v0.13.1

Security

• Hardened SSRF IP-literal matching for IPv6-mapped forms. The private/loopback/
  link-local guard (isPrivateIP) now parses addresses structurally via ipaddr.js
  instead of regex-matching them, so IPv4-mapped IPv6 addresses are blocked in every
  canonical spelling — including the hex-group form the WHATWG URL parser produces
  (e.g. [::ffff:127.0.0.1] → ::ffff:7f00:1), which the previous dotted-decimal-only
  match let through. Applies to all four guard entry points (checkSSRF,
  checkSSRFSync, the connect-time guardedLookup rebinding guard, and
  checkJitHttpProvisionUrl), closing the bypass for outbound hook URLs and HTTP JIT
  provisioning targets. Public unicast addresses (including IPv4-mapped public
  addresses) are unaffected. Regression tests added.

Fixed

• exec_with_secrets profile description now states the real guarantee. The
  restricted profile's MCP tool description claimed it "limits PATH and inheritable
  env vars"; in fact it denies a fixed list of network-tool binaries, strips proxy env
  vars, and caps runtime — it does not restrict PATH, and interpreters invoked
  directly (python, node, …) can still perform network I/O and read the injected
  secrets. The description now says so and points to OS-level isolation for untrusted
  commands. (No behavior change; a hardened restricted profile follows in 0.14.0.)

Dependencies

• ipaddr.js promoted to a direct dependency (^1.9.1; already present transitively).
  It backs the SSRF address parsing above. The published package's runtime dependency
  set is otherwise unchanged.

v0.13.0

Dependencies

• Fixed GHSA-h67p-54hq-rp68 (js-yaml quadratic-complexity DoS, dev-scope via eslint) with a js-yaml >=4.2.0 override — resolves to 4.3.0.
• Majors: commander 14→15 (CLI verified end-to-end), eslint 9→10 (three findings from newly-default rules fixed in code), @types/node 25→26; GitHub Actions checkout v7, setup-node v6, pnpm/action-setup v6, codeql-action v4.
• Minors: in-range pnpm update across prod + dev deps; vite pin 8.0.16→8.1.4.

Added

• qring has <key> — script-friendly existence check (exit 0 if present, 1 if not; --quiet for exit-code-only, honors --json). Decay-aware like the MCP has_secret tool, closing the last MCP→CLI parity gap.
• Claude Code plugin is now a real installable plugin — added claude-code-plugin/.claude-plugin/plugin.json and a repo-root .claude-plugin/marketplace.json, so it installs via /plugin marketplace add I4cTime/quantum_ring + /plugin install qring@q-ring instead of file copying. Plugin components (agents/commands/skills/hooks) moved from claude-code-plugin/.claude/ to the plugin root to match the Claude Code plugin format; hooks are wired via hooks/hooks.json (${CLAUDE_PLUGIN_ROOT}) for plugin installs and .claude/settings.json for project-scoped sync installs. sync-versions now stamps both new manifests.
• CONTRIBUTING.md — dev environment, branch/commit conventions, and the list of files to keep in sync (parity doc, plugin manifests, dashboard client bundle).
• Docker install instructions in the README for the MCP-server container path.
• CI smoke tests — the built qring binary (--version, --help) and an MCP initialize handshake against dist/mcp.js now run in CI after the build.
• --json is now honored by ~20 more commands — list, inspect, delete, import, audit, audit:verify, health, analyze, recall, check, env, validate (single/--all/--list-providers), rotate, tunnel list, hook list, approvals, scan, lint all emit { ok: true, data: … }, making the whole read surface scriptable. Previously only 4 commands supported the advertised global flag.
• Confirmation prompts on destructive operations — delete, forget --all, teleport unpack (overwriting existing keys), wizard (regenerating existing keys), and env:generate -o (existing file) now ask before proceeding. Pass -y/--yes to skip; non-interactive use without --yes errors instead of silently proceeding. Breaking for scripts that relied on unconfirmed qring delete/forget --all — add --yes.
• Plugin skills are now generated from a single source — cursor-plugin/skills/*/SKILL.md is canonical; scripts/plugin-generate-skills.mjs derives the Claude Code skills and Kiro steering files (pnpm run plugin:gen-skills). Reconciles the cosmetic drift that hand-copying had accumulated.
• CI parity guard (pnpm run check:parity + a parity CI job) — fails when the three plugins' command/agent/skill sets diverge, doc'd MCP tool counts don't match the registered count (44), manifest versions drift from package.json, generated skills are stale, or the committed dashboard client bundle differs from a fresh build.
• Cross-platform CI matrix (experimental, non-blocking) — macOS + Windows on Node 22, ubuntu on Node 24, and a Node 18 engines-floor leg (build + CLI smoke; vitest 4 needs Node 20+). Exercises the per-OS keyring backends for the first time.
• qring doctor — one-shot install diagnosis: keyring-backend round-trip probe (the headless-Linux failure mode), audit-dir writability + hash-chain integrity, .q-ring.json validity, active policy, and qring-mcp on PATH. Supports --json; exits 1 on any failed check.
• qring completion bash|zsh|fish — shell completion scripts generated from the live command tree, so they can never drift from the actual commands/flags.
• Dashboard: entanglement graph — entangled secrets now render as an SVG node/edge graph (circular layout, up to 14 keys; falls back to the pair list beyond that), as the docs always advertised.
• Dashboard: audit-chain badge — the Audit Log card shows hash-chain integrity live (same check as qring audit:verify), green when intact, red with the break position when tampered.
• Tag-driven release automation — pnpm run release:prepare <patch|minor|major|x.y.z> bumps the version, syncs all manifests, rolls the CHANGELOG, and runs the parity guard; pushing the v* tag then runs release.yml, which creates the GitHub Release (notes from the CHANGELOG) and chains the npm/MCP publish and Homebrew update via workflow_call. See docs/releasing.md.
• Docs — docs/troubleshooting.md (keyring backends, MCP connection, approval gate, policy-root pinning, scripting gotchas, AGPL FAQ), per-editor quickstarts (docs/quickstart-{claude-code,cursor,kiro}.md), docs/releasing.md, and a docs index in the README.

