Skip to content

Coding Tools MCP v0.7.0

Latest
Latest

Choose a tag to compare

View all tags
@Eswink Eswink released this 29 Oct 04:53
· 53 commits to main since this release
v0.7.0
36e0c26

Coding Tools MCP v0.7.0 — stable release. Supersedes v0.6.0 and the 0.7.0 release candidates (rc.1 / rc.2 / rc.3).

  • Source: 36e0c265a2bb5f93fe61a504468bf584706519e2 (36e0c265), branch release/final-0.7.0, tag v0.7.0
  • Integration: https://github.com/Eswink/coding-tools-mcp/actions/runs/40813239118 (SUCCESS 7/7)
  • Packaging (structural gates): https://github.com/Eswink/coding-tools-mcp/actions/runs/40814802175 (SUCCESS 13/13 jobs). The Linux packages (DEB/AppImage) were built on Ubuntu 22.04 and install-accepted on Ubuntu 22.04 and 24.04 (deb + AppImage). Windows NSIS passed standard-user installed acceptance.
  • All binary assets come from packaging run 40814802175. Nothing was built locally. The Docker kit is a deterministic git archive of the tagged commit.
  • The Windows NSIS installer is unsigned. There are no macOS assets in this release.

Changes since rc.3

  • Version files bumped from 0.7.0-rc.3 to 0.7.0. The application code is otherwise identical to rc.3 (15820f17).
  • The packaging version gates (rc_version_gate, rc_packages, rc_native_gate, rc_windows_install.ps1) accept a strict stable x.y.z version on a separate stable channel. The release-candidate regex is unchanged; an RC version cannot pass the stable channel and vice versa. The Debian package version for stable is 0.7.0 (RC builds keep x.y.z~rcN).
  • Pre-tag inverse / admission / topology pins and the reviewed-source manifest regenerated for 0.7.0.

Upgrading from v0.6.0

  • Windows: run MCP_0.7.0_x64-setup.exe (per-user NSIS installer, unsigned: SmartScreen may warn; check the sha256 first). It installs over v0.6.0 or any 0.7.0 RC.
  • Linux: sudo apt install ./MCP_0.7.0_amd64.deb upgrades in place; or replace the AppImage and chmod +x it.
  • Cloud gateway: load the new image, update CTM_GATEWAY_IMAGE in .env to the image ID below, then docker compose up -d and ctm_docker.py check. Desktop and gateway should be upgraded together.
  • In the desktop app, Settings → General → "检查更新" now reports v0.7.0.

Desktop assets

File sha256
MCP_0.7.0_amd64.deb 64341529d69d89204757eea34ea0c6d6ab2097807acad64eebecd26756ed2197
MCP_0.7.0_amd64.AppImage 34793babb5eb485d74676ff697263fa31dae0d714f7dfbeb12e2885fb970e7db
MCP_0.7.0_x64-setup.exe (unsigned) 8fa1bc2fcd2fd3a2f81ea7e2de606d4b083e8acc412e5964af38e9f4bdf148e6

Verify with sha256sum -c SHA256SUMS.txt. That file also covers cloud-linux-amd64.tar.gz.

Cloud assets

  • cloud-linux-amd64.tar.gz (137cfa80b5d601b5ff18341d49a59c5968e8459d126dfa2aefb0c9adcc445f7b) is the Linux amd64 cloud binary bundle (gateway / control-gateway / mcp-gateway / agent). It comes with archive-receipt.json and versions.json. Verify with SHA256SUMS-cloud.txt.
  • coding-tools-gateway-image-0.7.0.tar is the CI-built gateway runtime image (OCI archive, untagged). It is the same bytes as packaging artifact rc-cloud-image-build/cloud-image.tar: sha256 04d4c59ab88a33aeb2dcafe6162debe18c9f344a4a0d789e91602fafc8847fee. Verify with sha256sum -c coding-tools-gateway-image-0.7.0.tar.sha256.
    • Labels: org.opencontainers.image.version=0.7.0, org.opencontainers.image.revision=36e0c265a2bb5f93fe61a504468bf584706519e2.

Docker deployment (deploy/cloud-gateway/docker)

  • Kit: coding-tools-gateway-docker-kit-36e0c265.tar.gz, sha256 4cb586324fa27db03ec2f3c869f991555b38a7d24a9bfb89d313b8329bba4867. Verify with sha256sum -c SHA256SUMS-docker-kit.txt.
    • The uncompressed tar is gzip-independent, sha256 429e77ec957d317b2e9116a0cf412b1b0643e651052f1c609a137369e93c739d. Reproduce it with:
      git -c tar.umask=0022 archive --format=tar --prefix=coding-tools-gateway-docker-kit-36e0c265/ 36e0c265a2bb5f93fe61a504468bf584706519e2 deploy/cloud-gateway/docker | gzip -n -9
  • Load the image with docker load -i coding-tools-gateway-image-0.7.0.tar. The image ID must be sha256:9246a4faed40a41cbd5dce52d4e9f7a2c743e97501543c1f83b2edcae653db7b.
    • Put that ID into .env as CTM_GATEWAY_IMAGE=sha256:9246a4faed40a41cbd5dce52d4e9f7a2c743e97501543c1f83b2edcae653db7b.
    • Pin CTM_POSTGRES_IMAGE / CTM_INGRESS_IMAGE by @sha256: digest. Never use latest or any mutable tag.
  • Deployment order is mandatory: init → desktop device registration → up -d.
    1. ctm_docker.py setup
    2. invite-device → desktop prove-enrollment → redeem-device → select-device. This is required at least once: without a registered and selected device the gateway refuses to start (provisioning_not_ready).
    3. docker compose up -d + ctm_docker.py check.
  • PostgreSQL --auth-local=trust applies only to the in-container Unix socket. All network (TCP) connections require scram-sha-256 password auth, and postgres has no published port and sits on an internal-only network.
  • See the kit's README.md for details.

