wokitoki 0.3.1 → 0.3.2

package/README.md

@@ -10,8 +10,10 @@ Your Claude Code talks to your friend's Claude Code (or Codex), directly, peer t
 No server. No account. No tunnel. Free and open source.
 
 [![CI](https://github.com/pandeyvishwas51-oss/wokitoki/actions/workflows/ci.yml/badge.svg)](https://github.com/pandeyvishwas51-oss/wokitoki/actions/workflows/ci.yml)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/pandeyvishwas51-oss/wokitoki/badge)](https://scorecard.dev/viewer/?uri=github.com/pandeyvishwas51-oss/wokitoki)
 [![npm](https://img.shields.io/npm/v/wokitoki?color=FF5A1F)](https://www.npmjs.com/package/wokitoki)
 [![WokiToki MCP server on Glama](https://glama.ai/mcp/servers/pandeyvishwas51-oss/wokitoki/badges/score.svg)](https://glama.ai/mcp/servers/pandeyvishwas51-oss/wokitoki)
+[![M8ven Score](https://m8ven.ai/badge/mcp/pandeyvishwas51-oss-wokitoki-atcfpk?v=f7bb2fa9b9dcfb420e5aafaf4712ed9e)](https://m8ven.ai/mcp/pandeyvishwas51-oss-wokitoki-atcfpk?s=readme)
 [![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-FF5A1F)](https://github.com/pandeyvishwas51-oss/wokitoki/blob/main/LICENSE)
 [![MCP Registry](https://img.shields.io/badge/MCP_Registry-io.github.pandeyvishwas51--oss%2Fwokitoki-2B1306)](https://registry.modelcontextprotocol.io/v0/servers?search=wokitoki)
 [![Node 22.18+](https://img.shields.io/badge/node-22.18%2B-2B1306)](https://nodejs.org)
@@ -188,9 +190,11 @@ Every command accepts `--json` and `--home <dir>` (default `~/.wokitoki`). The o
 
 ```bash
 pnpm install
-pnpm check      # strict TypeScript + 64 tests: unit, adversarial, P2P on a local DHT testnet, multi-process CLI e2e, real MCP calls
+pnpm check      # strict TypeScript + 65 tests: unit, adversarial, P2P on a local DHT testnet, multi-process CLI e2e, real MCP calls
 ```
 
+Releases come only from CI: bump the version, tag `vX.Y.Z` on `main` and push the tag. [release.yml](https://github.com/pandeyvishwas51-oss/wokitoki/blob/main/.github/workflows/release.yml) stages it on npm with signed provenance (trusted publishing, no tokens) for a maintainer to approve with 2FA, attaches a build attestation and an SBOM to the GitHub release, and updates the MCP Registry.
+
 [Roadmap](https://github.com/pandeyvishwas51-oss/wokitoki/blob/main/ROADMAP.md): tasks, encrypted file transfer, multi-agent rooms and a web console are next. License: [Apache-2.0](https://github.com/pandeyvishwas51-oss/wokitoki/blob/main/LICENSE).
 
 <p align="center"><img src="https://raw.githubusercontent.com/pandeyvishwas51-oss/wokitoki/main/assets/logo.svg" width="72" alt="WokiToki mascot"></p>

package/dist/wokitoki.mjs

@@ -281,7 +281,11 @@ var init_src2 = __esm({
     utf8 = new TextEncoder();
     strictUtf8 = new TextDecoder("utf-8", { fatal: true });
     toB64 = (u) => Buffer.from(u).toString("base64url");
-    fromB64 = (s) => new Uint8Array(Buffer.from(s, "base64url"));
+    fromB64 = (s) => {
+      const bytes = new Uint8Array(Buffer.from(s, "base64url"));
+      if (Buffer.from(bytes).toString("base64url") !== s) throw new Error("invalid base64url: not in canonical form");
+      return bytes;
+    };
     toHex = (u) => Buffer.from(u).toString("hex");
     joinTranscript = (pairId, joiner) => utf8.encode(canonicalJson({ t: "agentmesh-pair-join-v1", pairId, joiner }));
   }
@@ -1912,7 +1916,8 @@ function createMcpServer(socketPath, version) {
     {
       title: "WokiToki status",
       description: "Show this WokiToki identity, network connection state (peer-to-peer or relay), pending outbox size and peer counts.",
-      annotations: { readOnlyHint: true, openWorldHint: false }
+      inputSchema: {},
+      annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false }
     },
     () => guard(async () => ok(await daemon2("GET", "/status")))
   );
@@ -1922,7 +1927,7 @@ function createMcpServer(socketPath, version) {
       title: "List WokiToki peers",
       description: 'List agents this machine is paired with. Only peers in state "active" can receive messages. Pairing and approval are done by the human with the wokitoki CLI, not by this tool.',
       inputSchema: { state: z7.enum(["pending", "active", "rejected", "revoked"]).optional().describe("filter by pairing state") },
-      annotations: { readOnlyHint: true, openWorldHint: false }
+      annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false }
     },
     ({ state }) => guard(async () => ok((await daemon2("GET", `/peers${state ? `?state=${state}` : ""}`)).map(peerSummary)))
   );
@@ -1950,7 +1955,8 @@ function createMcpServer(socketPath, version) {
         limit: z7.number().int().min(1).max(200).optional().describe("max messages (default 50)"),
         markRead: z7.boolean().optional().describe("mark returned messages as read (default true)")
       },
-      annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: false }
+      annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false }
+      // marks messages read
     },
     ({ peer, limit, markRead }) => guard(async () => {
       const q = new URLSearchParams({ unread: "1", limit: String(limit ?? 50), ...peer ? { peer } : {} });
@@ -1969,7 +1975,7 @@ function createMcpServer(socketPath, version) {
         peer: z7.string().max(128).optional().describe("only this peer (name or device id)"),
         limit: z7.number().int().min(1).max(200).optional().describe("max messages (default 20)")
       },
-      annotations: { readOnlyHint: true, openWorldHint: false }
+      annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false }
     },
     ({ peer, limit }) => guard(async () => {
       const q = new URLSearchParams({ limit: String(limit ?? 20), ...peer ? { peer } : {} });

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "wokitoki",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "wokitoki",
-      "version": "0.3.1",
+      "version": "0.3.2",
       "license": "Apache-2.0",
       "os": [
         "darwin",
@@ -790,9 +790,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.8",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz",
-      "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==",
+      "version": "3.1.9",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.9.tgz",
+      "integrity": "sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==",
       "funding": [
         {
           "type": "github",
@@ -1102,9 +1102,9 @@
       "license": "ISC"
     },
     "node_modules/jose": {
-      "version": "6.2.12",
-      "resolved": "https://registry.npmjs.org/jose/-/jose-6.2.12.tgz",
-      "integrity": "sha512-9NiFmJEex0sy2Dk58j2UGBSHgUs2ypF9eZSu4L6vjOX3Dp96Sw1F3uL+H+D1sx02jZZdzUT0HgvCy59CuvXcWw==",
+      "version": "6.2.13",
+      "resolved": "https://registry.npmjs.org/jose/-/jose-6.2.13.tgz",
+      "integrity": "sha512-7TIg10ZE1x82YediN+lcrPNvGMKge9yFHQD+Qho/b8y2adfugU3AsvvHfxV0fzyFllT6l9xCjf4RWY9g/Z9PJQ==",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/panva"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wokitoki",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Walkie-talkies for AI coding agents: Claude Code and Codex message each other peer to peer, end-to-end encrypted, via MCP. No server, no account.",
   "license": "Apache-2.0",
   "author": "Vishwas Pandey",