whitemagic-mcp 9.2.7 → 9.2.9

package/README.md

@@ -1,19 +1,30 @@
 # whitemagic-mcp
 
-[WhiteMagic](https://whitemagic.dev): local-first, governed memory and
-session continuity for AI coding agents, over MCP. One static Rust binary,
-no telemetry by default. MIT.
+Persistent memory and session continuity for AI coding agents, over MCP.
+[WhiteMagic](https://whitemagic.dev) is one static Rust binary — local-first,
+no telemetry by default, MIT — and every handoff can be signed as a
+verifiable [continuity receipt](https://www.whitemagic.dev/trust).
 
-Optional: a read-only hosted evaluation lane runs at
-`https://mcp.whitemagic.dev/mcp` (free evaluation keys), and the receipt
-format with its live verifier is documented at
-https://www.whitemagic.dev/trust.
+Works with Claude Code, Claude Desktop, Cursor, Codex, VS Code, opencode,
+Antigravity, and Devin Desktop — per-client configs:
+https://www.whitemagic.dev/whitemagic/guide
 
 This package installs and runs the official `wm` binary from the
 [GitHub releases](https://github.com/lbailey94/whitemagic/releases)
 (checksum-verified at install time) so an MCP client can launch it
 without a manual download step.
 
+## Try it without installing (hosted read-only lane)
+
+The evaluation lane runs at `https://mcp.whitemagic.dev/mcp`
+(streamable-http; keyless discovery, free evaluation keys, no SLA):
+
+```bash
+claude mcp add whitemagic-mcp --transport http https://mcp.whitemagic.dev/mcp
+```
+
+The npm package remains the local, full-write path.
+
 ## Use
 
 Point any MCP client (Claude Desktop, Cursor, Codex, Gemini CLI,
@@ -32,7 +43,7 @@ opencode) at:
 Or try it directly:
 
 ```bash
-npx whitemagic-mcp --version   # wm 9.2.7
+npx whitemagic-mcp --version   # wm 9.2.9
 npx whitemagic-mcp doctor      # environment health check
 ```
 
@@ -41,17 +52,13 @@ The binary is cached under `~/.cache/whitemagic/bin/<release-tag>/`
 release tag (the `v9` tag line). Pin a different release with
 `WHITEMAGIC_RELEASE`.
 
-## Hosted option (read-only beta)
-
-For evaluation without a local install there is a read-only hosted
-endpoint at `https://mcp.whitemagic.dev/mcp` (streamable-http; keyless
-discovery, free evaluation keys, no SLA). The npm package remains the
-local, full-write path.
-
 ## Platforms
 
-Linux x86-64 (static musl), macOS arm64/x64, Windows x64. No asset for
-your platform? Build from source:
+Linux x86-64 (static musl), Linux arm64 (static musl), and macOS arm64 are
+install-gated. macOS x64 and Windows x64 binaries are published, but their
+install paths are not gated yet. Downloads prefer the compressed `.gz`
+distributable when the release ships one (~58% smaller) and fall back to the
+raw binary otherwise. No asset for your platform? Build from source:
 https://github.com/lbailey94/whitemagic#install
 
 ## Privacy

package/bin/lib.mjs

@@ -20,6 +20,7 @@ import {
 } from "node:fs";
 import { homedir, platform, arch, tmpdir } from "node:os";
 import { join } from "node:path";
+import { gunzipSync } from "node:zlib";
 
 export const REPO = "lbailey94/whitemagic";
 const SHA256_RE = /^[0-9a-f]{64}$/i;
@@ -120,10 +121,32 @@ export async function fetchTo(url, dest, fetchImpl) {
   writeFileSync(dest, Buffer.from(await res.arrayBuffer()));
 }
 
