v0.2.1

Overview

v0.2.1 expands registration security and auditability while reducing memory pressure and SQLite write contention under load. It also adds opt-in operational metrics for administrators and aligns the Go module path with the canonical GitHub repository.

Security and registration

• Proof of work is now required for registration. The server issues signed, single-use registration challenges that are bound to the submitted registration data. The browser solves the SHA-256 challenge in a Web Worker before password hashing and account creation begin.
• Challenge issuance is rate-limited. This reduces the cost of automated registration abuse before expensive bcrypt work reaches the server.
• Registration mode is enforced atomically. The authoritative registration policy is read and validated inside the same SQLite transaction as user creation, preventing a concurrent mode change from bypassing disabled or invite-only registration.
• Invite registration no longer leaks username availability. Invite-code existence is checked before username lookup and bcrypt work, while final invite validation and consumption remain authoritative inside the registration transaction.
• Forwarded client IP handling is hardened. Forwarded headers are parsed with bounded work and client addresses are canonicalized, limiting memory amplification from malicious X-Forwarded-For input.

Performance and reliability

• SQLite usage writes are batched asynchronously. Usage persistence now reduces write-path contention without increasing the number of concurrent SQLite writers.
• Search capacity is released before quota rollback. Failed operations no longer hold scarce search capacity while compensating quota state.
• Rate limiter state is sharded and reclaimed incrementally. This lowers lock contention and reduces retained memory after temporary high-cardinality traffic spikes.
• SSE parsing performs fewer allocations. Event processing is byte-oriented, and the per-event limit is separated from the total response budget so complete raw responses are preserved without unnecessary temporary strings.
• Upstream error bodies are bounded. Non-2xx responses can no longer trigger excessive allocation or garbage-collection pressure through oversized response bodies.

Administration and auditability

• Invite-code redemption history is persisted atomically with registration. Audit records retain the redeemed invite code, the created user, and the redemption time.
• Administrators can inspect invite registration history in the panel. The release includes the supporting panel endpoints, pagination, and database migration.
• Invite pagination refreshes after create and delete operations. The panel no longer displays stale or inconsistent pages after invite-code changes.
• Unexpected registration storage failures return server errors. Internal failures are no longer misreported to clients as HTTP 400 validation errors.
• Operational metrics are opt-in. Database and asynchronous usage-writer metrics remain disabled by default and are exposed only after an administrator enables the persisted runtime setting.

Project and release changes

• The Go module path, internal imports, and documented linker flags now use the canonical repository path: github.com/MapleMapleCat/Grok_Search_Mcp.
• The default build version and documented Docker image tag have been updated to v0.2.1.

Upgrade and compatibility notes

• v0.2.1 is intended as an upgrade from v0.2.0.
• The application automatically applies the new invite-code redemption-history migration on startup; no manual database migration is required.
• Browser-based registration handles proof-of-work challenges automatically. Custom clients that call the registration API directly must request, solve, and submit a registration challenge before creating an account.
• Operational metrics remain disabled after upgrade until explicitly enabled by an administrator.
• Go consumers using the previous module path must update imports to github.com/MapleMapleCat/Grok_Search_Mcp.
• The Docker image is published as maplemaplecat/grok-search-mcp:v0.2.1.

Included commits

• 2e1dddc feat(store): improve SQLite write-path throughput and expose contention metrics.
• bab25c1 refactor(grok): reduce SSE parsing allocations while preserving raw responses.
• 7bfd571 fix(grok): limit upstream error response bodies.
• 9a193e0 fix(ratelimit): harden forwarded IP parsing and reduce limiter contention.
• cd72d68 feat(panel): gate operational metrics behind an administrator setting.
• 50673a0 refactor(project): align the Go module path with the GitHub repository.
• 9286570 fix(auth): prevent username disclosure during invite registration.
• e2d62bd fix(auth): enforce registration mode atomically.
• b0044b3 feat(auth): require signed, single-use proof of work for registration.
• 4fc8bc1 feat(invites): add invite redemption audit visibility and panel consistency fixes.
• 1e3abc0 chore(release): prepare version and image references for v0.2.1.

Assets

• grok-search-mcp_0.2.1_linux_amd64.tar.gz: statically linked Linux amd64 binary, README, and license.
• grok-search-mcp_0.2.1_linux_arm64.tar.gz: statically linked Linux arm64 binary, README, and license.
• checksums.txt: SHA-256 checksums for both archives.

Verify downloaded assets with:

sha256sum -c checksums.txt

Full changelog

v0.2.0...v0.2.1