Changed

• CLI errors are now one-line messages instead of stack traces — a central handler catches errors thrown by any command (policy denials, keyring backend failures) and prints them in red; set QRING_DEBUG=1 for the full stack.
• pnpm audit moved off the blocking CI path — it runs as a separate non-blocking job, so a freshly disclosed advisory in a transitive dependency no longer fails unrelated PRs.
• npm publish now triggers on release: published (was created), so draft releases can no longer publish; mcp-publisher is pinned to v1.7.9 instead of latest; publish and Homebrew workflows gained concurrency guards.

Fixed

• qring set <key> no longer hangs when the value is piped — promptSecret reads stdin to EOF when it isn't a TTY (e.g. echo "$VALUE" | qring set KEY).
• Homebrew formula test asserted the string "qring" in qring --version output, which prints only the bare version — brew test would have failed on every release. It now asserts the version string.
• Status dashboard actually sends security headers — Content-Security-Policy (default-deny, inline-only), X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: no-referrer (keeps the ?token= URL out of Referer headers), and Cache-Control: no-store on every response. Previously the page was CSP-compatible but no policy was enforced. Added tests for token auth (403) and the new headers.

v0.12.0 — security hardening, dashboard rebuild, dependency patches

🔒 Security hardening

• export_secrets honors the requiresApproval gate on bulk MCP reads
• Governance policy anchored to the MCP server's launch directory (no projectPath escape)
• import_dotenv over MCP no longer reads arbitrary files (content-only)
• SSRF: connect-time re-validation closes the DNS-rebinding window
• Teleport PBKDF2 100k → 210k (legacy bundles still decrypt)
• Status dashboard endpoints require a per-launch token
• Hardened exec network/command guards; policy cache invalidates on .q-ring.json change

📊 Dashboard

• Rebuilt on Preact + htm with VDOM diffing — fixes the flicker/reload-on-update; still a single self-contained, offline page

📦 Dependencies & CI

• Cleared 23 Dependabot alerts; pinned pnpm via packageManager; added Dependabot config + PR template

⚠️ Breaking

• Dashboard returns 403 without its token (use the printed URL)
• A single MCP server now applies only its launch directory's .q-ring.json policy

Full notes: CHANGELOG.md

v0.11.7 — Glama TDQS overhaul

Glama Tool Definition Quality Score (TDQS) overhaul

Every one of the 44 MCP tools now ships a 3-sentence description hitting all six Glama TDQS dimensions:

1. Purpose — what the tool does, in one sentence.
2. Usage guidelines — when to use it, explicitly disambiguated against sibling tools.
3. Behavioral transparency — side effects (mutations, audit logs, network calls), idempotency, and the exact return shape.

The server-level TDQS score weights the per-tool minimum at 40% (60% mean / 40% min), so this release specifically targets lifting the worst per-tool descriptions to drag the floor up.

Changed

• All 44 MCP tool descriptions rewritten using the 3-sentence template.
• commonSchemas (scope, projectPath, env, teamId, orgId) .describe() strings now include formats, defaults, conditional requirements, and concrete examples.
• Per-tool Zod .describe() strings tightened across all 10 tool files.
• README MCP tables resynced with the new one-liners.
• feature-docs-sync.mdc and release-process.mdc rules updated for the moved-out marketing site (qring.i4c.studio).

Notes

• No runtime / MCP wire-format changes. Tool names, parameter names, parameter types, and return shapes are unchanged. Existing agents and integrations will simply see longer, clearer descriptions on the next tools/list refresh.
• After this release publishes, trigger a Glama re-sync from the admin panel so the new TDQS scoring run picks up the improved descriptions.
• Marketing site sync (qring.i4c.studio) ships separately.

Install

npm install -g @i4ctime/q-ring@0.11.7
# or
brew upgrade i4ctime/tap/qring

Verify

qring --version    # should print 0.11.7
qring --help

v0.11.5

See CHANGELOG.md for [0.11.5] — 2026-04-27.

