Rel.AI MCP 0.23.0

Standards-compliant MCP lifecycle and recovery

• Use MCP 2026-07-28 through the stable v2 SDK without cutting off ChatGPT. Native stdio and modern HTTP use server/discover plus per-request protocol, client, and capability metadata. HTTP also serves the SDK-supported stateless 2025-11-25 initialize flow used by ChatGPT. MCP-Session-Id, /sse, /messages, JSON-RPC batches, and removed tool aliases remain rejected.
• Keep transport, work-session, native-task, and process identity separate. Every stateless request supplies its authenticated principal; the principal-bound work_id returned by relai_begin_work owns repository work, native taskId owns one asynchronous MCP request, and processId owns one managed process.
• Detect and recover stale client state. Rel.AI fingerprints the canonical tool manifest, serves the current list on every stateless request, invalidates stale credentials, and exposes explicit reconnect or host-action states in the dashboard.
• Publish one 30-tool surface at tool-surface version 27. The public native-Tasks probe, standalone validation-plan tool, named UI-check wrapper, and duplicate protocol routers are removed. Work-scoped schemas require a principal- and workspace-bound work_id; relai_run_checks plans change-aware validation internally.

Task observability, privacy, and runtime integrity

• Sanitize completion summaries before they enter task state. One bounded sanitizer now covers credential-bearing headers, token/password assignments, cookies, secret URL fields, private-key blocks, and approval or authorization codes at completion input, tracker, activity, persistence, historical-read, dashboard, SSE, and copy/export boundaries.
• Use one canonical task state machine. New writes no longer emit inactive or attention; historical aliases normalize on read, terminal states share one predicate, stale updates cannot reopen terminal work, and terminal timestamps, reasons, counters, and partial progress are preserved.
• Add explicit cooperative cancellation. relai_cancel_work targets the exact work session, is idempotent, preserves partial progress, bypasses the workspace lock, records a bounded reason, and signals supported process-backed operations without claiming every external side effect can be reversed.
• Report real validation and diagnostics progress. Known workflows establish a deduplicated denominator before execution, advance after every check, identify failures and timeouts, persist midpoint progress, and never present failed or cancelled work as successful 100% completion.
• Detect repository/runtime skew without locking the workspace. Status, MCP discovery, dashboard data, and packaged metadata compare application, protocol, tool-surface, tool-count, schema, and manifest-hash values. A mismatch remains visible with restart or reconnect guidance, but it is advisory: every tool stays available so Rel.AI can always finish or repair edits to its own checkout.
• Add production-path regression and acceptance infrastructure. Security tests inspect raw persisted history and every dashboard projection, real Electron Chromium acceptance covers task states, keyboard reachability, 200%/400% zoom, and accessibility, and the machine-readable observability benchmark executes both backend and isolated Electron renderer workloads while failing incomplete runs.
• Normalize historical state without destructive migration. Existing inactive, attention, and related aliases remain readable through evidence-based mapping; sanitized canonical records are used in memory and on subsequent persistence.
• Centralize and verify status-color semantics. Tasks, validation, native Tasks, processes, workspaces, connection layers, diagnostics, application updates, and Electron status surfaces now share one status-to-tone classifier: normal progress is information blue, success is green, intervention is amber, failure is red, and inactive terminal state is neutral. Exhaustive dark/light contrast and status-matrix tests prevent silent fallback or cross-screen disagreement.
• Stop terminal sessions from appearing to run forever. Failed, inactivity-cancelled, expired, blocked, approval-paused, and validation-failed tasks now render explicit static end or action-required states instead of an indeterminate loading animation. Terminal history also discards stale active-call and running-operation projections.
• Fail closed on native-task storage faults. Request validation, task unavailability, record corruption, and filesystem failures now use separate typed errors; protocol responses never expose host paths, corrupt records move out of the active task directory, and pruning reports quarantined records.

Durable local coding runtime

• Add managed persistent processes. ChatGPT can start, read, write to, stop, and list long-running commands through stable process IDs, cursor-based logs, process-tree termination, ownership checks, crash-safe metadata, and a dedicated dashboard Processes page.
• Remove proprietary deferred-operation, probe, and validation-wrapper tools. The canonical catalog contains 30 tools; defer, operationTaskId, operation polling, relai_native_tasks_probe, relai_validation_plan, and relai_ui_check are no longer public. Persistent commands use relai_process_*, while selected long-running operations use native MCP Tasks or bounded direct execution.
• Add managed Git worktrees. Rel.AI creates isolated branches under its managed worktree root, registers dynamic workspace aliases, inherits workspace policy, refuses unsafe removal, and preserves branches by default.
• Expand code intelligence and validation. Private local hybrid semantic search, symbol/import/caller/test tracing, normalized diagnostics, internal content-bound validation planning, reverse-impact analysis, and affected-test selection are available through the public tool surface.

