drush-mcp v0.4.0

Fixes

Upload scheme now follows the site. drupal_file_attach stores the file in the target field's uri_scheme and drupal_file_upload in the site's system.file default_scheme, matching Drupal's own upload widget. Previously both defaulted to public:// regardless of the field, which on private-files sites wrote sensitive attachments where the web server serves them without any access check. Pass scheme only to override.
drush-mcp.yml is actually loaded when the server starts without transport/host flags, and --config <path> is honoured. Before, the CLI parser always produced a site, so the file's sites: block (and with it per-site file_upload settings) was never read.

The TypeScript side no longer sends --scheme=public by default. Sites that relied on the old implicit public default while their fields or default_scheme are private will see uploads move to private://, which is the intended location. Requires the bridge at the same version: bump bloomidea/drush-mcp-bridge to ^0.4 (Composer's ^0.x is patch-only, so "^0.1 || ^0.3 || ^0.4" for cross-minor).

npm install -g @bloomidea/drush-mcp@0.4.0
composer require bloomidea/drush-mcp-bridge:^0.4