identityforge - npm Package Compare versions

Comparing version 0.4.0 to 0.4.1

dist/api.js

 import { randomUUID } from "node:crypto";
 import { resolveApiKey, resolveApiUrl } from "./config.js";
 import { isVersionGreater } from "./updateCheck.js";
-export const CLI_VERSION = "0.4.0";
+export const CLI_VERSION = "0.4.1";
 let apiClient = "cli";
 const clientProcessReference = randomUUID();
+let readDeclaredAgent = null;
 /** Select the client identity used by subsequent API requests. */
@@ -11,2 +12,34 @@ export function setApiClient(client = "cli") {
 }
+/**
+ * Register how to find out which product is driving this process, so API
+ * requests can say so.
+ *
+ * MCP clients send an `Implementation` in the initialize handshake, so when we
+ * run as an MCP server the name arrives unasked: `claude-code`, `cursor-vscode`,
+ * `Codex`, `gemini-cli-mcp-client`.
+ *
+ * This takes a function rather than a value on purpose. The name is only
+ * readable once the handshake has completed, and the obvious push — set it from
+ * the `initialized` notification — silently sends nothing for the whole session
+ * if a client never sends that notification. Reading per request has no such
+ * timing to get wrong: a request can only happen after the handshake.
+ */
+export function setDeclaredAgentSource(read) {
+    readDeclaredAgent = read;
+}
+/**
+ * There is no naming convention across MCP clients — kebab-case, PascalCase,
+ * space-separated and package names all ship today — and the API only records
+ * `^[a-z][a-z0-9][a-z0-9._-]{0,38}$`. Anything that will not survive that is
+ * dropped here rather than sent and silently ignored at the other end.
+ */
+function declaredAgentToken() {
+    const token = (readDeclaredAgent?.() ?? "")
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9._-]+/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .slice(0, 40);
+    return /^[a-z][a-z0-9][a-z0-9._-]*$/.test(token) ? token : null;
+}
 export const EXPORT_FORMATS = [
@@ -120,2 +153,5 @@ "design-md",
         headers["X-IdentityForge-Process"] = clientProcessReference;
+        const agent = declaredAgentToken();
+        if (agent)
+            headers["X-Agent-Client"] = agent;
     }
@@ -122,0 +158,0 @@ const key = resolveApiKey();

package.json

 {
 	"name": "identityforge",
-	"version": "0.4.0",
+	"version": "0.4.1",
 	"mcpName": "io.identityforge/mcp",
@@ -5,0 +5,0 @@ "description": "Agent-native brand naming, domain research, and design systems through one CLI and MCP server.",

README.md

@@ -47,3 +47,3 @@ <p align="center">
 
-[Download the full-resolution 1080p WebM](https://github.com/KasayoDotCom/identityforge-mcp/releases/download/v0.3.9/identity-forge-lifecycle-explainer.webm).
+[Download the full-resolution 1080p WebM](https://github.com/KasayoDotCom/identityforge-mcp/releases/download/v0.4.0/identity-forge-lifecycle-explainer.webm).
 
@@ -172,6 +172,8 @@ ## For agents
 current CLI or MCP process. A successful local apply also sends one bodyless
-completion signal. Neither includes paths, prompts, file contents, repository
-names, or a persistent installation identifier. Set
-`IDENTITYFORGE_TELEMETRY=0` to omit both the process reference and local apply
-signal; ordinary API requests still appear in server access logs.
+completion signal. Running as an MCP server, requests also carry the client name
+your editor or agent already sends in the MCP handshake (`claude-code`,
+`cursor-vscode`, `codex`), so usage can be attributed to a product rather than to
+nothing. None of this includes paths, prompts, file contents, repository names,
+or a persistent installation identifier. Set `IDENTITYFORGE_TELEMETRY=0` to omit
+all three; ordinary API requests still appear in server access logs.
 
@@ -178,0 +180,0 @@ | File | What it is |

New alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

354436

0.56%

Lines of code

5958

0.66%

Number of lines in readme file

551

0.36%

No dependency changes