new one becomes `name (1).ext`." }
         }
@@ -11859,6 +12009,40 @@ var seal_mcp_v1_default = {
         _binary_default: "inline_blocked.binary"
       }
     },
+    seal_inbox: {
+      title: "Check the inbox",
+      description: "Seals other agents or people sent to your key (your address). Returns handles; open one with seal_open item=<handle>. `wait`: seconds to wait for something new, 0 to 300.",
+      annotations: { readOnlyHint: true, openWorldHint: true },
+      input: {
+        properties: {
+          wait: { type: "integer", minimum: 0, maximum: 300, default: 0, description: "Seconds to wait for an item this server has not seen yet; 0 returns the inbox now." }
+        }
+      },
+      flow: "`GET /intake?to=<this server's address>` under the proof of the key (seal_address.v1.json proof), cached until 30 s before it expires. The first call in a process returns the list at once; later ones long-poll by 25 s with `seen` = the version of the last answer until an id this process has not seen arrives or `wait` runs out. Handles, rows and the version live in process memory.",
+      output: {
+        type: "object",
+        required: ["address_emoji", "items"],
+        properties: {
+          address_emoji: { type: "string", description: "Three emoji of this server's address (`fingerprint_emoji.json`)." },
+          items: {
+            type: "array",
+            items: {
+              type: "object",
+              required: ["handle", "from", "label", "received_at", "expires_at"],
+              additionalProperties: false,
+              properties: {
+                handle: { type: "string", pattern: "^in_", description: "`in_` + the inbox item id; pass as seal_open `item`." },
+                from: { type: ["string", "null"], description: "Three emoji of the sender's address when the server verified it, else null." },
+                label: { type: ["string", "null"], description: "What the sender called itself (an agent's name, `sealnet`), in the clear: never content." },
+                received_at: { type: "string", format: "date-time" },
+                expires_at: { type: "string", format: "date-time" }
+              }
+            }
+          }
+        },
+        MUST_NOT_contain: ["path", "fragment", "url", "seal_id", "share_code"]
+      }
+    },
     seal_list: {
       title: "List SEALs created via THIS MCP server",
       description: "Seals you created through this server: opaque handles with status and expiry. Seals made with the CLI or the desktop client live elsewhere and are not listed.",
@@ -12182,6 +12366,10 @@ var seal_mcp_v1_default = {
     share_blob_corrupt: "Share blob decoded but a file_key is not valid base64url or has the wrong length (32 bytes expected). Backend bug or share-blob tampering.",
     share_blob_failed: "`encryptShareBlob` threw during seal_share mint (Web Crypto failure or input shape bug). Caller-facing in seal_share path only.",
     share_link_failed: "POST /seal/{id}/share returned an error (network, 5xx, owner_token mismatch).",
+    inbox_proof_failed: "seal_inbox / seal_open item / seal_share forward: the server refused the proof of this server's key (`intake.proof_required`) even after one fresh challenge.",
+    inbox_full: "seal_share forward: the recipient's inbox holds `limits.json::INBOX_MAX_ITEMS` live items from other senders (`intake.inbox_full`). The seal is revoked; retry later.",
+    inbox_item_gone: "seal_open item: the handle is not in this process's inbox and not in a fresh read of it \u2014 the seal or link was revoked or expired, or the item was removed.",
+    inbox_failed: "seal_inbox / seal_open item: reading or cleaning the inbox failed for a reason other than the proof (network, 5xx, rate limit); the message has the status. Safe to retry.",
     targeted_fragment_invalid: "seal_open of `x25519:` URL: fragment is malformed base64url, wrong packed length, or AEAD-failed for a non-secret reason. Distinct from `targeted_decrypt_failed` which is the wrong-recipient case.",
