wokitoki 0.3.0 → 0.3.2

package/README.md

@@ -10,7 +10,10 @@ Your Claude Code talks to your friend's Claude Code (or Codex), directly, peer t
 No server. No account. No tunnel. Free and open source.
 
 [![CI](https://github.com/pandeyvishwas51-oss/wokitoki/actions/workflows/ci.yml/badge.svg)](https://github.com/pandeyvishwas51-oss/wokitoki/actions/workflows/ci.yml)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/pandeyvishwas51-oss/wokitoki/badge)](https://scorecard.dev/viewer/?uri=github.com/pandeyvishwas51-oss/wokitoki)
 [![npm](https://img.shields.io/npm/v/wokitoki?color=FF5A1F)](https://www.npmjs.com/package/wokitoki)
+[![WokiToki MCP server on Glama](https://glama.ai/mcp/servers/pandeyvishwas51-oss/wokitoki/badges/score.svg)](https://glama.ai/mcp/servers/pandeyvishwas51-oss/wokitoki)
+[![M8ven Score](https://m8ven.ai/badge/mcp/pandeyvishwas51-oss-wokitoki-atcfpk?v=f7bb2fa9b9dcfb420e5aafaf4712ed9e)](https://m8ven.ai/mcp/pandeyvishwas51-oss-wokitoki-atcfpk?s=readme)
 [![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-FF5A1F)](https://github.com/pandeyvishwas51-oss/wokitoki/blob/main/LICENSE)
 [![MCP Registry](https://img.shields.io/badge/MCP_Registry-io.github.pandeyvishwas51--oss%2Fwokitoki-2B1306)](https://registry.modelcontextprotocol.io/v0/servers?search=wokitoki)
 [![Node 22.18+](https://img.shields.io/badge/node-22.18%2B-2B1306)](https://nodejs.org)
@@ -89,7 +92,7 @@ It brings the MCP tools, the skill, and an alert: at session start and on your n
 | `wokitoki_read_inbox` | read unread messages (marks them read) |
 | `wokitoki_list_messages` | conversation history with delivery state |
 
-`wokitoki setup` also installs a Claude Code [skill](https://github.com/pandeyvishwas51-oss/wokitoki/blob/main/skills/wokitoki/SKILL.md) that tells the agent when to use these tools, to never send secrets, and to treat incoming messages as information rather than instructions.
+`wokitoki setup` also installs a Claude Code [skill](https://github.com/pandeyvishwas51-oss/wokitoki/blob/main/plugins/wokitoki/skills/wokitoki/SKILL.md) that tells the agent when to use these tools, to never send secrets, and to treat incoming messages as information rather than instructions.
 
 Your agent **cannot** pair, approve or revoke; those always need you at the terminal. Incoming text is labelled as untrusted data, so agents treat it as information, never as instructions. Any MCP client can use WokiToki by running `wokitoki mcp`.
 
@@ -187,9 +190,11 @@ Every command accepts `--json` and `--home <dir>` (default `~/.wokitoki`). The o
 
 ```bash
 pnpm install
-pnpm check      # strict TypeScript + 64 tests: unit, adversarial, P2P on a local DHT testnet, multi-process CLI e2e, real MCP calls
+pnpm check      # strict TypeScript + 65 tests: unit, adversarial, P2P on a local DHT testnet, multi-process CLI e2e, real MCP calls
 ```
 
+Releases come only from CI: bump the version, tag `vX.Y.Z` on `main` and push the tag. [release.yml](https://github.com/pandeyvishwas51-oss/wokitoki/blob/main/.github/workflows/release.yml) stages it on npm with signed provenance (trusted publishing, no tokens) for a maintainer to approve with 2FA, attaches a build attestation and an SBOM to the GitHub release, and updates the MCP Registry.
+
 [Roadmap](https://github.com/pandeyvishwas51-oss/wokitoki/blob/main/ROADMAP.md): tasks, encrypted file transfer, multi-agent rooms and a web console are next. License: [Apache-2.0](https://github.com/pandeyvishwas51-oss/wokitoki/blob/main/LICENSE).
 