Security, telemetry, and caching

• Harden OAuth as an issuer-bound OAuth 2.1 flow. Dynamic registrations, authorization codes, access tokens, and refresh tokens are bound to the active issuer and exact resource; redirects are exact, PKCE S256 is mandatory, scopes accumulate safely, refresh tokens rotate, reuse is rejected, public issuers require HTTPS, and approval-token replacement revokes registrations and grants. Authorization codes and bearer tokens are persisted under SHA-256 identifiers rather than plaintext map keys.
• Add OpenTelemetry tracing with W3C propagation. MCP requests, logical tasks, tools, workspace queues, managed processes, validation, and OAuth operations emit sampled, redacted spans without file contents, credentials, environment values, approval material, or full command lines. Active W3C trace context propagates into managed child processes.
• Stop forwarding the service environment into repository commands. A shared process-environment policy passes required platform variables, rejects NODE_OPTIONS and Electron Node mode, and requires explicit configuration for additional inherited values.
• Add revision-aware private resource caching. Discovery, tool, and resource responses use bounded TTLs and invalidate when configuration, workspace state, or the tool surface changes.

Runtime and release modernization

• Require Node.js 24 LTS and npm 11. Root and Electron manifests declare the runtime policy, npm is pinned through packageManager, and CI uses immutable action commit SHAs.
• Update and exact-pin the release-critical stack. Electron remains at 43.2.0, electron-builder is pinned to 26.15.3, electron-updater is pinned to 6.8.9, MCP SDK packages are pinned to 2.0.0, and globals moves to 17.8.0.
• Harden Electron packages before publication. Setup and recovery pages use the restricted relai-app://renderer protocol; packaged binaries disable RunAsNode, NODE_OPTIONS, CLI inspection, and extra file-protocol privileges while requiring integrity-validated ASAR loading.
• Make Windows releases signed and attributable. Publication requires protected Authenticode credentials and valid signatures, generates a CycloneDX SBOM, and creates GitHub build-provenance and SBOM attestations.
• Make generated assets and module direction enforceable. CI regenerates and diffs color assets, browser UI source has an explicit ESM package scope, and a module-system audit prevents CommonJS growth or mixed modules before the coordinated backend and Electron hard cutover.
• Make native MCP Tasks selective and production-facing. Stateless HTTP and stdio discovery advertise the Tasks extension; relai_exec, relai_diagnostics_run, and relai_run_checks are task-eligible, process tools retain process semantics, clients without Tasks support receive bounded synchronous results, and both transports enforce task polling, update, cancellation, capability, and principal ownership.
• Add a release-blocking native Tasks matrix. A machine-readable gate covers HTTP/stdio capability negotiation, strict modern envelopes, stateless ChatGPT initialization, adaptive direct/native execution, notification no-response behavior, server identity metadata, lifecycle and persistence, input idempotency, cancellation cleanup, process independence, principal isolation, the 30-tool public surface, and dashboard terminal states.
• Reduce the published npm package to an explicit runtime allowlist. The package now ships only the CLI, service source, dashboard assets, examples, type boundaries, README, and license, reducing the dry-run artifact from 418 entries and about 4.09 MB to 194 entries and about 0.57 MB compressed.
• Remove build-only SDK files from the Electron runtime. Packaged MCP and telemetry dependencies exclude source, test, TypeScript, declaration, and source-map trees; final resources/ size is 45.36 MiB and packaged connector acceptance verifies the reduced runtime.
• Make dependency and package budgets release-blocking. Production Knip models the shipped CLI, backend, dashboard, Electron main, and renderer entries; production npm audits must remain clean; the build-tool audit accepts only one expiry-bound build-only advisory graph; and package size fails above the strict 3% tolerance.
• Publish one exact updater artifact contract. Installer, portable, and blockmap names are version-derived and canonical; latest.yml must name the exact installer and match its SHA-512 bytes; SHA256SUMS.txt and the release asset list must cover the same basenames before publication.
• Invalidate derived release evidence on every rebuild. A completed Electron release promotion removes stale checksums, asset lists, SBOMs, and size reports before new evidence is generated, preventing old metadata from authenticating newly built executables.

Color-system ESM hard cutover

• Replace the temporary CommonJS color module with one build-time ESM manifest. The generator imports src/ui/colorTokens.mjs directly; runtime CommonJS code consumes generated assets rather than an interop bridge.
• Delete every legacy CSS alias. Dashboard and Electron component styles now use semantic --ui-* properties directly, and automated checks reject the removed shorthand names.
• Serve generated OAuth styling as a static asset. Authorization and error pages link /public/oauth.css, removing duplicated inline CSS and runtime palette imports.
• Keep release packaging lean. The build-time manifest is not shipped as a backend resource; packaged verification requires the generated OAuth and Electron renderer styles instead.

