Coding Tools MCP v0.7.0

Coding Tools MCP v0.7.0 — stable release. Supersedes v0.6.0 and the 0.7.0 release candidates (rc.1 / rc.2 / rc.3).

• Source: 36e0c265a2bb5f93fe61a504468bf584706519e2 (36e0c265), branch release/final-0.7.0, tag v0.7.0
• Integration: https://github.com/Eswink/coding-tools-mcp/actions/runs/40813239118 (SUCCESS 7/7)
• Packaging (structural gates): https://github.com/Eswink/coding-tools-mcp/actions/runs/40814802175 (SUCCESS 13/13 jobs). The Linux packages (DEB/AppImage) were built on Ubuntu 22.04 and install-accepted on Ubuntu 22.04 and 24.04 (deb + AppImage). Windows NSIS passed standard-user installed acceptance.
• All binary assets come from packaging run 40814802175. Nothing was built locally. The Docker kit is a deterministic git archive of the tagged commit.
• The Windows NSIS installer is unsigned. There are no macOS assets in this release.

Changes since rc.3

• Version files bumped from 0.7.0-rc.3 to 0.7.0. The application code is otherwise identical to rc.3 (15820f17).
• The packaging version gates (rc_version_gate, rc_packages, rc_native_gate, rc_windows_install.ps1) accept a strict stable x.y.z version on a separate stable channel. The release-candidate regex is unchanged; an RC version cannot pass the stable channel and vice versa. The Debian package version for stable is 0.7.0 (RC builds keep x.y.z~rcN).
• Pre-tag inverse / admission / topology pins and the reviewed-source manifest regenerated for 0.7.0.

Upgrading from v0.6.0

• Windows: run MCP_0.7.0_x64-setup.exe (per-user NSIS installer, unsigned: SmartScreen may warn; check the sha256 first). It installs over v0.6.0 or any 0.7.0 RC.
• Linux: sudo apt install ./MCP_0.7.0_amd64.deb upgrades in place; or replace the AppImage and chmod +x it.
• Cloud gateway: load the new image, update CTM_GATEWAY_IMAGE in .env to the image ID below, then docker compose up -d and ctm_docker.py check. Desktop and gateway should be upgraded together.
• In the desktop app, Settings → General → "检查更新" now reports v0.7.0.

Desktop assets

File	sha256
MCP_0.7.0_amd64.deb	64341529d69d89204757eea34ea0c6d6ab2097807acad64eebecd26756ed2197
MCP_0.7.0_amd64.AppImage	34793babb5eb485d74676ff697263fa31dae0d714f7dfbeb12e2885fb970e7db
MCP_0.7.0_x64-setup.exe (unsigned)	8fa1bc2fcd2fd3a2f81ea7e2de606d4b083e8acc412e5964af38e9f4bdf148e6

Verify with sha256sum -c SHA256SUMS.txt. That file also covers cloud-linux-amd64.tar.gz.

Cloud assets

• cloud-linux-amd64.tar.gz (137cfa80b5d601b5ff18341d49a59c5968e8459d126dfa2aefb0c9adcc445f7b) is the Linux amd64 cloud binary bundle (gateway / control-gateway / mcp-gateway / agent). It comes with archive-receipt.json and versions.json. Verify with SHA256SUMS-cloud.txt.
• coding-tools-gateway-image-0.7.0.tar is the CI-built gateway runtime image (OCI archive, untagged). It is the same bytes as packaging artifact rc-cloud-image-build/cloud-image.tar: sha256 04d4c59ab88a33aeb2dcafe6162debe18c9f344a4a0d789e91602fafc8847fee. Verify with sha256sum -c coding-tools-gateway-image-0.7.0.tar.sha256.
  • Labels: org.opencontainers.image.version=0.7.0, org.opencontainers.image.revision=36e0c265a2bb5f93fe61a504468bf584706519e2.

Docker deployment (deploy/cloud-gateway/docker)

• Kit: coding-tools-gateway-docker-kit-36e0c265.tar.gz, sha256 4cb586324fa27db03ec2f3c869f991555b38a7d24a9bfb89d313b8329bba4867. Verify with sha256sum -c SHA256SUMS-docker-kit.txt.
  • The uncompressed tar is gzip-independent, sha256 429e77ec957d317b2e9116a0cf412b1b0643e651052f1c609a137369e93c739d. Reproduce it with:
    git -c tar.umask=0022 archive --format=tar --prefix=coding-tools-gateway-docker-kit-36e0c265/ 36e0c265a2bb5f93fe61a504468bf584706519e2 deploy/cloud-gateway/docker | gzip -n -9
• Load the image with docker load -i coding-tools-gateway-image-0.7.0.tar. The image ID must be sha256:9246a4faed40a41cbd5dce52d4e9f7a2c743e97501543c1f83b2edcae653db7b.
  • Put that ID into .env as CTM_GATEWAY_IMAGE=sha256:9246a4faed40a41cbd5dce52d4e9f7a2c743e97501543c1f83b2edcae653db7b.
  • Pin CTM_POSTGRES_IMAGE / CTM_INGRESS_IMAGE by @sha256: digest. Never use latest or any mutable tag.
• Deployment order is mandatory: init → desktop device registration → up -d.
  1. ctm_docker.py setup
  2. invite-device → desktop prove-enrollment → redeem-device → select-device. This is required at least once: without a registered and selected device the gateway refuses to start (provisioning_not_ready).
  3. docker compose up -d + ctm_docker.py check.
• PostgreSQL --auth-local=trust applies only to the in-container Unix socket. All network (TCP) connections require scram-sha-256 password auth, and postgres has no published port and sits on an internal-only network.
• See the kit's README.md for details.

Rollback behaviour

• The desktop app has no auto-updater. "检查更新" is a manual button that reads releases/latest from the GitHub API and only shows a dialog / opens the release page. Nothing is downloaded or installed automatically, and versions.json is not read by the desktop app.
• If Latest is ever switched back to v0.6.0, users already on 0.7.0 see "当前已是最新版本" and stay on 0.7.0 (no downgrade prompt, no automatic downgrade); v0.6.0 users stop seeing an update. Any fix would ship as 0.7.1 or later. Tags are never deleted.

Known issues

These CI failures also occurred on rc.2 (bdc4aeb) and rc.3 (15820f1), in the same workflow and the same job. They are baseline and not regressions. The v0.7.0 runs are from draft PR #169 on 36e0c26; rc.3 from PR #168; rc.2 from PR #165.