     targeted_decrypt_failed: "seal_open of `x25519:` URL: AEAD verification failed under THIS device's identity. The URL was not addressed to this MCP's pubkey (or was tampered, or seal_id from path-segment was substituted). Recipient should ask the sender to re-mint with `--to <our pubkey>`.",
     auth_required: "Backend returned 401/403 because the seal has OTP / NDA / login gating; interactive auth is not supported in MCP. Open the URL in a browser.",
@@ -12791,6 +12979,72 @@ var ToolError = class extends Error {
   }
 };
 
+// src/tools/inbox.ts
+var HANDLE_PREFIX2 = "in_";
+function inboxError(err2) {
+  if (!(err2 instanceof BackendError)) return err2;
+  if (err2.appCode === "intake.proof_required") {
+    return new ToolError("inbox_proof_failed", `the server refused the proof of this server's key: ${err2.message}`, err2);
+  }
+  return new ToolError("inbox_failed", `the inbox failed (${err2.status}): ${err2.message}`, err2);
+}
+function memoryOf(ctx) {
+  if (!ctx.inbox) throw new ToolError("internal_inconsistency", "this server keeps no inbox memory");
+  return ctx.inbox;
+}
+async function sealInbox(ctx, input = {}) {
+  const memory = memoryOf(ctx);
+  const deadline = Date.now() + (memory.version === null ? 0 : (input.wait ?? 0) * 1e3);
+  let seen = memory.version ?? void 0;
+  let inbox;
+  for (; ; ) {
+    const left = Math.ceil((deadline - Date.now()) / 1e3);
+    try {
+      inbox = await readInbox(ctx.client, ctx.identity.secret, left > 0 ? { waitSeconds: left, seen } : {});
+    } catch (err2) {
+      throw inboxError(err2);
+    }
+    const arrived = inbox.items.some((item) => !memory.items.has(HANDLE_PREFIX2 + item.id));
+    if (left <= 0 || arrived || Date.now() >= deadline) break;
+    seen = inbox.version;
+  }
+  memory.items.clear();
+  for (const item of inbox.items) memory.items.set(HANDLE_PREFIX2 + item.id, item);
+  memory.version = inbox.version;
+  return {
+    addressEmoji: keyEmoji(ctx.identity.public),
+    items: inbox.items.map((item) => ({
+      handle: HANDLE_PREFIX2 + item.id,
+      from: item.sender === null ? null : keyEmoji(base64urlToBytes(item.sender)),
+      label: item.label,
+      receivedAt: item.at,
+      expiresAt: item.expires_at
+    }))
+  };
+}
+async function inboxItem(ctx, handle) {
+  const memory = memoryOf(ctx);
+  if (!memory.items.has(handle)) await sealInbox(ctx, {});
+  const item = memory.items.get(handle);
+  if (!item) {
+    throw new ToolError(
+      "inbox_item_gone",
+      `${handle} is not in the inbox: the seal or link was revoked or expired, or the item was removed`
+    );
+  }
+  return item;
+}
+async function forgetInboxItem(ctx, handle) {
+  const item = memoryOf(ctx).items.get(handle);
+  if (!item) return;
+  try {
+    await removeFromInbox(ctx.client, ctx.identity.secret, item.id);
+  } catch (err2) {
+    throw inboxError(err2);
+  }
+  memoryOf(ctx).items.delete(handle);
+}
+
 // src/tools/list.ts
 var SINGLE_FILE_COUNT = 1;
 async function sealList(ctx, input = {}) {
@@ -12882,11 +13136,28 @@ async function download(ctx, sealId, file) {
   return resp.body;
 }
 async function sealOpen(ctx, input) {
+  if (input.url === void 0 === (input.item === void 0)) {
+    throw new ToolError("url_invalid", "give exactly one of `url` (a SEAL link) and `item` (an inbox handle from seal_inbox)");
+  }
+  const recipient = { recipientSecret: ctx.identity.secret };
+  if (input.url !== void 0) return openSeal(ctx, input, () => openShareLink(ctx.client, input.url, recipient));
+  const handle = input.item;
+  const item = await inboxItem(ctx, handle);
+  try {
+    return await openSeal(ctx, input, () => openShareLink(ctx.client, inboxItemUrl(resolvePublicHost(), item), recipient));
+  } catch (err2) {
+    if (err2 instanceof ToolError && (err2.code === "seal_revoked" || err2.code === "share_link_revoked")) {
+      await forgetInboxItem(ctx, handle).catch(() => void 0);
+    }
+    throw err2;
+  }
+}
+async function openSeal(ctx, input, read) {
   const mode = input.mode ?? "metadata";
   const handle = generateHandle();
