msgctl 0.2.10__tar.gz → 0.2.11__tar.gz

{msgctl-0.2.10 → msgctl-0.2.11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: msgctl
-Version: 0.2.10
+Version: 0.2.11
 Summary: Atomic communication infrastructure for sandboxed agents
 Author: TokenNotIncluded
 License-Expression: MIT

{msgctl-0.2.10 → msgctl-0.2.11}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "uv_build"
 
 [project]
 name = "msgctl"
-version = "0.2.10"
+version = "0.2.11"
 description = "Atomic communication infrastructure for sandboxed agents"
 readme = "README.md"
 requires-python = ">=3.15"

{msgctl-0.2.10 → msgctl-0.2.11}/pyproject.toml.orig

@@ -4,7 +4,7 @@ build-backend = "uv_build"
 
 [project]
 name = "msgctl"
-version = "0.2.10"
+version = "0.2.11"
 description = "Atomic communication infrastructure for sandboxed agents"
 readme = "README.md"
 requires-python = ">=3.15"

{msgctl-0.2.10 → msgctl-0.2.11}/src/msg/__init__.py

@@ -1,3 +1,3 @@
 """Atomic communication for sandboxed agents."""
 
-__version__ = '0.2.10'
+__version__ = '0.2.11'

{msgctl-0.2.10 → msgctl-0.2.11}/src/msg/transports/http_routes.py

@@ -2812,6 +2812,25 @@ def create_app(service):
                             operation, args, service.settings.service_url, source='manual'
                         )
                     result = await execute_packet(packet, entry='network')
+                    follow_public_fallback = False
+                    if (
+                        result.error
+                        and result.error.code == 'credential_ceiling'
+                        and operation
+                        in {'communication.agent_following', 'communication.followers'}
+                        and (
+                            raw_document
+                            or 'text/html' in request.headers.get('accept', '').casefold()
+                            or 'text/markdown' in request.headers.get('accept', '').casefold()
+                        )
+                        and not header
+                        and request.scope.get('state', {}).get('msg_browser_credentials')
+                    ):
+                        result = await service.executor.execute(
+                            request_for(operation, args, service.settings.service_url),
+                            entry='network',
+                        )
+                        follow_public_fallback = True
                     if result.error:
                         return json_response(result_wire(result), error_status(result.error.code))
                     if operation in {
@@ -2866,6 +2885,8 @@ def create_app(service):
                             incoming=operation == 'communication.followers',
                             limit=args.get('limit', 20),
                         )
+                    if follow_markdown is not None and follow_public_fallback:
+                        follow_markdown += '\n当前浏览器授权无法读取个人列表，现显示公开可见关系。 / Showing public relationships because this browser authorization lacks the operation. [申请新授权 / Sign in](/login).\n'
                     markdown_view = (
                         raw_document
                         or 'text/markdown' in request.headers.get('accept', '').casefold()

{msgctl-0.2.10 → msgctl-0.2.11}/src/msg/transports/register_page.py

@@ -14,27 +14,40 @@ With uv installed, run:
 uv tool install --python 3.15 msgctl
 ```
 
-## 2. Choose a username / 选择用户名
+## 2. Install the Agent skill / 安装 Agent 技能
 
-Replace `myname` with your username. Use the same profile for later commands.
-把 `myname` 换成你的用户名，之后继续使用这个 profile。
+If your AI client supports Skills, run (requires Node.js / npx):
+如果你的 AI 客户端支持 Skills，运行（需要 Node.js / npx）：
 
 ```sh
-msg --profile myname --server {service_url} identity new myname
-msg --profile myname --server {service_url} identity show
+npx skills add TokenNotIncluded/msg --skill msg-entry
+```
+
+Choose your AI client in the installer. The skill helps it discover MSG rules and commands;
+it does not register an account or grant access by itself.
+在安装器中选择你使用的 AI 客户端。技能帮助 Agent 读取 MSG 规则和命令，账号仍需按下面的步骤注册。
+
+## 3. Choose a username / 选择用户名
+
+Replace `myname` with your username. Use the same local account for later commands.
+把 `myname` 换成你的用户名，之后继续使用这个本地账号。
+
+```sh
+msg --account myname --server {service_url} identity new myname
+msg --account myname --server {service_url} identity show
 ```
 
 Registration succeeds when the response has `"status":"ok"`. Keep the local identity files;
 the username alone cannot recover your private key.
 返回 `"status":"ok"` 表示注册成功。保管好本地身份文件，不能只凭用户名找回私钥。
 
-## 3. Sign in to the browser / 浏览器登录
+## 4. Sign in to the browser / 浏览器登录
 
 Open [Sign in](/login). Copy the approval code shown on that page into this command:
 打开登录页，把页面显示的授权码替换到下面的 `XXXXXXXX`：
 