• #150 pre-tag composition checks: "Exact pre-tag adopter composition and hermetic evidence" and "Pre-tag data contracts" fail the same 3 tests as rc.2 and rc.3 (303 tests, failures=3): rc_pretag_composition_tests…test_exact_tracked_tree_modes_and_scope, rc_pretag_join_once_tests…test_protected_scope_versions_runtime_and_old452_are_unchanged, rc_pretag_publication_tests…test_protected_source_versions_gates_workflows_and_old_452_are_unchanged. v0.7.0 Exact 40813462384 / Pre-tag 40813462373; rc.3 40668439974 / 40668440208; rc.2 40425933081 / 40425933207.

• Cloud gateway identity contracts: job portable (windows-2025) (O_NOFOLLOW unavailable on Windows; "absolute private render directory required"). v0.7.0 40813462331 / rc.3 40668439869 / rc.2 40425933125.

• Cloud gateway standalone service: job process-and-browser (Chromium TargetClosedError, acceptance_error). v0.7.0 40813462430 / rc.3 40668440034 / rc.2 40425933365.

• Native Ubuntu Rust contract suites — NATIVE_ROOT_UNAVAILABLE. On Ubuntu runners, call_tool_contract fails 20 of 22 tests with NATIVE_ROOT_UNAVAILABLE (tests/common/mod.rs:137/148); the matching Windows jobs pass. Affected jobs:

  • Local authority bridge contracts: rust (ubuntu-24.04) (rust (windows-2025) passes). v0.7.0 40813462489 / rc.3 40668440102 / rc.2 40425933071.
  • 固定入口源码验证v1: rust (ubuntu-latest). v0.7.0 40813462417 / rc.3 40668440040 / rc.2 40425933021.
  • 发布候选验证v4: Rust完整基线 (ubuntu-latest). v0.7.0 40813462486 / rc.3 40668440147 / rc.2 40425933440.
  • Desktop mandatory Linux sandbox acceptance: native (ubuntu-24.04). v0.7.0 40813462457 / rc.3 40668440163 / rc.2 40425933209.
  • Cloud execution bridge native gates: Native desktop drain (ubuntu-24.04), portable (ubuntu-24.04), portable (windows-2025), postgres. v0.7.0 40813462379 / rc.3 40668439843 / rc.2 40425933133.

• 固定入口源码验证v1 frontend: TypeScript error TS5112. Same job failed on rc.3 40668440040 and rc.2 40425933021; v0.7.0 40813462417.

• Cloud gateway protocol laboratory (impact), which failed on rc.2/rc.3, passes on v0.7.0 (40813462423).

• Frontend npm advisory: GHSA-gcqx-w48m-w2h4 / CVE-2026-93753, deepmerge ≤ 4.3.1 prototype poisoning (low).

  • Scope: dev-only. deepmerge 4.3.1 is pulled in only by the build toolchain (@sveltejs/vite-plugin-svelte → @sveltejs/kit → @sveltejs/adapter-static). npm audit --omit=dev reports 0, and the gate requires that 0. It is not shipped in the desktop bundle. No patched deepmerge release exists.
  • The frontend audit gate (scripts/rc_npm_audit_gate.py) accepts exactly this advisory and its 3 via-chain dev packages, all low.
  • The exemption expires on 2026-11-30 (UTC); from 2026-12-01 00:00 UTC (08:00 UTC+8) newly captured audits fail the gate. Expiry is judged by the recorded captured_at in npm-audit-capture.json, not the verification date: evidence captured on or before 2026-11-30 stays valid; any re-capture after that fails unless the full audit is zero again. Handled on the 0.7.x maintenance line.

• Evidence metadata cosmetic: packaging evidence JSON still records build_kind / release_candidate = "release-candidate" for this stable build. It does not appear in any asset name; to be renamed on the maintenance line.

• New stable-channel gate tests not wired into CI: scripts/rc_npm_audit_gate_tests/rc_stable_channel_tests.py (17 tests) and the 14 audit gate tests pass locally but no workflow runs them yet.

• npm_vulnerability_count counts only non-exempted advisories (it is 0 although the full audit lists the 4 exempted low dev entries); rename tracked separately.

• v22 300-file cap has zero margin. The frozen Windows standard-user acceptance (scripts/Windows标准用户验收v22.py) rejects more than 300 top-level scripts/*.py + package.json; v0.7.0 is at exactly 300. Any new top-level script fails Windows acceptance; this is fixed first in 0.8.0 work.

• The Windows installer is unsigned. macOS is out of scope for v0.7.0.

0.7.0-rc.3 — pre-release, NOT FINAL

0.7.0-rc.3: pre-release, NOT FINAL. This is an engineering candidate and is not QUALIFIED (eng ≠ QUALIFIED ≠ FINAL). It is not latest; v0.6.0 remains Latest.

• Source: 15820f1787bc79eba4df3943f513ebb3e6f60a0b (15820f17), branch release/full-rc-candidate-0.7.0-rc.3
• Integration: https://github.com/Eswink/coding-tools-mcp/actions/runs/40668440265 (SUCCESS 7/7)
• Packaging (structural gates): https://github.com/Eswink/coding-tools-mcp/actions/runs/40670735891 (SUCCESS 13/13). The Linux packages (DEB/AppImage) were built on Ubuntu 22.04 and install-accepted on both Ubuntu 22.04 and 24.04 (deb + AppImage). Windows NSIS passed standard-user installed acceptance.
• All assets come from packaging run 40670735891. Nothing was built locally.
• The Windows NSIS installer is unsigned. macOS is not part of rc.3.

Changes since rc.2

• Windows build fix (MSVC dead_code / clippy).
• Frontend npm audit gate (scripts/rc_npm_audit_gate.py), shared by the packaging gate and the downstream evidence verifiers. Advisory expiry is judged by the recorded capture time (npm-audit-capture.json).
• The gate tests moved to scripts/rc_npm_audit_gate_tests/ so that the frozen Windows v22 acceptance inventory stays at its 300-file cap.

