Skip to content

v0.1.1

Choose a tag to compare

View all tags
@DanMeon DanMeon released this 21 May 06:20
· 8 commits to main since this release
v0.1.1
b42e1cd

Security

  • redact() now strips both the full HATCHET_CLIENT_TOKEN and its 16-char prefix from external-facing strings, catching truncated log lines and partial header echoes that the exact-substring match in 0.1.0 missed.
  • ConfigError from _parse_bool runs the offending env value through redact() before echoing — a token mis-pasted into HATCHET_MCP_READ_ONLY no longer surfaces in the startup banner.
  • New muzzle_dependency_loggers() forces hatchet_sdk, aiohttp, httpx, httpcore, grpc, and urllib3 loggers to WARNING at server boot, closing the only realistic path by which a downstream LOG_LEVEL=DEBUG could echo Authorization: Bearer <token> headers to stderr.

Docs

  • README: add a 4-step Quick start (token → install → MCP-client wiring → first call) and remove the pre-publish placeholders.
  • Scaffold the v0.2.0/reliability spec (idempotent retry + 30s deadline + structured stderr logs + `get_server_info` diagnostics) with its paired ADR.

Full changelog: v0.1.0...v0.1.1

Assets 2
Loading