v1.2.0

[1.2.0] - 2026-10-17

Fixed

• With several app instances behind a load balancer, or scheduler replicas
  in distributed mode, a due audit schedule ran once per process and every
  process probed every SLA target. A due audit schedule is now claimed with
  one row update before it runs, a claim lasts one interval and the run
  releases it; each SLA target's poll is claimed the same way, so every
  job runs once across all processes and a process that dies mid-run hands
  its job to another after the interval. The admin guide says how many
  replicas may run (any number; SQLite serves one process).

Security

• AI Sessions now mark alert text, incident descriptions and tool output as
  data in every prompt that carries them, with one plain rule that such text
  is never an instruction. Credential-shaped strings in tool output (keys,
  tokens, private keys, password= values) are redacted before the model,
  the session record and any ticket see them. An alert whose text addresses
  the assistant ("ignore your instructions", "as the AI, run") is flagged on
  the incident and in the audit log at intake and never acted on; what a
  session may do is still decided by the tier gate alone. A corpus of
  injected alerts proves the gate blocks or asks for approval at every tier.
• A model config whose saved key setting is not a variable name (a key
  pasted before such values were refused) is now listed without it, for
  every role, with a not a variable name: edit this config note on the
  Models page; the server logs the config ids at startup, never the values.
• Skill Studio no longer suggests safe for a tool whose name starts with
  explain: an EXPLAIN ANALYZE runs the statement it explains, so such a
  tool is suggested as caution for review.
• An identity provider that publishes a single bare key instead of a key
  set no longer ends a sign-in as a server error when that key does not fit
  the id token; the sign-in is refused like any other bad token.
• A model's key setting must now be the provider's own variable
  (ANTHROPIC_API_KEY, OPENAI_API_KEY, AZURE_OPENAI_API_KEY) or one the
  server operator lists in OPSMENDER_MODEL_KEY_VARS, and the providers with
  a fixed host (anthropic, openai, azure_openai) refuse a base URL
  anywhere else. Before, an admin could name any variable the server holds,
  the token signing secret included, and pair it with any URL, so a model
  setting could send that value to a host of their choosing. The free-URL
  providers (ollama, openai_compatible) keep any URL but may only use
  listed keys. Model configs saved before this change keep working until
  edited.
• A local (stdio) MCP server now receives only PATH, the OS basics and the
  variables its own configuration names. Before, it received every variable
  of the app, so a server (and through it an admin) could read the token
  signing secret or the database URL. A server saved before this change
  keeps receiving everything until an admin saves it again, which the MCP
  page points out; a server defined in OPSMENDER_MCP_SERVERS_JSON inherits
  only with "inherit_env": true. A server that needs KUBECONFIG or
  AWS_PROFILE gets it named in its variables.

Changed

• The MCP SDK moves to 1.30.0, and CI's audit no longer ignores its
  advisory. A remote (SSE or HTTP) MCP server is now followed through a
  redirect only within its own scheme, host and port; any other redirect
  fails the connection with a message naming the other origin, so an
  admin enters that URL if it is the server they mean.
• Every workflow runs on the Node 24 releases of its actions (checkout v7,
  setup-python v7, setup-node v7, upload-artifact v7, download-artifact v8,
  action-gh-release v3, codeql-action v4, setup-uv v10.3.0 (it publishes no
  moving major tag), upload-pages-artifact
  v5, deploy-pages v5, setup-buildx-action v4, build-push-action v7, and
  trivy-action 0.36.0 whose own steps run on Node 24), and the repository
  carries .nvmrc (24) beside the frontend's engines field, so Node 24
  is the minimum everywhere.