Desktop assets

File	sha256
MCP_0.7.0-rc.3_amd64.deb	1f0bc5f12a61b70aa4b333e7432a40c2ac74bf75c78a66071f61c1a85e1afe0e
MCP_0.7.0-rc.3_amd64.AppImage	ae62d96eb4452ac9ded17267101512361d393af7366fa93eb9bdeb5e3f3d0c61
MCP_0.7.0-rc.3_x64-setup.exe (unsigned)	a360b3d69ed1fc03479a393375a880f986f4f55f1ca6bfdb5ad06634ee73fbee

Verify with sha256sum -c SHA256SUMS.txt. That file also covers cloud-linux-amd64.tar.gz.

Cloud assets

• cloud-linux-amd64.tar.gz (607e8ac51d2553765aa8f787bc7af98c016d9579a550daddaa63cde01d00b4e6) is the Linux amd64 cloud binary bundle (gateway / control-gateway / mcp-gateway / agent). It comes with archive-receipt.json and versions.json. Verify with SHA256SUMS-cloud.txt.
• coding-tools-gateway-image-0.7.0-rc.3.tar is the CI-built gateway runtime image (OCI archive, untagged). It is the same bytes as packaging artifact rc-cloud-image-build/cloud-image.tar: sha256 30a53cb777a583c0b8ee2fbf37c3b71dbceb2522be6d8f2862ca8e6038a4f5c0. Verify with sha256sum -c coding-tools-gateway-image-0.7.0-rc.3.tar.sha256.
  • Labels: org.opencontainers.image.version=0.7.0-rc.3, org.opencontainers.image.revision=15820f1787bc79eba4df3943f513ebb3e6f60a0b.

Docker deployment (deploy/cloud-gateway/docker)

• Kit: coding-tools-gateway-docker-kit-15820f17.tar.gz, sha256 c437af808cb23745363e80aa77b7dd71ceeb70ade1c069b7bd71c5ca0ef4b32f. Verify with sha256sum -c SHA256SUMS-docker-kit.txt.
  • The uncompressed tar is gzip-independent, sha256 d8f64a752b9501126a9bcbcb0a5213a0e1de3128160458643187974cbaa49b17. Reproduce it with:
    git -c tar.umask=0022 archive --format=tar --prefix=coding-tools-gateway-docker-kit-15820f17/ 15820f1787bc79eba4df3943f513ebb3e6f60a0b deploy/cloud-gateway/docker | gzip -n -9
• Load the image with docker load -i coding-tools-gateway-image-0.7.0-rc.3.tar. The image ID must be sha256:9baa7b9a4a47c0bd9c17c19625cb9af4e818b39e1af1a371072bae272192b424.
  • Put that ID into .env as CTM_GATEWAY_IMAGE=sha256:9baa7b9a4a47c0bd9c17c19625cb9af4e818b39e1af1a371072bae272192b424.
  • Pin CTM_POSTGRES_IMAGE / CTM_INGRESS_IMAGE by @sha256: digest. Never use latest or any mutable tag.
• Deployment order is mandatory: init → desktop device registration → up -d.
  1. ctm_docker.py setup
  2. invite-device → desktop prove-enrollment → redeem-device → select-device. This is required at least once: without a registered and selected device the gateway refuses to start (provisioning_not_ready).
  3. docker compose up -d + ctm_docker.py check.
• PostgreSQL --auth-local=trust applies only to the in-container Unix socket. All network (TCP) connections require scram-sha-256 password auth, and postgres has no published port and sits on an internal-only network.
• See the kit's README.md for details.

Known issues

These CI failures also occurred on rc.2 (bdc4aeb), in the same workflow and the same job. They are baseline and not regressions in rc.3. The rc.3 runs are from draft PR #168 on 15820f1 (earlier e8c4ee6 and 133043c runs failed the same jobs); the rc.2 runs are from PR #165 on bdc4aeb.

• #150 pre-tag composition checks:

  • "Exact pre-tag adopter composition and hermetic evidence" and "Pre-tag data contracts" fail the same 3 tests as rc.2 (rc.2 runs 40425933081 / 40425933207):
    • rc_pretag_composition_tests…test_exact_tracked_tree_modes_and_scope
    • rc_pretag_join_once_tests…test_protected_scope_versions_runtime_and_old452_are_unchanged
    • rc_pretag_publication_tests…test_protected_source_versions_gates_workflows_and_old_452_are_unchanged
  • rc.3 Pre-tag: 40668440208 (303 tests, failures=3).
  • rc.3 Exact: 40668439974 (303 tests, failures=3). See CI3-DIGESTS.md.

• Cloud gateway identity contracts: job portable (windows-2025). rc.3 40668439869 / rc.2 40425933125.

• Cloud gateway protocol laboratory: job impact. rc.3 40668439986 / rc.2 40425933108. rc.2 additionally failed contracts (ubuntu-24.04) and contracts (windows-2025), which pass on rc.3.

• Cloud gateway standalone service: job process-and-browser. rc.3 40668440034 / rc.2 40425933365.

• Local authority bridge contracts: job rust (ubuntu-24.04). rc.3 40668440102 / rc.2 40425933071.

• 发布候选验证v4: job Rust完整基线 (ubuntu-latest). rc.3 40668440147 / rc.2 40425933440.

• 固定入口源码验证v1: jobs frontend, rust (ubuntu-latest). rc.3 40668440040 / rc.2 40425933021.

• Desktop mandatory Linux sandbox acceptance: job native (ubuntu-24.04). rc.3 40668440163 / rc.2 40425933209.

• Cloud execution bridge native gates: jobs Native desktop drain (ubuntu-24.04), portable (ubuntu-24.04), portable (windows-2025), postgres. rc.3 40668439843 / rc.2 40425933133.

• Frontend npm advisory: GHSA-gcqx-w48m-w2h4 / CVE-2026-93753, deepmerge ≤ 4.3.1 prototype poisoning (low).

  • Scope: dev-only. deepmerge 4.3.1 is pulled in only by the build toolchain: @sveltejs/vite-plugin-svelte 7.3.1, then @sveltejs/kit, then @sveltejs/adapter-static. It is not a production dependency: npm audit --omit=dev reports 0, and the RC gate requires that 0. It is not shipped in the desktop bundle.
  • No patched deepmerge release exists. GitHub reviewed the advisory on 2026-10-28 05:34 UTC+8, after rc.2 packaging.
  • The RC frontend audit gate (scripts/rc_npm_audit_gate.py) accepts exactly this advisory and its 3 via-chain dev packages, all at severity low. Any other advisory, package or severity fails the gate.
  • The exemption expires on 2026-11-30. From 2026-12-01 (UTC) the gate fails unless the full audit is zero again, e.g. after an upstream deepmerge or vite-plugin-svelte release.
  • The packaging gate records the audit's capture time (npm-audit-capture.json in the package contracts, hash-bound into identity.json). The downstream evidence verifiers (final_rc_evidence, rc_consumer_contracts) use the same gate rule and judge expiry by that recorded capture time, not the time of verification. Evidence captured on or before 2026-11-30 therefore stays valid after that date, and new evidence captured from 2026-12-01 is rejected.
  • Details are in AUDITFIX-DIGESTS.md, AUDITGATE-DIGESTS.md and AUDITGATE2-DIGESTS.md.