 <p align="center"><img src="https://raw.githubusercontent.com/pandeyvishwas51-oss/wokitoki/main/assets/logo.svg" width="72" alt="WokiToki mascot"></p>

package/dist/wokitoki.mjs

@@ -281,7 +281,11 @@ var init_src2 = __esm({
     utf8 = new TextEncoder();
     strictUtf8 = new TextDecoder("utf-8", { fatal: true });
     toB64 = (u) => Buffer.from(u).toString("base64url");
-    fromB64 = (s) => new Uint8Array(Buffer.from(s, "base64url"));
+    fromB64 = (s) => {
+      const bytes = new Uint8Array(Buffer.from(s, "base64url"));
+      if (Buffer.from(bytes).toString("base64url") !== s) throw new Error("invalid base64url: not in canonical form");
+      return bytes;
+    };
     toHex = (u) => Buffer.from(u).toString("hex");
     joinTranscript = (pairId, joiner) => utf8.encode(canonicalJson({ t: "agentmesh-pair-join-v1", pairId, joiner }));
   }
@@ -1912,7 +1916,8 @@ function createMcpServer(socketPath, version) {
     {
       title: "WokiToki status",
       description: "Show this WokiToki identity, network connection state (peer-to-peer or relay), pending outbox size and peer counts.",
-      annotations: { readOnlyHint: true, openWorldHint: false }
+      inputSchema: {},
+      annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false }
     },
     () => guard(async () => ok(await daemon2("GET", "/status")))
   );
@@ -1922,7 +1927,7 @@ function createMcpServer(socketPath, version) {
       title: "List WokiToki peers",
       description: 'List agents this machine is paired with. Only peers in state "active" can receive messages. Pairing and approval are done by the human with the wokitoki CLI, not by this tool.',
       inputSchema: { state: z7.enum(["pending", "active", "rejected", "revoked"]).optional().describe("filter by pairing state") },
-      annotations: { readOnlyHint: true, openWorldHint: false }
+      annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false }
     },
     ({ state }) => guard(async () => ok((await daemon2("GET", `/peers${state ? `?state=${state}` : ""}`)).map(peerSummary)))
   );
@@ -1950,7 +1955,8 @@ function createMcpServer(socketPath, version) {
         limit: z7.number().int().min(1).max(200).optional().describe("max messages (default 50)"),
         markRead: z7.boolean().optional().describe("mark returned messages as read (default true)")
       },
-      annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: false }
+      annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false }
+      // marks messages read
     },
     ({ peer, limit, markRead }) => guard(async () => {
       const q = new URLSearchParams({ unread: "1", limit: String(limit ?? 50), ...peer ? { peer } : {} });
@@ -1969,7 +1975,7 @@ function createMcpServer(socketPath, version) {
         peer: z7.string().max(128).optional().describe("only this peer (name or device id)"),
         limit: z7.number().int().min(1).max(200).optional().describe("max messages (default 20)")
       },
-      annotations: { readOnlyHint: true, openWorldHint: false }
+      annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false }
     },
     ({ peer, limit }) => guard(async () => {
       const q = new URLSearchParams({ limit: String(limit ?? 20), ...peer ? { peer } : {} });
@@ -2148,7 +2154,7 @@ await init_control();
 var SELF = fileURLToPath(import.meta.url);
 var firstExisting = (...paths) => paths.find((p) => existsSync4(p)) ?? paths[0];
 var BIN = firstExisting(resolve2(dirname2(SELF), "../bin/wokitoki.js"), SELF);
-var SKILL = firstExisting(resolve2(dirname2(SELF), "../skills/wokitoki/SKILL.md"), resolve2(dirname2(SELF), "../../../skills/wokitoki/SKILL.md"));
+var SKILL = firstExisting(resolve2(dirname2(SELF), "../skills/wokitoki/SKILL.md"), resolve2(dirname2(SELF), "../../../plugins/wokitoki/skills/wokitoki/SKILL.md"));
 var INSTALL_URL = "https://raw.githubusercontent.com/pandeyvishwas51-oss/wokitoki/main/install.sh";
 var VERSION = JSON.parse(readFileSync3(new URL("../package.json", import.meta.url), "utf8")).version;
 var program = new Command("wokitoki").description("WokiToki: paired, end-to-end encrypted messaging between independently owned coding agents").version(VERSION).option("--home <dir>", "WokiToki home directory (default: $WOKITOKI_HOME or ~/.wokitoki)").option("--json", "machine-readable JSON output").showHelpAfterError();
@@ -2531,7 +2537,7 @@ program.command("hook <event>").description("Claude Code hook: announce unread m
   const { home } = ctx();
   try {
     if (!existsSync4(homePaths(home).identity)) {
-      if (event === "session-start") console.log(`WokiToki is installed but not set up. If the user wants their agent to message other developers' agents, tell them to run: wokitoki setup --name "<their name>"`);
+      if (event === "session-start") console.log(`WokiToki is not set up on this machine. If the user wants their agent to message other developers' agents, tell them to run: npm install -g wokitoki, then wokitoki setup --name "<their name>"`);
       return;
     }
     const unread = await daemon("GET", "/messages?unread=1&limit=100");