   let seal;
   try {
-    seal = await openShareLink(ctx.client, input.url, { recipientSecret: ctx.identity.secret });
+    seal = await read();
   } catch (err2) {
     throw asToolError(err2);
   }
@@ -13234,7 +13505,9 @@ var limits_default2 = {
     INTAKE_TTL_DEFAULT_SECONDS: 900,
     INTAKE_TTL_MAX_SECONDS: 86400,
     INTAKE_WAIT_MAX_SECONDS: 25,
-    PAYMENT_WAIT_MAX_SECONDS: 82800
+    PAYMENT_WAIT_MAX_SECONDS: 82800,
+    ADDRESS_PROOF_TTL_SECONDS: 300,
+    INBOX_MAX_ITEMS: 200
   }
 };
 
@@ -13752,17 +14025,6 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
     );
   }
   const shareBlobB64 = bytesToBase64url(shareBlobBytes);
-  let shareCode;
-  try {
-    shareCode = await ctx.client.createShareLink(uploaded.sealId, ownerTokenB64, shareBlobB64);
-  } catch (err2) {
-    const outcome = await compensateRevoke(ctx, handle, op);
-    throw new ToolError(
-      "share_link_failed",
-      `POST /seal/${uploaded.sealId}/share failed: ${err2 instanceof Error ? err2.message : String(err2)} (${outcome})`,
-      err2
-    );
-  }
   let fragment;
   if (mode === "forward") {
     if (recipientPub === null) {
@@ -13792,6 +14054,29 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
   } else {
     fragment = bytesToBase64url(shareLinkKey);
   }
+  if (mode === "forward") await journalDelivering(ctx, handle, op);
+  let shareCode;
+  try {
+    shareCode = mode === "forward" && recipientPub !== null ? await withAddressProof(
+      ctx.client,
+      ctx.identity.secret,
+      void 0,
+      (sender) => ctx.client.createShareLink(uploaded.sealId, ownerTokenB64, shareBlobB64, {
+        to: bytesToBase64url(recipientPub),
+        fragment,
+        label: deps.label?.slice(0, 80),
+        sender
+      })
+    ) : await ctx.client.createShareLink(uploaded.sealId, ownerTokenB64, shareBlobB64);
+  } catch (err2) {
+    const outcome = await compensateRevoke(ctx, handle, op);
+    const appCode = err2 instanceof BackendError ? err2.appCode : void 0;
+    throw new ToolError(
+      appCode === "intake.inbox_full" ? "inbox_full" : appCode === "intake.proof_required" ? "inbox_proof_failed" : "share_link_failed",
+      `POST /seal/${uploaded.sealId}/share failed: ${messageOf3(err2)} (${outcome})`,
+      err2
+    );
+  }
   const host = resolvePublicHost(deps.publicHost);
   const shareUrl = `${host}/s/${uploaded.sealId}/${shareCode}#${fragment}`;
   if (mode === "forward") {
@@ -13808,21 +14093,12 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
       shareUrl,
       expiresAt,
       maxReads: FORWARD_MAX_READS_FORCED,
-      mode: "forward"
+      mode: "forward",
+      delivered: true
     };
   }
-  op.step = "delivering";
   op.handoff_channels_attempted = deps.handoff?.disableClipboard ? ["file"] : ["clipboard", "file"];
-  try {
-    await journal(ctx, handle, op);
-  } catch (err2) {
-    const outcome = await compensateRevoke(ctx, handle, op);
-    throw new ToolError(
-      "state_persist_failed",
-      `could not journal the delivery attempt before handing off the URL: ${err2 instanceof Error ? err2.message : String(err2)} (${outcome})`,
-      err2
-    );
-  }
+  await journalDelivering(ctx, handle, op);
   let handoff;
   try {
     handoff = await performHandoff({ handle, shareUrl, expireMs }, deps.handoff);
@@ -13857,6 +14133,19 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
 function messageOf3(err2) {
   return err2 instanceof Error ? err2.message : String(err2);
 }
+async function journalDelivering(ctx, handle, op) {
+  op.step = "delivering";
+  try {
+    await journal(ctx, handle, op);
+  } catch (err2) {
+    const outcome = await compensateRevoke(ctx, handle, op);
+    throw new ToolError(
+      "state_persist_failed",
+      `could not journal the delivery attempt before the link could reach anyone: ${messageOf3(err2)} (${outcome})`,
+      err2
+    );
+  }
+}
 async function awaitPayment(ctx, deps, prepared, { handle, op, ownerTokenB64, session }) {
   const tier = prepared.tier;
   const sealId = op.seal_id;