• rc_npm_audit_gate_tests not yet wired into CI; follow-up after rc.3. The 14 gate unit tests passed locally on 133043c (scripts/rc_npm_audit_gate_tests.py) and on 15820f1 from their new path (scripts/rc_npm_audit_gate_tests/rc_npm_audit_gate_tests.py), but no workflow runs them yet. Packaging runs the gate CLI itself, and it passed in run 40670735891 on 15820f1. A follow-up issue draft is in ISSUE-DRAFT-audit-gate-ci.md.

• npm_vulnerability_count counts only non-exempted advisories; rename tracked separately. In the rc.3 package contracts this field is 0 even though the full npm audit reports the 4 exempted low-severity dev entries (GHSA-gcqx-w48m-w2h4). The full report and capture are preserved as npm-audit.json / npm-audit-capture.json.

• v22 300-file cap has zero margin; must be handled before next release. The frozen scripts/Windows标准用户验收v22.py hashes the top-level scripts/*.py (non-recursive) plus package.json and rejects more than 300 entries. 133043c had 301 (300 tracked top-level .py, of which 59 have non-ASCII names, plus package.json) and failed Windows NSIS acceptance in packaging run 40660783985. rc.2 had 297. 15820f1 moves only the gate tests into scripts/rc_npm_audit_gate_tests/, which brings the count to exactly 300. Packaging run 40670735891 on 15820f1 passed Windows NSIS standard-user acceptance at 300. Any further top-level scripts/*.py will fail Windows acceptance again. Details are in WINCOUNT-DIGESTS.md and CI3-DIGESTS.md.

macOS is out of rc.3 scope.

0.7.0-rc.2

PRE-RELEASE — NOT FINAL

eng≠QUALIFIED≠FINAL

• tip: bdc4aeb51abf191e9cbca2fd1b84ee26b4674b2b (bdc4aeb5)
• packaging (structural gates): https://github.com/Eswink/coding-tools-mcp/actions/runs/40428267551 — SUCCESS 13/13
• integration: https://github.com/Eswink/coding-tools-mcp/actions/runs/40425933329 — SUCCESS 7/7
• Windows NSIS installer is unsigned

Assets: DEB + AppImage + NSIS + SHA256SUMS only. Do not treat as QUALIFIED or FINAL.
Cloud assets (added after publication, same packaging run 40428267551 @ bdc4aeb, product 0.7.0-rc.2): cloud-linux-amd64.tar.gz (Linux amd64 cloud binary bundle: coding-tools-gateway / -control-gateway / -mcp-gateway / -agent) and cloud-image.tar (gateway runtime image, untagged; after docker load -i cloud-image.tar reference it by image ID sha256:7e69b9ade56ce598264f23f3504e465670a6f2c0119293f04937645963b2ee3a), plus archive-receipt.json, versions.json, image-archive.sha256; verify with SHA256SUMS-cloud.txt.

gateway-v0.1.0-rc.1（网关部署包预发布，未经端到端测试）

网关部署包预发布 gateway-v0.1.0-rc.1（未经端到端测试）

这一版只包含云网关的部署包（kit、RUNBOOK、模板、渲染脚本，以及 CONNECT-CHATGPT-AND-DESKTOP.md 接入说明），来源 commit 是 e43728285af66beac7807376ff7764c708c2b631（分支 feat/gateway-s1-agent-resilience）。它不是正式版，也不是 latest。

附件和校验

• coding-tools-gateway-deploy-kit-e4372828.tar：规范哈希以这个文件为准，sha256 是 260bdbedd5c7ff1c402c5ef1028f92cb183f7caadc09f1f736104536430ab3d2
• coding-tools-gateway-deploy-kit-e4372828.tar.gz：sha256 是 7d001ea55deea715f2ecf1eaf9ec1039bae5a11c331b271431c107fffd6b7e97。它的哈希取决于 gzip 的实现，所以校验时以 .tar 为准。
• SHA256SUMS.txt

复现命令（在仓库里运行）：

git -c tar.umask=0022 archive --format=tar \
  --prefix=coding-tools-gateway-deploy-kit-e4372828/ e43728285af66beac7807376ff7764c708c2b631 \
  deploy/cloud-gateway/kit deploy/cloud-gateway/runtime_topology.py \
  deploy/cloud-gateway/render.py deploy/cloud-gateway/current_nginx_include.py \
  deploy/cloud-gateway/Dockerfile.runtime deploy/cloud-gateway/CONNECT-CHATGPT-AND-DESKTOP.md \
  > coding-tools-gateway-deploy-kit-e4372828.tar
gzip -n -9 -c coding-tools-gateway-deploy-kit-e4372828.tar > coding-tools-gateway-deploy-kit-e4372828.tar.gz

网关镜像

网关镜像使用 v0.7.0-rc.2 release 里的 cloud-image.tar。用 docker load 导入后，请按镜像 ID sha256:7e69b9ade56ce598264f23f3504e465670a6f2c0119293f04937645963b2ee3a 引用，不要按 tag 引用。

已知限制（使用前请务必阅读）

• 这个组合没有经过端到端测试：没有在真实 VPS 上测过，也没有接 ChatGPT 实测，只通过了 CI 里的容器拓扑测试（issue40 run 40484373103，26 个 case）。
• rc.2 的二进制不包含 S1（agent 断线恢复相关的改动）。
• 网关不支持动态客户端注册（DCR）：客户端需要先用 register-client 预登记。ChatGPT 能否接受这种方式还没有验证。
• 没有 Windows 版 coding-tools-agent：目前只有 Linux amd64 版，Windows 设备还没有经过验证的生成密钥方法。
• --domain 必须由用户自己填写：换成自己的域名，示例值不能直接用。

v0.7.0-rc.1 — pre-release (NOT FINAL)

coding-tools-mcp 0.7.0-rc.1 — PRE-RELEASE（NOT FINAL）

对应提交 24b8b7559582e74c2f788bc750a92f14d94321b6（tree 9fad1878a1d44430447e88e8c89ec337da9e1eee）。仅限预发布试装：这不是 FINAL，不是安全或最终批准，也不是 latest。

