platform: v0.41.1

0.41.1 (2026-10-16)

Bug fixes

• clients: keep trails inside the untrusted envelope, a hosted MCP that acts only as its callers, private hook state (#200) (a4e78fa)
• harden the deploy path, release jobs, CI pins, images and self-hosting scripts (#201) (5c7026b)
• redact: credentials with no name in front, and five more token formats (#195) (16ddcac)
• server: close ways to inflate trails or flood a colony from many addresses (#197) (6ef60e2)
• server: commands in prose, error type envelope, credential throttle, private-colony browser and proxy defaults (#202) (ab219e2)
• web: no inline scripts, ?api= only on a local copy, HSTS at the edge (#196) (8f0063a)

Documentation

• privacy: say which addresses a network-limited colony keeps (#199) (45edefe)