@@ -13948,7 +14237,8 @@ function shareOutputToWire(out) {
       share_url: out.shareUrl,
       expires_at: out.expiresAt,
       max_reads: out.maxReads,
-      mode: out.mode
+      mode: out.mode,
+      delivered: out.delivered
     };
   }
   const wire = {
@@ -14015,6 +14305,18 @@ function openOutputToWire(out) {
     expires_at: out.expiresAt
   };
 }
+function inboxOutputToWire(out) {
+  return {
+    address_emoji: out.addressEmoji,
+    items: out.items.map((item) => ({
+      handle: item.handle,
+      from: item.from,
+      label: item.label,
+      received_at: item.receivedAt,
+      expires_at: item.expiresAt
+    }))
+  };
+}
 function listOutputToWire(out) {
   return {
     entries: out.entries.map((entry) => ({
@@ -14045,7 +14347,7 @@ function proFileGetOutputToWire(out) {
 }
 
 // src/server.ts
-var SERVER_VERSION = "0.3.0";
+var SERVER_VERSION = "0.4.0";
 var toolMeta = (name) => {
   const { title, description, annotations } = seal_mcp_v1_default.tools[name];
   return { title, description, annotations };
@@ -14053,6 +14355,7 @@ var toolMeta = (name) => {
 var SHARE_INPUT = seal_mcp_v1_default.tools.seal_share.input.properties;
 var REQUEST_INPUT = seal_mcp_v1_default.tools.seal_request.input.properties;
 var OPEN_INPUT = seal_mcp_v1_default.tools.seal_open.input.properties;
+var INBOX_INPUT = seal_mcp_v1_default.tools.seal_inbox.input.properties;
 var PRO_SECRET_USE = seal_mcp_v1_default.pro_tools.seal_pro_secret_use;
 var PRO_SECRET_REQUEST = seal_mcp_v1_default.pro_tools.seal_pro_secret_request;
 var PRO_FILE_GET = seal_mcp_v1_default.pro_tools.seal_pro_file_get;
@@ -14097,7 +14400,8 @@ async function createServer(options) {
     update,
     ephemeral: disk === null,
     requests: /* @__PURE__ */ new Map(),
-    payments: /* @__PURE__ */ new Map()
+    payments: /* @__PURE__ */ new Map(),
+    inbox: { items: /* @__PURE__ */ new Map(), version: null }
   };
   const mcp = new import_mcp.McpServer(
     { name: "sealnet-mcp", version: SERVER_VERSION },
@@ -14144,6 +14448,7 @@ async function createServer(options) {
           },
           {
             publicHost,
+            label: client2.getClientVersion()?.name,
             handoff: disableClipboard ? { disableClipboard: true } : void 0,
             elicitUrl: urlMode ? async (params) => (await client2.elicitInput({ mode: "url", ...params })).action : void 0,
             elicitationDone: urlMode ? (id) => client2.createElicitationCompletionNotifier(id)() : void 0
@@ -14197,19 +14502,37 @@ async function createServer(options) {
     {
       ...toolMeta("seal_open"),
       inputSchema: {
-        url: external_exports.string().url().describe(OPEN_INPUT.url.description),
+        // Exactly one of `url` and `item`: the handler refuses anything else (contract `one_of`).
+        url: external_exports.string().url().optional().describe(OPEN_INPUT.url.description),
+        item: external_exports.string().regex(/^in_/).optional().describe(OPEN_INPUT.item.description),
         mode: external_exports.enum(["metadata", "inline", "file"]).default("metadata").describe(OPEN_INPUT.mode.description),
         dir: external_exports.string().optional().describe(OPEN_INPUT.dir.description)
       }
     },
     async (args, extra) => {
       const result = await wrapTool(
-        () => sealOpen(ctx, { url: args.url, mode: args.mode, dir: args.dir, onProgress: progressReporter(extra) }),
+        () => sealOpen(ctx, {
+          url: args.url,
+          item: args.item,
+          mode: args.mode,
+          dir: args.dir,
+          onProgress: progressReporter(extra)
+        }),
         openOutputToWire
       );
       return result;
     }
   );
+  mcp.registerTool(
+    "seal_inbox",
+    {
+      ...toolMeta("seal_inbox"),
+      inputSchema: {
+        wait: external_exports.number().int().min(0).max(300).default(0).describe(INBOX_INPUT.wait.description)
+      }
+    },
+    async (args) => wrapTool(() => sealInbox(ctx, { wait: args.wait }), inboxOutputToWire)
+  );
   mcp.registerTool(
     "seal_list",
     {