验证情况

• publisher-native QUALIFIED @24b8b755：run 39019249916（publisher-native 85+300 + fingerprint≡tip）。
• Linux eng run 39022811061：cargo test 751 passed / 0 failed；ubuntu-22.04 / 24.04 × deb / AppImage 四个安装 job 均 passed:true, stages:12, exclusive-refresh-v1。
• Windows eng run 39022811053：cargo test 696 passed / 0 failed。

已知事项

• Windows 安装包未签名，运行时可能出现 SmartScreen 提示。
• hermetic-executor 红（rc_pretag_windows_launch_cases 缺失）为已知评审裁决 C，不挡 QUALIFIED。
• Linux build-evidence 中 relro、native_linker_consumption、retained_glib、installed_desktop_bytes 四个诊断项为 false，属 engineering-only 已知项。
• FINAL 仍缺 final-rc-packages 与 dot-rc-integration 完整链路。

文件与 SHA256

670af7cb3763b8a643d345c8f64b3cabd6047883de2d8cb25c60de2ec7229915  MCP_0.7.0-rc.1_amd64.deb
a9a6534e765da59eaa01479ea08bfbc2fd4130eb9300a1f6dc6cf6562d2217d5  MCP_0.7.0-rc.1_amd64.AppImage
760e3f58c0bbb475fd9802591637cc46ea4788be9c508079c89559a3cfc4e80b  MCP_0.7.0-rc.1_x64-setup.exe

安装前请对账（sha256sum / Get-FileHash）。

安装

• DEB：sudo apt install ./MCP_0.7.0-rc.1_amd64.deb
• AppImage：chmod +x MCP_0.7.0-rc.1_amd64.AppImage && ./MCP_0.7.0-rc.1_amd64.AppImage
• Windows：运行 MCP_0.7.0-rc.1_x64-setup.exe

v0.6.1-rc.1 — Desktop local-machine validation

0.6.1-rc.1 桌面实机测试预发布

这是桌面本地验证版本，不是整个云网关/本地 Agent 路线图的完成版。未接通的云端业务派发、Windows 原生沙箱、Hooks、受管 worktree、快照回滚不属于本包已交付能力。完整项目的发布清单和阻断状态保持不变。

包含的变化

Ubuntu 的远程 exec_command、异步命令与执行健康检查现在必须在宿主持有的工作区中建立 Landlock/seccomp 隔离。缺少内核能力、工作区绑定或有效本地授权时拒绝执行，不回退到无沙箱。现有任务的本地撤销/暂停规则保留：拒绝新工作，既有工作排空或由本地用户取消；重启不自动重放不确定操作。

Linux 上的 Git 状态/diff/log/show/blame 和 Harness 的 Git 辅助查询使用有界只读沙箱，禁止工作区写入和网络；外部 diff、textconv、fsmonitor 不会获得宿主权限。

Windows 包用于验证既有授权、独占会话、暂停/恢复及任务兼容性，不宣称具有操作系统级文件系统或网络沙箱。桌面旧 tty=true 仍是管道会话；库级原生 PTY 不等于桌面已接入 PTY。

安装条件与限制

Ubuntu 包面向 x86_64 Ubuntu 24.04 图形桌面和普通用户。内核需支持 Landlock ABI >=3、seccomp、openat2、close_range。容器、自定义内核和旧内核可能缺少能力；此时命令失败是拒绝默认行为，不要以 root 启动或关闭隔离规避。系统运行时可只读访问，工作区外写入和网络拒绝。需要网络的依赖安装、下载、Git fetch/push 不在本次隔离执行支持范围内；请在受控本地终端准备依赖后再测试。

Windows x64 需要 WebView2。GitHub Windows Server 2025 自动测试不替代 Windows 10/11 实机观察。包可能未进行 Authenticode 签名；签名状态以构建来源记录为准，不要把校验和当作代码签名。

选择独立测试项目，不要将整个主目录、系统目录或含真实密钥的目录作为工作区。外置 .git 管理目录或跨工作区 worktree 可能被只读 Git 边界拒绝。

先核对，再安装

从同一预发布中取得适合系统的安装包与 SHA256SUMS.txt，核对文件摘要：

Get-FileHash .\MCP_0.6.1-rc.1_x64-setup.exe -Algorithm SHA256

sha256sum MCP_0.6.1-rc.1_amd64.deb
sha256sum MCP_0.6.1-rc.1_amd64.AppImage

与清单中同名条目逐字比较，并查看 BUILD-INFO.json 的 source_sha、source_tree、run_id 和平台范围。版本字符串本身不是源码一致性证明。校验通过后停止旧客户端，使用 NSIS、DEB 或 AppImage 正常安装/启动。测试前备份项目文件及现有配置，避免在重要项目上首次验证。

建议实机观察

1. 窗口正常启动；安全存储不可用时显示锁定恢复界面，不能变成明文保存。确认应用版本为 0.6.1-rc.1。
2. 用测试工作区和新会话发起授权，仅在本地桌面批准所需权限。未批准或另一会话不得执行；不要在聊天中发送密码、令牌或私钥。
3. Ubuntu 运行简单工作区脚本，核对子进程结果的 sandbox_required 与 sandbox_enforced 为 true。内置 pwd/echo 等不创建子进程的诊断不能作为沙箱证明。
4. 使用专门的临时测试文件验证工作区外读写、越界符号链接和回环网络拒绝；不要用真实私密文件做探针。Git 只读命令应正常返回，不能执行项目配置中的外部帮助程序。
5. 提交有界异步任务后断开客户端再读取结果，检查没有重复提交或重放。测试本地暂停/恢复、取消及退出/重启后的恢复提示。不要把撤销理解成已承诺任务从未执行。
6. 记录系统/内核、安装包摘要、应用版本、测试步骤、结果与脱敏日志。真实 ChatGPT 与网络拓扑表现需要由实机观察决定，本包没有声称这些验证已通过。

回退与反馈

停止候选客户端后替换回既有稳定版程序。保留工作区与持久授权/恢复账本；不要删除恢复锁、恢复旧授权账本或清除不确定任务来强行解锁。需要时在本地重新授权并按界面确认任务状态。此版本不修改生产 VPS、DNS、Nginx、云端凭据或 main 分支。

自动验证说明仅涵盖对应源码与安装包的 CI 结果，不是独立安全认证。完整云网关正式发布仍需完成未交付工程和另行验收。

v0.6.0 — Ubuntu secure-storage recovery · Windows / Ubuntu

v0.6.0 — Ubuntu secure-storage recovery · Windows / Ubuntu

This stable release promotes the exact 0.6.0-rc.4 product bytes that passed the full Linux/Windows automated gates and the real affected-machine Ubuntu 24.04 operator gate.