Bundled ngrok provenance and antivirus handling

• Keep the one-installer experience while making ngrok deterministic. Rel.AI bundles reviewed ngrok 3.39.10, pins its exact size and SHA-256, validates the upstream Authenticode publisher and issuer, packages the provenance manifest, and records ngrok in the CycloneDX SBOM.
• Move ngrok upgrades into signed Rel.AI releases. The writable managed copy is restored whenever it differs from the packaged hash; ngrok self-update checks and remote management are disabled so executable bytes cannot drift independently after installation.
• Make release signing fail closed. The protected Windows workflow enables forceCodeSigning and separately verifies the installer, portable executable, unpacked Rel.AI executable, and packaged ngrok identity before publication.
• Document component-level antivirus triage. Release candidates are scanned as separate Rel.AI and ngrok samples, Trojan classifications block publication pending investigation, and generic ngrok PUA/PUP results follow vendor false-positive submission instead of concealment or separate user downloads.

Active-controller build safety

• Prevent development builds from deleting their own controller. Electron records its live PID, executable, resource, application, and working-directory paths in a non-secret runtime marker; packaging and cleanup reject any target tree that contains those active files.
• Centralize Electron packaging in a fail-closed wrapper. electron:build and electron:dist run validation and electron-builder with --publish never, never execute generated installers or applications, and preserve an installed controller when it lives outside the build output.
• Fix Windows packaging under Node 24. The wrapper invokes pinned JavaScript CLI entrypoints through process.execPath instead of spawning npm.cmd or npx.cmd, avoiding the Windows spawnSync ... EINVAL failure without enabling a command shell.
• Eliminate the combined-target executable rename race. Release packaging creates win-unpacked once, validates it, then produces NSIS and portable artifacts sequentially with --prepackaged; parallel targets can no longer race to rename the same electron.exe.
• Tolerate transient Windows build-directory locks. Guarded cleanup uses bounded fs.rmSync retries before failing with an actionable lock diagnostic; it never kills processes or bypasses active-controller protection.
• Stage release builds outside the VS Code workspace. Electron Builder now works in an OS-temporary directory and atomically promotes completed artifacts into dist. A VS Code-held legacy app.asar is preserved, while the current unpacked application is published under dist/unpacked-builds and recorded in dist/current-unpacked.json instead of failing the release.
• Make package verification follow the promoted build. Layout, connector-acceptance, signature, and bundled-ngrok checks resolve the authoritative unpacked directory. Fuse verification now requires the exact executable path and refuses implicit selection, preventing a stale dist/win-unpacked build from satisfying the gate.
• Block production-identity installer lifecycle work while Rel.AI is active. Install, update, uninstall, and replacement operations are reserved for an explicitly stopped controller or an isolated release machine.
• Isolate development and test servers from the production connector profile. Programmatic servers on an ephemeral port ignore saved launch state and cannot rewrite connection.json, preventing validation runs from repointing the active app or ChatGPT endpoint.

Breaking upgrade behavior

• Do not restore old aliases, sessionful protocol routes, or color-token aliases. Modern clients negotiate MCP 2026-07-28 through server/discover and send current metadata on every stateless request; the HTTP endpoint separately accepts ChatGPT's SDK-supported stateless initialize flow.

Validation

• Workstream-specific release, dashboard, audit, updater, dependency, and benchmark tests passed; aggregate npm run test:all remains the final concurrent-workstream reconciliation gate
• npm run audit:production - zero production advisories
• npm run audit:packaging - only the expiry-bound reviewed build-only advisory graph accepted
• npm run knip:production - shipped runtime dependency model passed
• npm run benchmark:observability - 18/18 mandatory backend and renderer metrics passed
• npm run release:check
• npm run electron:build
• npm run electron:dist - canonical NSIS installer, portable executable, blockmap, update metadata, and promoted unpacked directory generated
• npm run verify:packaged -- --dir <current-unpacked> - packaged TypeScript/source exclusions verified
• Electron fuse verification passed against the packaged executable
• Packaged OAuth/MCP connector acceptance passed
• Strict 0.23.0 package-size baseline passed: 106.26 MiB installer, 95.39 MiB portable, 346.61 MiB unpacked, 45.36 MiB resources/
• CycloneDX SBOM generation passed
• npm pack --dry-run - 194 entries, 567,887 bytes compressed, 1,712,287 bytes unpacked

Bump root/electron/status UI/lockfiles to 0.23.0.