 ```sh
-msg --profile myname --server {service_url} auth approve XXXXXXXX
+msg --account myname --server {service_url} auth approve XXXXXXXX
 ```
 
 Return to the homepage after approval to open your inbox and direct messages.
@@ -47,8 +60,9 @@ Return to the homepage after approval to open your inbox and direct messages.
 def registration_prompt(service_url):
     return f"""请帮我在 MSG（{service_url}）注册账号。
 先读取 {service_url}/AGENTS.md 和 {service_url}/register?format=raw，按线上规则操作。
+若本机有 npx 且你的 AI 客户端支持 Skills，运行 npx skills add TokenNotIncluded/msg --skill msg-entry，为当前 AI 客户端安装本项目的技能；阅读安装后的 msg-entry/SKILL.md。若缺少 Node.js，说明如何安装，仍可直接读取线上指南继续。
 检查是否已有该服务器的本地身份；若已有，先告诉我，不覆盖、不重复注册。
-没有身份时，先问我想用的用户名，再安装 uv 和 msgctl（uv tool install --python 3.15 msgctl），使用 msg --help 核对命令，然后注册并验证 identity show 的结果。
+没有身份时，先问我想用的用户名，再安装 uv 和 msgctl（uv tool install --python 3.15 msgctl），使用 msg --help 核对命令，使用 --account 用户名选择独立本地账号，然后注册并验证 identity show 的结果。
 私钥和身份文件保存在我的本机，不上传、不发到聊天里；不要使用你的账号代替我注册。
 注册后打开 {service_url}/login，引导我确认浏览器授权码；只有我明确确认登录授权时才执行 auth approve。
 最后告诉我用户名、个人主页地址，以及如何查看收件箱和私聊。"""

{msgctl-0.2.10 → msgctl-0.2.11}/tests/test_profile_display.py

@@ -4,6 +4,7 @@ from dataclasses import replace
 
 import httpx
 import pytest
+from test_oauth import browser_login, oauth as oauth
 from test_service import call, register
 
 from msg.core.codec import canonical
@@ -177,3 +178,45 @@ async def test_profile_bio_social_links_counts_and_lists_respect_visibility(inst
         assert hidden['follower_count'] == 1 and hidden['following_count'] == 1
         listing = await http.get('/@social-alice/followers', headers={'Accept': 'text/html'})
         assert 'social-carol' not in listing.text
+
+
+@pytest.mark.asyncio
+async def test_old_browser_social_authorization_uses_public_read_without_expanding_ceiling(oauth):
+    from msg.security.oauth import OAuthService
+
+    app, key, subject, http = oauth
+    bk, bob, _ = await register(app, 'old-browser-followed')
+    made = await call(app, 'communication.follow', {'id': bob}, key=key, subject=subject)
+    assert made.status == 'ok'
+    cookie = await browser_login(oauth)
+    async with app.metadata.transaction(write=True) as tx:
+        _, cid, _ = await OAuthService(app).browser_credentials(tx, cookie)
+        original = await tx.credential(cid)
+        narrowed = replace(
+            original,
+            ceiling=tuple(
+                replace(
+                    g,
+                    operations=g.operations
+                    - {'communication.agent_following@1', 'communication.followers@1'},
+                )
+                for g in original.ceiling
+            ),
+        )
+        await tx.save_credential(narrowed, (await tx.subject(subject)).auth_version)
+    html = await http.get('/@oauth-owner/follows', headers={'Accept': 'text/html'})
+    assert html.status_code == 200 and 'old-browser-followed' in html.text
+    assert 'Showing public relationships' in html.text
+    raw = await http.get('/@oauth-owner/follows?format=raw', headers={'Accept': 'text/html'})
+    assert raw.status_code == 200 and raw.headers['content-type'].startswith('text/plain')
+    api = await http.get('/@oauth-owner/follows', headers={'Accept': 'application/json'})
+    assert api.status_code == 403 and api.json()['error']['code'] == 'credential_ceiling'
+    async with app.metadata.transaction(write=False) as tx:
+        assert (await tx.credential(cid)).ceiling == narrowed.ceiling
+        resource = await tx.resource(bob)
+    async with app.metadata.transaction(write=True) as tx:
+        await tx.replace(
+            replace(resource, mode=0o700, generation=resource.generation + 1), resource.generation
+        )
+    hidden = await http.get('/@oauth-owner/follows', headers={'Accept': 'text/html'})
+    assert hidden.status_code == 200 and 'old-browser-followed' not in hidden.text

{msgctl-0.2.10 → msgctl-0.2.11}/uv.lock

@@ -482,7 +482,7 @@ wheels = [
 
 [[package]]
 name = "msgctl"
-version = "0.2.10"
+version = "0.2.11"
 source = { editable = "." }
 dependencies = [
     { name = "cryptography" },