Linux secure-storage startup now handles the real split-session D-Bus condition and the fresh-profile condition where Secret Service is reachable but has no persistent default collection. Recovery remains fail-closed: existing encrypted configuration is never reset or silently re-keyed, no plaintext fallback or raw master-key file is used, and background MCP/Actions/tunnel/chat-approval services remain blocked until secure configuration is Ready.

Identity note: this is intentionally a metadata-only stable promotion. The downloadable installers remain byte-for-byte the accepted RC4 artifacts, so their filenames and embedded/package version remain 0.6.0-rc.4. Rebuilding only to change the embedded version would invalidate the operator-accepted product bytes.

Windows and Ubuntu x86-64 packages are included. macOS is not included. The Windows installer is not commercially code-signed and may show an unknown-publisher warning.

v0.5.0 — 新版桌面控制台 · Windows / Ubuntu

v0.5.0 — Windows / Ubuntu 正式 Release

本次按维护者明确要求，将已公开并验收的 v0.5.0 晋级为正式 Release / Latest，不再使用 Pre-release 作为当前发行类型。正式状态以 Release 页面和 stable-promotion-receipt.json 为准。

不变的发布来源

产品提交：63261e0c9ae4b0c6befdbe5ae8caff7f5d32c076。Git tree：01b11a1088d82501a1e579801ce6ac774ab5d43a。

Release ID：388174565。本次仅改变发行名称、说明、正式版标记及 Latest。三个安装包、四个配套附件、版本标签和原发布分支全部保留原身份及字节。后续 README / 发行工具提交与产品提交分开，不将更新后的 main SHA 冒充安装包源码。

系统	文件
Windows x64	MCP_0.5.0_x64-setup.exe
Ubuntu 22.04 / 24.04 amd64	MCP_0.5.0_amd64.deb、MCP_0.5.0_amd64.AppImage

下载位置：v0.5.0 七个原始附件。安装和连接步骤见本仓库 README。不要使用上游仓库安装包替代本分支版本。

界面和交互

五页面统一深蓝侧栏、分区卡片、语义状态及浅色/深色/跟随系统主题；保留已有路由、真实后端能力和原生窗口行为。完善保存后草稿状态、切换时迟到结果保护、密钥部分读取失败的禁用处理及审批框焦点。相对 v0.4.0，产品 Rust、IPC API 包装和依赖图不变；不伪造参考图中尚未实现的设置。

OAuth 与本机聊天批准仍分开。默认按工作区独占、指纹核对、权限缩减、Refresh Token 轮换和重放检测、旧任务排空、90 秒待审批截止及重启后重新批准保持不变。需要刷新令牌时客户端请求 mcp offline_access，不启用 OIDC。

已有验收与晋级检查

原构建 34810770540 的十六个源码、构建、安装前置作业通过：Windows 432、Ubuntu 417 项 Rust 测试，两端各 180 项前端；40 张页面矩阵截图、10 项交互、8 种状态；五种安装组合各 20 张原生截图和 12 个原生安全阶段。原生与模拟 IPC 浏览器证据分开记录。

原发布作业在附件已公开后，立即读取标签收到 404，因此原工作流整体仍是 failure。这个失败不会被重写。只读验证 34812656272 随后成功复算验收并匿名核对七个公开附件。

本次晋级再次使用原源码、原证据及未修改的验收器复算上述门禁，核对原工作流身份和结果，晋级前后匿名下载七个附件并校验 SHA-256。晋级写操作仅限本 Release 的元数据，不执行重新打包、上传、删除或修改 Git ref。晋级后确认 draft=false、prerelease=false、Latest 指向 v0.5.0。

安装、升级与真实边界

Windows 安装前退出旧程序，备份配置及系统账户密钥恢复材料；包未商业签名，可能出现未知发布者提示。Ubuntu 使用普通登录桌面用户和可用、已解锁的 Secret Service，不使用 sudo 启动 GUI。DEB 为优先推荐方式，AppImage 自动验收范围为 extract-and-run。

升级不需要删除工作区或历史。不要同时运行两个版本写同一配置，不要在旧任务未结束时强制释放排空状态。完整重启需重新本机批准聊天。回退使用保留的 v0.4.0 和兼容备份。

v0.5.0 内置更新检查仍指向上游，请从 Eswink/coding-tools-mcp 的 Release 下载更新。 本次元数据晋级不改变这个编译期行为。

正式发行不扩大验收证据：真实 ChatGPT 账号长期自动刷新、系统通知横幅、所有硬件/FUSE/Wayland、macOS/ARM/无桌面环境并未全部验证。会话隔离不是逐聊天独立操作系统沙箱。未合并的独立 PR #11 不包含在本版，线上 Nginx 和用户凭据未改动。

原附件 Verification_v0.5.0.md、Release-scope_v0.5.0.json 中的 Pre-release 字样，是晋级前构建阶段的不可变记录，只在发行渠道描述上由本说明及当前 Release 状态取代；其测试、来源和限制仍有效。不能通过覆盖附件消除这个时间差异。

Stable promotion summary (English)

v0.5.0 is promoted to a full Release and Latest under the maintainer's explicit authorization. The seven existing assets and product source 63261e0 remain unchanged. Documentation/tooling commits are not binary-source revisions. Promotion recomputes original source/UI/native gates, verifies the original failed publication run and its successful prerequisites, and anonymously checks every public asset before and after a metadata-only PATCH. The original pre-release verification attachments remain intact as build-time records. Windows is unsigned; real-account long-duration ChatGPT refresh, OS notification banners and untested graphics/hardware platforms retain their stated limits. The built-in v0.5.0 updater still targets upstream; use this fork's Release links.