Rollback behaviour

  • The desktop app has no auto-updater. "检查更新" is a manual button that reads releases/latest from the GitHub API and only shows a dialog / opens the release page. Nothing is downloaded or installed automatically, and versions.json is not read by the desktop app.
  • If Latest is ever switched back to v0.6.0, users already on 0.7.0 see "当前已是最新版本" and stay on 0.7.0 (no downgrade prompt, no automatic downgrade); v0.6.0 users stop seeing an update. Any fix would ship as 0.7.1 or later. Tags are never deleted.

Known issues

These CI failures also occurred on rc.2 (bdc4aeb) and rc.3 (15820f1), in the same workflow and the same job. They are baseline and not regressions. The v0.7.0 runs are from draft PR #169 on 36e0c26; rc.3 from PR #168; rc.2 from PR #165.

  • #150 pre-tag composition checks: "Exact pre-tag adopter composition and hermetic evidence" and "Pre-tag data contracts" fail the same 3 tests as rc.2 and rc.3 (303 tests, failures=3): rc_pretag_composition_tests…test_exact_tracked_tree_modes_and_scope, rc_pretag_join_once_tests…test_protected_scope_versions_runtime_and_old452_are_unchanged, rc_pretag_publication_tests…test_protected_source_versions_gates_workflows_and_old_452_are_unchanged. v0.7.0 Exact 40813462384 / Pre-tag 40813462373; rc.3 40668439974 / 40668440208; rc.2 40425933081 / 40425933207.

  • Cloud gateway identity contracts: job portable (windows-2025) (O_NOFOLLOW unavailable on Windows; "absolute private render directory required"). v0.7.0 40813462331 / rc.3 40668439869 / rc.2 40425933125.

  • Cloud gateway standalone service: job process-and-browser (Chromium TargetClosedError, acceptance_error). v0.7.0 40813462430 / rc.3 40668440034 / rc.2 40425933365.

  • Native Ubuntu Rust contract suites — NATIVE_ROOT_UNAVAILABLE. On Ubuntu runners, call_tool_contract fails 20 of 22 tests with NATIVE_ROOT_UNAVAILABLE (tests/common/mod.rs:137/148); the matching Windows jobs pass. Affected jobs:

    • Local authority bridge contracts: rust (ubuntu-24.04) (rust (windows-2025) passes). v0.7.0 40813462489 / rc.3 40668440102 / rc.2 40425933071.
    • 固定入口源码验证v1: rust (ubuntu-latest). v0.7.0 40813462417 / rc.3 40668440040 / rc.2 40425933021.
    • 发布候选验证v4: Rust完整基线 (ubuntu-latest). v0.7.0 40813462486 / rc.3 40668440147 / rc.2 40425933440.
    • Desktop mandatory Linux sandbox acceptance: native (ubuntu-24.04). v0.7.0 40813462457 / rc.3 40668440163 / rc.2 40425933209.
    • Cloud execution bridge native gates: Native desktop drain (ubuntu-24.04), portable (ubuntu-24.04), portable (windows-2025), postgres. v0.7.0 40813462379 / rc.3 40668439843 / rc.2 40425933133.

  • 固定入口源码验证v1 frontend: TypeScript error TS5112. Same job failed on rc.3 40668440040 and rc.2 40425933021; v0.7.0 40813462417.

  • Cloud gateway protocol laboratory (impact), which failed on rc.2/rc.3, passes on v0.7.0 (40813462423).

  • Frontend npm advisory: GHSA-gcqx-w48m-w2h4 / CVE-2026-93753, deepmerge ≤ 4.3.1 prototype poisoning (low).

    • Scope: dev-only. deepmerge 4.3.1 is pulled in only by the build toolchain (@sveltejs/vite-plugin-svelte → @sveltejs/kit → @sveltejs/adapter-static). npm audit --omit=dev reports 0, and the gate requires that 0. It is not shipped in the desktop bundle. No patched deepmerge release exists.
    • The frontend audit gate (scripts/rc_npm_audit_gate.py) accepts exactly this advisory and its 3 via-chain dev packages, all low.
    • The exemption expires on 2026-11-30 (UTC); from 2026-12-01 00:00 UTC (08:00 UTC+8) newly captured audits fail the gate. Expiry is judged by the recorded captured_at in npm-audit-capture.json, not the verification date: evidence captured on or before 2026-11-30 stays valid; any re-capture after that fails unless the full audit is zero again. Handled on the 0.7.x maintenance line.

  • Evidence metadata cosmetic: packaging evidence JSON still records build_kind / release_candidate = "release-candidate" for this stable build. It does not appear in any asset name; to be renamed on the maintenance line.

  • New stable-channel gate tests not wired into CI: scripts/rc_npm_audit_gate_tests/rc_stable_channel_tests.py (17 tests) and the 14 audit gate tests pass locally but no workflow runs them yet.

  • npm_vulnerability_count counts only non-exempted advisories (it is 0 although the full audit lists the 4 exempted low dev entries); rename tracked separately.

  • v22 300-file cap has zero margin. The frozen Windows standard-user acceptance (scripts/Windows标准用户验收v22.py) rejects more than 300 top-level scripts/*.py + package.json; v0.7.0 is at exactly 300. Any new top-level script fails Windows acceptance; this is fixed first in 0.8.0 work.

  • The Windows installer is unsigned. macOS is out of scope for v0.7.0.

Assets 14
Loading