+/**
+ * Parse a release `.sha256` sidecar (first whitespace-delimited token) and
+ * refuse anything that is not a well-formed digest.
+ */
+function parseDigestFile(path, label) {
+  const expected = (readFileSync(path, "utf8").trim().split(/\s+/)[0] ?? "").toLowerCase();
+  if (!SHA256_RE.test(expected)) {
+    throw new Error(`release checksum for ${label} is malformed — refusing to install it`);
+  }
+  return expected;
+}
+
+function checksumMismatch(label, expected, actual) {
+  return new Error(
+    `checksum mismatch for ${label} (expected ${expected.slice(0, 12)}…, got ${actual.slice(0, 12)}…) — the download may be corrupted; retry`,
+  );
+}
+
 /**
  * Ensure a verified `wm` binary for this platform exists in the cache and
  * return its path. Fresh downloads go temp -> checksum -> chmod -> rename;
  * a cache entry that fails re-verification is replaced (self-healing).
+ *
+ * The launcher prefers the gzipped distributable (~58% smaller; published
+ * for Linux/macOS) exactly like `scripts/install.sh` does. Windows `.exe`
+ * assets ship raw, and releases that predate the `.gz` fall back on a 404.
  */
 export async function ensureBinary({
   fetchImpl = fetch,
@@ -155,22 +178,45 @@ export async function ensureBinary({
   const tmp = mkdtempSync(join(binDir, ".download-"));
   try {
     const tmpBin = join(tmp, asset);
-    const tmpSha = join(tmp, `${asset}.sha256`);
-    await fetchTo(`${BASE_URL(resolvedTag)}/${asset}`, tmpBin, fetchImpl);
-    await fetchTo(`${BASE_URL(resolvedTag)}/${asset}.sha256`, tmpSha, fetchImpl);
-    const expected = (readFileSync(tmpSha, "utf8").trim().split(/\s+/)[0] ?? "").toLowerCase();
-    if (!SHA256_RE.test(expected)) {
-      throw new Error(`release checksum for ${asset} is malformed — refusing to install it`);
+    let compressed = false;
+    if (!asset.endsWith(".exe")) {
+      try {
+        await fetchTo(`${BASE_URL(resolvedTag)}/${asset}.gz`, join(tmp, `${asset}.gz`), fetchImpl);
+        await fetchTo(
+          `${BASE_URL(resolvedTag)}/${asset}.gz.sha256`,
+          join(tmp, `${asset}.gz.sha256`),
+          fetchImpl,
+        );
+        compressed = true;
+      } catch (err) {
+        if (!String(err?.message ?? "").includes("HTTP 404")) throw err;
+      }
     }
-    const actual = digestFile(tmpBin);
-    if (actual !== expected) {
-      throw new Error(
-        `checksum mismatch for ${asset} (expected ${expected.slice(0, 12)}…, got ${actual.slice(0, 12)}…) — the download may be corrupted; retry`,
+    if (compressed) {
+      const gzPath = join(tmp, `${asset}.gz`);
+      const expectedGz = parseDigestFile(join(tmp, `${asset}.gz.sha256`), `${asset}.gz`);
+      const actualGz = digestFile(gzPath);
+      if (actualGz !== expectedGz) {
+        throw checksumMismatch(`${asset}.gz`, expectedGz, actualGz);
+      }
+      writeFileSync(tmpBin, gunzipSync(readFileSync(gzPath)));
+      log(`whitemagic-mcp: using the compressed distributable (${asset}.gz)`);
+    } else {
+      await fetchTo(`${BASE_URL(resolvedTag)}/${asset}`, tmpBin, fetchImpl);
+      await fetchTo(
+        `${BASE_URL(resolvedTag)}/${asset}.sha256`,
+        join(tmp, `${asset}.sha256`),
+        fetchImpl,
       );
+      const expected = parseDigestFile(join(tmp, `${asset}.sha256`), asset);
+      const actual = digestFile(tmpBin);
+      if (actual !== expected) {
+        throw checksumMismatch(asset, expected, actual);
+      }
     }
     chmodSync(tmpBin, 0o755);
     renameSync(tmpBin, cached);
-    writeFileSync(sidecarFor(cached), `${expected}\n`);
+    writeFileSync(sidecarFor(cached), `${digestFile(cached)}\n`);
     return cached;
   } finally {
     rmSync(tmp, { recursive: true, force: true });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "whitemagic-mcp",
-  "version": "9.2.7",
-  "description": "WhiteMagic MCP server: local-first, governed memory and session continuity for AI coding agents. Installs and runs the wm binary; no telemetry by default; optional read-only hosted evaluation lane.",
+  "version": "9.2.9",
+  "description": "Local-first persistent memory and session continuity for AI coding agents (Claude Code, Cursor, Codex), over MCP - one static Rust binary, no telemetry by default, verifiable handoffs.",
   "license": "MIT",
   "bin": {
     "whitemagic-mcp": "./bin/cli.mjs"
@@ -17,13 +17,21 @@
   "keywords": [
     "mcp",
     "mcp-server",
+    "memory",
     "agent-memory",
-    "ai-agents",
-    "local-first",
-    "whitemagic",
+    "ai-memory",
+    "persistent-memory",
     "session-continuity",
+    "context",
+    "local-first",
+    "claude-code",
+    "cursor",
+    "codex",
+    "model-context-protocol",
+    "ai-agents",
     "governance",
-    "receipts"
+    "receipts",
+    "whitemagic"
   ],
   "repository": {
     "type": "git",