v0.4.0 — 独占会话与可配置刷新 · Windows/Ubuntu预发布

v0.4.0 — 独占会话与可配置刷新（Windows / Ubuntu 预发布）

本版交付默认独占聊天、全局本机审批、持久化轮换刷新令牌和用户可填写的有效期。发布流程要求同一源码、同一工作流中的双平台完整回归，以及 Windows NSIS 和 Ubuntu 22.04/24.04 DEB/AppImage 五种安装组合各十二个原生验收阶段通过；原始记录和具体计数见随包 Release-scope_v0.4.0.json、Exclusive-evidence_v0.4.0.zip。不是所有环境无缺陷的稳定版声明。

**验收边界：**原生测试操作真实安装程序、WebView、HTTP OAuth/PKCE/刷新和本机审批，使用明确标记的合成 OAuth 凭据及会话元数据。真实 ChatGPT 账号的会话元数据投递、长时间自动刷新和操作系统通知横幅的实际显示仍需本地联调；不把它们记为 CI 已通过。没有关闭沙箱，没有 Windows 延期验收路径。

安装与升级

安装前在原程序中停止或取消运行任务，确认不再写入工作区，然后退出程序并备份应用配置及工作区。保留密钥存储，勿删除配置目录来“修复”授权；不要把密钥、令牌、完整配置或真实工作区上传到 issue。

Windows x64：运行 MCP_0.4.0_x64-setup.exe。安装包未配置商业代码签名，可能提示未知发布者；核对仓库来源与 SHA-256 后再决定是否运行，勿关闭系统安全策略。已验证普通用户原生审批，不要求把日常应用提升为管理员。

Ubuntu 22.04/24.04 amd64 推荐 DEB：

sudo apt install ./MCP_0.4.0_amd64.deb

或使用 AppImage：

chmod +x MCP_0.4.0_amd64.AppImage
./MCP_0.4.0_amd64.AppImage

桌面程序应以普通用户启动，不使用 sudo。AppImage 保留现有受限兼容入口，不应通过禁用 WebKit 沙箱解决运行问题。

将全部七个发布附件放在同一目录，Ubuntu 用 sha256sum -c SHA256SUMS_v0.4.0.txt 核验清单所列六个文件；Windows 用 Get-FileHash .\MCP_0.4.0_x64-setup.exe -Algorithm SHA256 对照清单。校验和文件不自校验。GitHub 公开附件摘要还会由发布流程匿名下载复核。

如何使用独占授权

打开对应工作区，启用 OAuth 并启动 MCP。仅在需要远程操作的 ChatGPT 聊天中明确申请 request_chat_authorization。选择插件本身并不是服务端可观察到的授权动作；收到带有效身份及会话信息的申请后才预留独占权。

前台应用显示全局审批框；在其他设置页面也能查看。核对聊天返回的指纹，取消不需要的权限，勾选指纹确认，然后点击“批准并独占”。后台可通过托盘及待审批收件箱进入，系统通知受系统设置影响；没有通知横幅时不要等待它，直接打开程序的待审批入口。

A 获准后，B/C 请求会被拒绝，不创建新待审批记录，不触发新审批提示，也不替换 A。服务器不能移除 ChatGPT 其他窗口的插件菜单。更换聊天必须在本机主动撤销当前授权，待旧任务结束后，再从新聊天申请。

撤销或租约到期只阻止后续调用，不回滚已发生的操作。存在运行中任务或交互进程时保留 draining 状态，直至任务结束或本机取消；程序异常退出后发现未确认的任务，会保留恢复锁，必须在本机检查并处理，不能直接清除文件强行转交工作区。

可填写的时长

对应工作区的“远程会话安全”中保存设置：

设置	默认值	范围
默认独占聊天	开启	可在本机更改
访问令牌有效期	60 分钟	5–480 分钟
刷新会话有效期	30 天	1–90 天
独占聊天授权有效期	24 小时	1–720 小时
空闲自动释放	0（关闭）	关闭或 30–1440 分钟
待审批请求	90 秒	固定

访问令牌有效期不是“ChatGPT 必定刷新一次的间隔”；何时发起刷新由客户端决定。刷新不延长独占租约、不产生审批、不改变会话归属。保存策略可能使现有授权失效并应用运行配置，界面确认后再保存；新时长用于新签发令牌和新批准租约，既有 refresh family 的绝对期限不自动延长。

刷新令牌强制轮换，旧令牌重用会撤销所属 family 及关联访问令牌。并发刷新或响应丢失可能因此要求重新登录；没有不安全的旧令牌宽限重放通道。桌面重启后刷新身份可恢复，但本地聊天批准必须重新进行。

从 v0.3.2 重新建立长期连接

旧版 access-only 授权不会凭空变成 refresh session。升级后让客户端重新获取 OAuth metadata 并完成一次新的授权。发现文档声明 authorization_code / refresh_token；长期连接的授权请求需要包含 mcp offline_access，并在服务端授权页面明确允许离线刷新。offline_access 不是文件或执行命令权限；本地 scopes 仍单独审批。

服务器 URL 保持 https://research-system.eswlnk.com/mcp；Client ID、Secret 和精确 Callback URL 必须与本机配置一致。注册 URL 留空；这不是 OIDC 服务，不开启 OIDC、不加 openid profile email。应用已有缓存 metadata 时可能需要重新创建连接，让它读取新 metadata。不要在聊天中传递 Client Secret 或密码。

先确认三个公网 /.well-known/oauth-... 地址都返回 JSON，再测试真实 ChatGPT 的 A 授权/B 拒绝/刷新后继续 A。Nginx 和隧道仍由现有部署配置负责；本版安装程序不会自动修改公网 Nginx。PR #11 的额外公网诊断修复保持独立，不冒称已包含。

OpenAI 的刷新与 metadata 配置说明（外部参考，不是本项目真实账号验收证据）：https://help.openai.com/en/articles/12584461

回滚与已知边界

回滚前停止本版、撤销本版授权和刷新会话，恢复备份配置并安装原版本。旧版本不认识的新存储不要删除或覆盖，保留用于诊断。工作区和历史归档不应为回滚授权而被清空。

单一会话授权不是操作系统容器：真实工作区文件仍然共享，获准执行命令可能访问共享文件。MCP/后台任务也不会让 ChatGPT 网页自动无限执行开发循环；任务持续时间、客户端运行限制与会话租约是独立条件。

