tokens-for-good 0.3.3 → 0.3.5

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Tokens for Good
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/package.json

@@ -1,12 +1,17 @@
 {
   "name": "tokens-for-good",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "type": "module",
   "description": "Donate your spare AI tokens to research nonprofits for Fierce Philanthropy",
   "bin": {
     "tokens-for-good": "src/cli.js"
   },
   "main": "./src/mcp-server.js",
+  "files": [
+    "src/",
+    "pipeline/",
+    "LICENSE"
+  ],
   "scripts": {
     "start": "node src/mcp-server.js",
     "test": "node --test src/**/*.test.js"

package/src/mcp-server.js

@@ -26,7 +26,7 @@ updateState({ platform });
 
 const server = new McpServer({
   name: 'tokens-for-good',
-  version: '0.3.3',
+  version: '0.3.5',
 });
 
 // --- No-key onboarding message ---
@@ -345,7 +345,20 @@ server.tool('check_permissions', 'Check if permissions and hooks are set up for
 
 The hook reads TFG_API_KEY from the environment (set in .mcp.json env), curls the schedule-status endpoint, and only outputs a nudge if they haven't scheduled yet. Once they schedule, the hook goes silent.
 
-After setting up both, tell the user: "Done! Permissions and schedule reminder are configured."` }],
+3. **Skill** — create the file ~/.claude/skills/tfg/SKILL.md with this content:
+
+---
+name: tfg
+description: Do charitable research for Fierce Philanthropy via Tokens for Good
+---
+
+Do charitable research for Fierce Philanthropy via Tokens for Good. Call next_action to check whether to research or review. Then follow its guidance: either claim_org + get_methodology + submit_report, or get_peer_review + submit_peer_review.
+
+---
+
+This lets the user type /tfg to start a research session.
+
+After setting up everything, tell the user: "Done! Permissions, schedule reminder, and /tfg command are configured."` }],
   };
 });
 

package/src/state.js

@@ -28,9 +28,9 @@ export function loadState() {
 
 export function saveState(state) {
   if (!existsSync(STATE_DIR)) {
-    mkdirSync(STATE_DIR, { recursive: true });
+    mkdirSync(STATE_DIR, { recursive: true, mode: 0o700 });
   }
-  writeFileSync(STATE_FILE, JSON.stringify(state, null, 2), 'utf-8');
+  writeFileSync(STATE_FILE, JSON.stringify(state, null, 2), { encoding: 'utf-8', mode: 0o600 });
 }
 
 export function updateState(updates) {