AI Server Commander v1.0.8

OAuth persistence

• Persistent OAuth clients and token state through OAUTH_STATE_PATH
• Atomic state replacement with mode 600
• Client secrets, authorization codes, access tokens and refresh tokens stored only as SHA-256 hashes
• Access and refresh tokens survive normal restarts
• Refresh-token rotation and /oauth/revoke
• Public PKCE and confidential-client compatibility
• Fail-closed behavior for malformed or symlinked state
• Exact loopback redirect validation

Dependency modernization

• Removed LocalTunnel and its pinned vulnerable Axios chain
• Removed Inquirer in favor of Node's built-in readline setup
• Upgraded Firebase Admin to the latest Node 20-compatible v13 release
• Reduced runtime audit from 15 findings / 3 high to 8 moderate / 0 high / 0 critical
• CI now fails on high or critical runtime audit findings

Migration

• Existing LocalTunnel users must move to a maintained reverse proxy or tunnel and set productionDomain
• Deployments upgrading from v1.0.7 or earlier require one new MCP authorization because previous OAuth state was memory-only
• Preserve the same OAUTH_STATE_PATH across future releases to retain client authorization

Validation

• CI passed on Node 20 and Node 22
• Clean install and full suite passed in the OpenClaw container
• Clean install and full suite passed on the TOS host with Node 20
• Restart, rotation, revocation, public-client, confidential-client, corrupted-state and raw-token persistence tests passed