本次构建身份

源码：5b1265f6905e2953e32000797a62cfd2f16baa48

文件树：552088e4f965361da6135f3edf1c3ab8a84aa068

工作流：34763767073

v0.3.2 — 聊天授权 · Ubuntu与Windows验收版

v0.3.2 聊天授权 · Ubuntu / Windows 预发布

Windows 原生完整审批：八阶段通过；会话元数据是测试夹具，不是真实 ChatGPT。

源码：a0551c447712104e2c2cb253d3d8a5a966518580；Actions：34689697641。Ubuntu 22.04/24.04 × DEB/AppImage 四组合各八阶段通过。

真实 ChatGPT 双聊天与公网联调尚未验收；未签名包可能显示未知发布者。不是稳定版或全面安全认证。

v0.3.2 OAuth 发现与凭据恢复修复候选

本轮变更及验证范围

本轮修复 MCP OAuth 发现路径、实际运行配置应用和分层诊断，并继续修复凭据表单的异步竞态。密钥写入后服务重启失败时，界面会回读实际保存的值；若回读也失败，则清空并锁定受影响字段，而不是继续展示失效密钥。重新生成过程中，对应凭据表单不继续展示旧值。共享密钥的部分保存失败不会丢弃其他未保存草稿，读取共享身份也不会覆盖私有 Client ID 草稿。

“保存失败”不必然表示配置未落盘。先查看服务运行状态与脱敏错误，按界面回读后的值核对配置，修正重启问题后再启动服务；不要根据旧值重复授权或把密钥发到公开日志。密钥轮换后，外部客户端需要同步新凭据并重新授权。

安装包、五组合原生测试和发布状态必须以对应提交的 Actions 结果及本次 Release 附件为准。本说明文件本身不代表测试通过，也不意味着此候选已经发布。下面的安装命令仅在相应附件实际生成并通过校验后使用。

安装与升级

提供 Ubuntu 22.04/24.04 amd64 DEB、AppImage 和 Windows x64 NSIS。先核对本 Release 的 SHA256SUMS，退出旧程序，再安装。离线保留升级前配置和对应系统用户凭据；仅复制加密配置不能替代系统凭据备份。不要把主密钥、令牌、原始配置或个人文件上传到聊天和公开仓库。降级需恢复升级前备份。

Ubuntu：sudo apt install ./MCP_0.3.2_amd64.deb，从应用菜单启动；或 chmod +x MCP_0.3.2_amd64.AppImage 后以普通用户执行。CI 的 AppImage 使用 extract-and-run，不代表全部 FUSE、Wayland 或 GPU 环境都已验证。

Windows：运行 MCP_0.3.2_x64-setup.exe，以普通用户启动。包未配置商业代码签名时可能提示未知发布者。不要为测试关闭 Defender、WebView2 沙箱或系统访问控制。

原生验收与真实 ChatGPT 的区别

本次交付必须通过 Windows 真实窗口八阶段、实际 NSIS 安装后八阶段，以及 Ubuntu 两系统两种包的安装后八阶段；结果、源码和包摘要以本 Release 附件为准，不采用 v0.3.0 的 Windows 原生延期例外。

CI 使用本机真实 OAuth/PKCE、真实 IPC、窗口点击和真实进程，但两个聊天标识是合成测试数据。真实 ChatGPT 账号授权、真实会话元数据与公网 TLS/穿透入口联调仍须在你的机器核验，不能把 CI 结果冒称真实 ChatGPT 已通过。

授权流程

在本机配置工作区和公网 HTTPS 入口，再让 ChatGPT 连接 MCP 并完成 OAuth。每个新聊天默认没有业务授权。只在目标聊天调用 request_chat_authorization 申请最小范围，随后在桌面聊天授权面板核对工作区、权限和会话指纹并批准。不要发送长期主密钥，也不要批准不能对应到自己操作的请求。

OAuth 登录与聊天批准是两层检查。默认空闲 30 分钟、绝对 8 小时；应用重启后须重新批准聊天。桌面可拒绝、撤销及切换独占模式。

真实客户端本地核验表

以下不是待修的本机自动化测试，而是 CI 无法代表你的账号和公网入口完成的真实客户端核验。每项记录实际结果，不预填通过。

场景	预期	实测
同账号新聊天 A/B，未桌面批准	业务读取/执行均拒绝，仅允许授权状态与申请	待本地核验
只批准 A	A 仅在批准范围可用，B 仍拒绝	待本地核验
B 知道 A 的任务/会话 ID	仍不能读取、继续或取消 A 的资源	待本地核验
A 只读批准后申请写入、命令或自提权	超出授权拒绝，模型不能自行批准	待本地核验
撤销 A 或全部	后续业务调用拒绝	待本地核验
独占模式切换 B	A 失去后续访问，B 仅在其范围可用	待本地核验
重启桌面	按原机制保留 OAuth 凭据，两个聊天均须重新批准	待本地核验
缺失/冲突元数据、失效 OAuth 或错误资源	默认拒绝，不回退匿名或共享主密钥	待本地核验

失败时立即撤销，记录版本、操作步骤、非秘密错误码和脱敏结果；不公开令牌或原始配置。

信任边界

聊天标识不是密码学认证的 ChatGPT 来源；持有有效 OAuth token 的恶意客户端可能构造该元数据。执行权限不是操作系统沙箱：获准聊天在同一工作区共享实际文件。撤销阻止后续访问，不保证自动回滚或终止所有已发出的进程。旧 Actions 业务入口在缺少合格上下文时拒绝，不作为绕过通道。

本版为预发布，不是对全部用户机器或所有平台的安全认证。旧 Release 和既有包不覆盖。

Windows 执行路径与已知限制

本轮追加修复 Windows 扩展 UNC 路径转换：网络根保留为双反斜杠，普通盘符路径兼容性不变，非文件系统设备命名空间不被误转为相对路径。新增字符串转换与调用方契约回归，不冒称已验证用户的 SMB 服务器、网络盘权限或超长路径部署。

历史运行 34684664507 曾出现无初始输入的 PowerShell 命令在 30 秒预算内无输出；后续相同测试通过。本轮保持原有超时预算并增加固定次数的 Windows 命令重复回归，任一次失败都阻止候选验证。该历史间歇性现象尚未确定根因，不能把初始 stdin 修复或 UNC 修复宣称为它的根因修复。故本版仍为预发布；遇到相同情况应保留脱敏命令、时间和错误码，不自动重试可能已有副作用的任务。