srift-transfer 2.2.13 → 2.2.14

package/README.md

@@ -37,6 +37,15 @@ The user opens the link in any web browser or runs `curl -OJ https://srift.app/d
 
 **Session** transfers are end-to-end encrypted with **AES-256-GCM**, keys derived locally (PBKDF2-SHA256, 100,000 iterations) and never sent to us.
 
+> **⚠️ The sender's daemon must be alive for the link to work.**
+> SRIFT keeps no server-side copy — the daemon streams the file from your disk
+> on demand. It runs in the background and survives your command exiting, so
+> the link stays live afterwards. But if the daemon stops (machine sleeps or
+> reboots, or `srift daemon stop`) the link returns `503 sender is offline`.
+> This is the direct trade-off for zero retention: nothing is stored, so
+> nothing can be served once the source goes away. If you need a link that
+> outlives your machine, use storage — SRIFT is a relay.
+
 Public `quick-share` links are a deliberate exception, and it's worth being precise: the link is designed to be opened by any browser, `curl` or `wget` — clients that hold no key and run no SRIFT code. End-to-end encryption is therefore impossible on that path by definition. What SRIFT guarantees for quick-share is **zero retention**: bytes stream from the sender straight to the open HTTP response, are never written to SRIFT storage, and are served `Cache-Control: no-store`. If you need the relay to be unable to read the content, use a session transfer instead of a public link.
 
 ---

package/dist/daemon.js

@@ -254,7 +254,11 @@ srift_quick_share({ filePath: "/abs/path/file.zip" })
 \u2192 they open it in any browser, or run:
     curl -OJ <downloadUrl>
     wget --content-disposition <downloadUrl>
-\u2192 keep the daemon running while the download is in progress
+\u2192 IMPORTANT: the local daemon seeds the file. It keeps running in the
+  background after your tool call returns, so the link stays live. But if
+  the daemon stops (machine sleeps/reboots, or 'srift daemon stop') the link
+  returns 503 "sender is offline" \u2014 SRIFT stores no copy server-side.
+  Tell the user to download while their machine is on.
 \`\`\`
 
 **Open a long-lived collaboration room:**
@@ -487,7 +491,13 @@ The peer must call srift_accept_transfer with this fileId.`;
         ``,
         `Give the URL to the user \u2014 they open it in any browser, or run:`,
         `  curl -OJ "${url}"`,
-        `Keep this srift daemon running while they download.`
+        ``,
+        `The daemon seeds this file from disk and keeps running in the`,
+        `background, so the link stays live after this call returns.`,
+        `It stops working if the daemon stops (machine sleeps/reboots, or`,
+        `\`srift daemon stop\`) \u2014 SRIFT keeps no server-side copy, so the link`,
+        `then returns 503 "sender is offline". Tell the user to grab it while`,
+        `this machine is on.`
       ].join("\n");
     }
     case "srift_send_chat":

package/dist/index.js

@@ -352,7 +352,11 @@ srift_quick_share({ filePath: "/abs/path/file.zip" })
 \u2192 they open it in any browser, or run:
     curl -OJ <downloadUrl>
     wget --content-disposition <downloadUrl>
-\u2192 keep the daemon running while the download is in progress
+\u2192 IMPORTANT: the local daemon seeds the file. It keeps running in the
+  background after your tool call returns, so the link stays live. But if
+  the daemon stops (machine sleeps/reboots, or 'srift daemon stop') the link
+  returns 503 "sender is offline" \u2014 SRIFT stores no copy server-side.
+  Tell the user to download while their machine is on.
 \`\`\`
 
 **Open a long-lived collaboration room:**
@@ -479,7 +483,13 @@ The peer must call srift_accept_transfer with this fileId.`;
         ``,
         `Give the URL to the user \u2014 they open it in any browser, or run:`,
         `  curl -OJ "${url}"`,
-        `Keep this srift daemon running while they download.`
+        ``,
+        `The daemon seeds this file from disk and keeps running in the`,
+        `background, so the link stays live after this call returns.`,
+        `It stops working if the daemon stops (machine sleeps/reboots, or`,
+        `\`srift daemon stop\`) \u2014 SRIFT keeps no server-side copy, so the link`,
+        `then returns 503 "sender is offline". Tell the user to grab it while`,
+        `this machine is on.`
       ].join("\n");
     }
     case "srift_send_chat":
@@ -2913,7 +2923,7 @@ var __filename = fileURLToPath2(import.meta.url);
 var __dirname = path3.dirname(__filename);
 var DAEMON_PORT3 = parseInt(process.env.SRIFT_DAEMON_PORT || "3822", 10);
 var DAEMON_URL3 = `http://127.0.0.1:${DAEMON_PORT3}`;
-var CLI_VERSION = "2.2.13";
+var CLI_VERSION = "2.2.14";
 function parseDuration(s) {
   if (!s) return 0;
   const m = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/i.exec(s.trim());
@@ -4538,7 +4548,12 @@ Everything below works without tokens, OAuth, or API keys.
     \u2192 the user opens it in any browser, or downloads via:
         curl -OJ https://srift.app/d/<token>
         wget --content-disposition https://srift.app/d/<token>
-    \u2192 keep the daemon running while they download
+    \u2192 the daemon keeps seeding in the background after this command exits.
+      The link stays live while that daemon is running. If it is stopped
+      (srift daemon stop, reboot, laptop sleep) the link returns 503
+      "sender is offline" \u2014 SRIFT keeps no server-side copy of the file.
+      For a link that must outlive your machine, upload it somewhere that
+      does retain the bytes; SRIFT is a relay, not storage.
 
 \u2500\u2500\u2500\u2500 Open a long-lived collaboration room \u2500\u2500\u2500\u2500
   srift session start --name "AI-Collab"

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "srift-transfer",
-  "version": "2.2.13",
+  "version": "2.2.14",
+  "mcpName": "app.srift/srift",
   "description": "Zero-config, zero-token peer-to-peer secure file transfer, encrypted chat, and Model Context Protocol (MCP) server for AI coding agents (Claude, Cursor, Windsurf, Continue, Zed) and developers. End-to-end AES-256-GCM encrypted.",
   "keywords": [
     "mcp",