Runrail 0.2.0

Recall by meaning, sign-in to remote MCP servers, connectors on more routes,
setup runs that resume, and fixes from a security and robustness audit. Runrail
0.1.1 and 0.1.2 were never released, so this release also brings their changes,
listed below.

• Built on the public Nifra 5.8.0 packages (was 5.3.0), and runrail new
  starters scaffold with create-nifra@5.8.0.
• Recall by meaning. Pick an embedding model on one of your connections and
  memories are embedded in the background with that connection's own key;
  recall then finds a memory that says the same thing in other words, joined
  with the keyword matches. How close counts as the same thing is measured for
  each model when you pick it. Every memory is searched: a one-bit-per-dimension
  code of each is scanned and only the closest thousand are compared in full,
  so at the 50,000-memory limit recall holds about 11 MB. Off until you pick a
  model, and it falls back to keywords when the model does not answer.
• Connectors on Pi and the ACP routes. Copilot, OpenCode, Gemini, and Goose
  start Runrail's connectors MCP server for each session, and Pi loads an
  extension that declares the connector tools with registerTool, so it works
  whatever MCP extension Pi has. Like Codex, these routes cannot ask before a
  tool runs, so they get only the tools whose grant needs no approval.
• Sign in to a remote MCP server in the browser. A server that answers 401
  now reports MCP_SIGN_IN_REQUIRED instead of a transport failure, and
  auth.mcp.start signs in the way the MCP authorization spec describes:
  Runrail registers itself with the server's authorization server, signs in
  with PKCE, and keeps the tokens, bound to that server, in the credential
  vault, renewing them before they run out. A token from bearerEnv that the
  server refuses now reports MCP_TOKEN_REJECTED.
• An MCP server whose authorization server does not let apps register
  themselves, such as GitHub's, signs in with an app you registered:
  auth.mcp.client.set names its app ID and callback port, and its secret goes
  only through POST /secret (mcpClientId) into the credential vault. Such
  a server with no app named reports AUTH_CLIENT_REQUIRED.
• Setup runs pick up where they stopped. An engine started with a setup-runs
  folder saves each run a person started as it goes, and Desktop asks the
  project's engine to take it back after a restart: done steps stay done, the
  step that was mid-turn is marked interrupted, and the next turn is told to
  check where things stand (setup.run.saved, setup.run.restore).
• A setup's budget can cap tokens (budget.maxTokens). Each answered turn
  reports its thread's input and output so far, and a run's status and each
  eval case show the total.
• runrail eval run runs a saved eval suite with no desktop, each case's
  turns in this process on the role's own route, model, and access, into the
  same results Desktop lists; runrail eval list shows them. Up to four evals
  now run at once in a project (was one).

Security

• File tools refuse paths that run programs on their own: .husky,
  .githooks, .codex, .mcp.json, .claude/settings*, .claude/hooks, and
  .vscode/tasks.json. They no longer follow a link swapped in after the check.
• Sign-in to a remote MCP server no longer follows the server to a private
  address, and a damaged OAuth file is set aside instead of overwritten. One
  shared private-address check now serves every fetch that needs it.
• Tool descriptions from an MCP server are capped in length.
• run_command rejects input fields it does not read and drops relative
  PATH entries. The approval card shows the folder the command runs in.
• A Codex tool call must name the turn that is running. The Claude Code route
  reads user settings only. install.sh requires https.

Fixes

• The Linear connector sends your personal API key the way Linear's API
  asks, with no Bearer prefix.
• An MCP server's failed HTTP request fails only itself, and a server that
  forgot your session starts a new one and the call is retried. Tool calls get
  their own 120-second timeout. A reply with audio or resource blocks is noted
  instead of failing, and a tool with a badly formed name is skipped instead of
  failing the whole server.
• runGit returns once git exits, even if a helper holds its pipes open, and
  git in a worktree has a timeout and ends its whole process group.
• search_files, find_files and list_files say when a result is partial
  (truncated, skippedFiles), and search now reaches 8,192 files.
• .env.example is readable, and a project under a .ssh folder is no longer
  refused.
• One plugin or package folder that fails verification no longer stops startup;
  it is listed as unavailable, and plugins reload still reports it.
• The share, push (VAPID), connector and checkpoint stores hold up under
  concurrent writes and damaged files. Device sign-in survives a network blip.
  Live frames, terminal output and transcript reads are faster.