Highlights: Kiro + Claude Code first-party plugins, removal of in-repo web/ marketing app (site at qring.i4c.studio), MCP tool description improvements, npm/MCP publish via tag workflow.

v0.11.0

v0.11.0 — Site overhaul + dashboard rebuild

Changed

• Marketing site overhauled (web/) — replaced the hand-rolled landing/docs/changelog with a full HeroUI v3 + HeroUI Pro implementation backed by Tailwind v4 and lucide-react. New surfaces: hero with social-card art and install picker, TrustStrip KPIs (locale-stable), WhyQRing comparison, IntegrationsCarousel, LiveDemo terminal driving a global ⌘K CommandPalette, AgentMode, CursorPlugin showcase, FAQ, FreeCallout, FinalCta. Docs page gains a pinned Floating TOC with manual scroll-spy and a copy-to-clipboard MCP prompt cookbook. Navbar contrast lifted, custom hash navigation handles same-page anchors and home-link scroll-to-top in App Router. Background tokens darkened for better text contrast over the WebGL backdrop.
• Status dashboard rebuilt — qring status (and the status_dashboard MCP tool) now serves a denser, more useful live page: KPI strip, manifest/policy/approvals/hooks/agent-memory panels, sortable + searchable secrets table, audit-log filters with action + source chips, top-bar pause/refresh/JSON controls, and keyboard shortcuts (/, P, R, Esc).
• Snapshot payload expanded — /api/status and the SSE stream now include version, projectPath, scopes, protectedCount, manifest, policy, approvals, hooks, memoryKeys, and auditMetrics.

Fixed

• Dashboard search input no longer loses focus — the SSE re-render uses a focus-preserving DOM swap that retains caret position, selection, and scroll offset across the 5-second tick.

CI

• Wired HEROUI_AUTH_TOKEN (repo secret) into the Next.js + deploy-pages workflows so the licensed @heroui-pro/react postinstall can fetch its bundle on the runner.

v0.10.1

Patch release — unblock publish pipeline

This patch ships v0.10.0's refactor + security work to npm. The functional source code is unchanged from v0.10.0; the bump exists solely to push a new artifact through the now-fixed publish workflow.

Fix

• publish.yml — removed npm install -g npm@latest step that crashed with Cannot find module 'promise-retry' on the Node 22 runner image. This bug had silently blocked v0.9.9 and v0.10.0 from reaching npm (both were tagged + GitHub-released but never published).
• publish.yml — added workflow_dispatch trigger with optional ref input so a stuck release can be manually re-published from the Actions tab without re-tagging.

Highlights from v0.10.0 (now actually shipping)

• CLI decomposed into nine themed modules under src/cli/commands/.
• MCP tools decomposed into ten focused modules under src/mcp/tools/ plus shared _shared.ts.
• Grouped qring --help with nine glyph-prefixed sections.
• Approval HMAC widened to cover workspace and sessionId.
• JIT HTTP SSRF fails closed on DNS errors.
• Teleport AES-GCM uses 12-byte IVs.
• 164 tests across 24 files.

Installation

npm install -g @i4ctime/q-ring
brew install i4ctime/tap/qring   # via the auto-update workflow

Full changelog: https://github.com/I4cTime/quantum_ring/blob/main/CHANGELOG.md

v0.10.0

Highlights

Security

• Approval HMAC now covers workspace and sessionId; forged/tampered bindings are rejected (new tamper test added).
• ~/.config/q-ring/ created with mode 0o700.
• JIT HTTP SSRF fails closed on DNS errors and blocks non-http(s) URLs.
• Teleport AES-GCM new bundles use a 12-byte IV.
• Shell hooks switched from exec to execFile with bounded stdout buffer.

Decomposition

• CLI registration split into nine themed modules under src/cli/commands/.
• MCP tool registration split into ten focused modules under src/mcp/tools/ plus a shared _shared.ts.

CLI beautification

• qring --help now renders commands under nine glyph-prefixed sections: Secrets, Project, Quantum, Validation & Rotation, Dev Tooling, Audit & Health, Hooks, Agent Memory, Security & Governance.

Docs

• docs/cli-mcp-parity.md — full CLI ↔ MCP command/tool mapping with shared-behavior notes.

Tests

• 164 tests across 24 files (added keyring-lifecycle.test.ts, ssrf-jit.test.ts, workspace/session tamper coverage in approval.test.ts).

Installation

npm install -g @i4ctime/q-ring
# or
pnpm add -g @i4ctime/q-ring
# or (Homebrew)
brew install i4ctime/tap/qring

Full changelog: https://github.com/I4cTime/quantum_ring/blob/main/CHANGELOG.md

v0.9.9

What's Changed

• Release v0.9.9 by @I4cTime in #43

Full Changelog: v0.9.8...v0.9.9

v0.9.8

What's Changed

• Release v0.9.8 by @I4cTime in #40

Full Changelog: v0.9.7...v0.9.8