wenlan-mcp 0.17.3 → 0.17.5

package/README.md

@@ -14,7 +14,7 @@ Useful work with AI shouldn't disappear when a conversation ends. Wenlan builds
 <p align="center">
   <a href="https://github.com/7xuanlu/wenlan/actions/workflows/ci.yml?query=branch%3Amain"><img alt="CI" src="https://github.com/7xuanlu/wenlan/actions/workflows/ci.yml/badge.svg?branch=main&event=push"></a>
   <a href="https://github.com/7xuanlu/wenlan/releases/latest"><img alt="Latest release" src="https://img.shields.io/github/v/release/7xuanlu/wenlan?sort=semver&label=release"></a>
-  <a href="#license"><img alt="License: Apache-2.0" src="https://img.shields.io/badge/license-Apache--2.0-blue.svg"></a>
+  <a href="#license"><img alt="License: Apache-2.0 and AGPL-3.0" src="https://img.shields.io/badge/license-Apache--2.0%20%2B%20AGPL--3.0-blue.svg"></a>
 </p>
 
 <p align="center">
@@ -53,13 +53,13 @@ Wenlan runs as one local daemon. The desktop app carries that daemon inside it;
 
 Nothing else to install. The app bundles the daemon, CLI, and MCP connector, starts the daemon on launch, and offers to connect the AI clients it detects: the plugin for Claude Code and Codex, an MCP entry for the rest. From there you read Pages, inspect the Source behind any citation, and curate the knowledge system.
 
-This preview is ad-hoc signed and not notarized, so macOS blocks the first launch: it may say Wenlan "cannot be opened" or that it could not check it for malicious software. Close that dialog, then allow the app once under System Settings, Privacy & Security, "Open Anyway". One command skips that step: it verifies the download against GitHub's published SHA-256, clears quarantine for this app alone, and changes no macOS security settings.
+The app is signed with an Apple Developer ID certificate and notarized by Apple, so macOS opens it on a first launch with no warning to click through. If you would rather install it from the terminal, one command downloads it, checks it against GitHub's published SHA-256, and moves it into Applications.
 
 ```bash
 /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/7xuanlu/wenlan/main/scripts/install-macos-app.sh)"
 ```
 
-On Windows x64, run the `-setup.exe` from the same [Releases](https://github.com/7xuanlu/wenlan/releases/latest) page. It installs the daemon, CLI, and MCP connector along with the runtime libraries they load, so there is nothing else to install. Linux has no desktop build yet; use the headless runtime below.
+On Windows x64, run the `-setup.exe` from the same [Releases](https://github.com/7xuanlu/wenlan/releases/latest) page. It installs the daemon, CLI, and MCP connector along with the runtime libraries they load, so there is nothing else to install. The installer is not signed yet, so SmartScreen says "Windows protected your PC": choose "More info", then "Run anyway". Linux has no desktop build yet; use the headless runtime below.
 
 <a id="claude-code-in-30-seconds"></a>
 
@@ -291,7 +291,7 @@ Full workflow reference: [plugin/skills](plugin/skills/README.md). Technical mod
 
 Nothing is locked in. Pages and session notes are Markdown under `~/.wenlan/`; memories live in one libSQL database under the platform data directory (`~/Library/Application Support/wenlan/` on macOS, `~/.local/share/wenlan/` on Linux, `%LOCALAPPDATA%\wenlan\` on Windows). Copy those two folders to back up or move a Wenlan. An install upgraded from Origin still holds a full copy of its data in `~/.origin/` and in the sibling `origin` data folder (`~/Library/Application Support/origin/` on macOS, `~/.local/share/origin/` on Linux, `%LOCALAPPDATA%\origin\` on Windows); delete or copy those two as well.
 
-To uninstall: the app's *Run Wenlan in background at login* toggle removes the launch registration — turn it off, quit, and delete `Wenlan.app` or run the Windows uninstaller, then delete the folders above. `wenlan background off` only stops the daemon and disables autostart; it does not remove the launch registration, so a CLI-only install should instead follow the daemon uninstall bullet in [PRIVACY.md](PRIVACY.md). Every path Wenlan writes is listed there.
+To uninstall: the app's *Run Wenlan in background at login* toggle removes the launch registration — turn it off, quit, and delete `Wenlan.app` or run the Windows uninstaller, then delete the folders above. `wenlan background off` only stops the daemon and disables autostart; it does not remove the launch registration, so a CLI-only install should instead follow the daemon uninstall bullet in [PRIVACY.md](PRIVACY.md). The paths Wenlan writes are listed there.
 
 ---
 
@@ -329,6 +329,7 @@ More detailed documentation, concepts, and comparisons:
 - [Local-first AI memory](https://wenlan.app/learn/local-first-ai-memory): data, privacy, and control.
 - [Markdown and local index](https://wenlan.app/learn/markdown-local-index-ai-memory): storage, retrieval, and ownership.
 - [AI agent handoff loop](https://wenlan.app/learn/ai-agent-handoff-loop): carrying work cleanly into the next session.
+- [Research knowledge base from papers](https://wenlan.app/learn/source-backed-research-knowledge-base): build an inspectable literature matrix and source-backed synthesis from papers you already have.
 
 ### Comparisons
 
@@ -357,11 +358,34 @@ pnpm build:all
 
 ---
 
+<a id="code-signing-policy"></a>
+
+## Code signing policy
+
+Free code signing provided by [SignPath.io](https://about.signpath.io), certificate by [SignPath Foundation](https://signpath.org).
+
+- **Authors:** [@7xuanlu](https://github.com/7xuanlu), who may commit to this repository without a further review.
+- **Reviewers:** [@7xuanlu](https://github.com/7xuanlu). Every change from someone who is not a committer arrives as a pull request and is reviewed before it merges.
+- **Approvers:** [@7xuanlu](https://github.com/7xuanlu), who approves each signing request and so decides which release is signed.
+
+Multi-factor authentication is required of every maintainer, on GitHub and on SignPath, and nobody is added to either without it. Releases are built only by the tagged release workflow in this repository, on GitHub-hosted runners, from the commit the tag points at.
+
+**Privacy policy:** [PRIVACY.md](PRIVACY.md) — what Wenlan stores, where it stores it, and each case we know of in which it reaches the network. How each platform is signed: [docs/code-signing.md](docs/code-signing.md).
+
+The SignPath application is pending. Windows installers are not signed yet.
+
+---
+
 <a id="license"></a>
 
 ## License
 
-Wenlan is licensed under **Apache-2.0**. This includes the local runtime, CLI, MCP server, shared types, and Claude Code/Codex plugin files in this repository.
+Wenlan uses two licenses, one per part of the repository.
+
+- **Apache-2.0** ([`LICENSE`](LICENSE)) covers the local runtime, CLI, MCP server, shared types, and the Claude Code and Codex plugin files. Build on these freely.
+- **AGPL-3.0-only** ([`app/LICENSE`](app/LICENSE)) covers the desktop app: the `app/` crate and the React frontend it ships. If you run a modified version of the app as a network service, the AGPL asks you to offer that modified source to its users.
+
+The split is deliberate. Apache-2.0 code may be used inside an AGPL-3.0 program, so the desktop app builds on the runtime without either license being violated.
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wenlan-mcp",
-  "version": "0.17.3",
+  "version": "0.17.5",
   "description": "Local-first memory layer for AI agents - MCP server",
   "keywords": [
     "mcp",