v0.1.2 — advisory fixes on top of the security hardening

Supersedes 0.1.1 (npm versions are immutable) with everything from the security-hardening release plus today's dependency-advisory fixes:

• zod 4.6.7 — clears GHSA-mrhx-c7xc-m3w5 (high: memory exhaustion validating oversized constrained collections), with the zod-4 two-argument z.record migration across the schema layer. The full suite (369 tests across 35 files) passes on zod 4.
• body-parser 2.4.0 — clears GHSA-27r3-jxmh-p828 (high: denial of service via trailing bytes after a compressed request body) on the bridge's own HTTP path.
• fast-uri 3.1.9 — clears four moderate URI-parsing advisories (GHSA-w74x-v6f9-j3xg and related) in the OAuth URL path.
• README and docs now link the published npm package and both Grok Bot templates.

npm audit --audit-level=low: 0 vulnerabilities. CI green on Ubuntu and Windows, including the audit gate.

v0.1.1 — security hardening

Security hardening

• MCP session budgets: at most 8 live sessions per principal and 16 total; the owner displaces the least-recently-active foreign session instead of being refused, so one enrolled client can no longer lock the owner out.
• Key separation: OAuth access-token signatures and local owner-approval proofs now use dedicated HKDF subkeys of the stored credential. The static bearer and on-disk format are unchanged; tokens issued before the separation keep working until they expire.
• Managed credential integrity (Windows): the credential file owner and ACL are verified before every read; a tampered file fails closed and rotates. Fresh credentials claim per-user ownership before publishing, which also fixes publishing from elevated processes.
• No-overwrite publication: a concurrent rotation can no longer be silently replaced by the rename fallback.
• Destructive-request denylist: blocks unlink, shred, find -delete, erase, ri, rd /s, extra SSH key types, .npmrc/.netrc/.kube/.docker/.azure/.gcloud/gh-hosts reads, and 8.3 Windows paths; the redactor closes the space-separated-password evasion.
• Tunnel credential hygiene: remote enable rejects tunnel arguments that look like embedded credentials (token flags, API keys, client secrets, bare hex/base64url tokens).
• Replay guard: owner-proof nonce pruning runs on every attempt and the dead duplicate check is gone.
• Process hygiene: NoDefaultCurrentDirectoryInExePath is set so bare executables never resolve from the working directory; CI runs with least-privilege read-only permissions.

Completed work

• scripts/verify.mjs now ships as a fail-closed placeholder referenced by the examples and docs.
• Windows-only tests use honest platform gates; new suites cover the CLI entrypoint, credential publication races, and the expanded denylist.
• Docs state the accepted exposures plainly: the T3 token hand-off through the launcher environment, owner-endpoint locality checks behind tunnels, the shared enrollment rate-limit bucket, POSIX plaintext-at-rest, and the clipboard window of remote copy-token.

Full check: lint, 369 tests across 35 files, and the TypeScript build pass on Ubuntu and Windows.

v0.1.0

Vesper Grok Bot Bridge 0.1.0 — first public release of the standalone CLI/MCP runtime and the publisher source kit.

This tag is 3507cd4. Ubuntu and Windows CI passed on that commit: tests, build, dependency audit, and packaging.

Install the CLI runtime

Requires Node.js 22+, npm, and Git.

npm install -g ./grok-bot-mcp-agent-0.1.0.tgz
grok-agent-bridge setup --repository C:/Code/my-project
grok-agent-bridge doctor

Then follow docs/STANDALONE.md: enroll your repository and verifier, enroll the exact coding CLI and model, expose your own HTTPS gateway, and approve OAuth locally. The archive does not include provider binaries, subscriptions, credentials, or a hosted tunnel.

SHA-256 for grok-bot-mcp-agent-0.1.0.tgz:

968a4bb8914c35a718cef5cb9eeeabaf17bec3f6e612b03b30bf0a7755040bb9

Publisher source kit

grok-coding-supervisor-template-0.1.0.tgz is documentation for preparing the two Grok Bot templates (Vesper — T3 and Vesper — CLI). It is not an npm install and not a native Grok Bot import. Ordinary recipients add a published Bot from Marketplace or a real template link.

SHA-256:

f95a790f8c33052cc5312b8d3d497bbee0aac594ca4c4c32de6c237bf39b2d0a

community-release.json lists both archives, file lists, and the still-empty native template-link fields.

npm publication of grok-bot-mcp-agent@0.1.0 is not in this release yet. Registry sign-in succeeded, and publish stopped because the account requires an authenticator one-time password.