session-peer v1.0.3

session-peer v1.0.3

This security and stability maintenance release follows v1.0.2. The local/SSH core remains dependency-free on Python 3.9+. Relay and MCP remain opt-in; the Antigravity bridge remains experimental.

Security fixes

All five advisories have no assigned CVE identifier at release preparation. Publication proceeds using their GHSA identifiers.

• GHSA-9x52-82cv-4c22: SSH destinations and the complete supplied option list are validated before OpenSSH runs; remote arguments are shell-quoted.
• GHSA-4rvw-q2vm-v4x3: pairing requires a certificate-backed initial principal or an existing trusted binding for a rotated key.
• GHSA-6xwm-5p7g-8v8q: Relay admission separates invalid paths/connections from session issuance and adds bounded per-source handshake limits.
• GHSA-2hjv-35jg-gghm: hosted Control device-code issuance accepts only the intended client field, caps pending codes and prunes expired records.
• GHSA-646x-xjw9-mf6x: hosted Control blocks bearer-to-cookie credential promotion and enforces cookie/origin checks for approval and login-session management.

Upgrade clients and self-hosted Relay/Control services. Source fixes do not establish deployment of hosted remediation. Existing pairing bindings are not automatically audited or removed: operators must review and revoke/re-pair untrusted bindings. Behind a reverse proxy, configure the authenticated client-source boundary and edge admission limits; many sources can still exhaust the global budget.

Stability and release changes

• SSH preserves valid in-band outcomes and captured timeout responses; uncertain sends remain unknown and must not be automatically retried (#249).
• MCP gives owned wake processes time to clean up before escalation (#250).
• Receiver admission isolates unauthenticated work and bounds cleanup/shutdown (#251).
• PyPI publication requires explicit environment review; scheduled dependency audits run independently of product CI (#252, #253).
• Native messages preserve literal leading dashes and reject excessive Windows command lines before launch (#254).
• Human-readable output escapes terminal control characters while structured JSON preserves data (#255).
• SSH standalone updates verify staged files, serialize replacement, prevent stale downgrades and preserve complete or uncertain commit receipts (#256).
• Standalone installation/update authenticates immutable release assets and provenance; release installation probes verify the isolated installed package (#257).
• Control logins expire absolutely after 24 hours; browser session listing/revocation has an independent rate budget (#258).

Install and upgrade boundaries

Use your existing installation manager. For pipx:

pipx upgrade session-peer
# New Unix / WSL installation with optional Relay and MCP:
pipx install 'session-peer[relay,mcp]==1.0.3'

Core requires Python 3.9+, MCP 3.10+, and Relay receiver/server use Unix or WSL with Python 3.11+. A service-managed receiver needs Codex on its service PATH or an operator-owned codexBin binding. Test with --dry-run before sending.

SSH option compatibility is intentionally narrower: only connection options from the documented allowlist are accepted. Options that execute local commands or select alternate configuration files, such as ProxyCommand, LocalCommand and -F, are rejected. Trusted user-owned OpenSSH configuration remains an operator boundary. Verified standalone installation requires authenticated GitHub CLI attestation verification; there is no fallback to an old unsigned release or development main.

Existing sliding Control sessions are capped at their original creation time plus 24 hours when upgraded and may require immediate sign-in. Device revocation and account login-session revocation are separate; if a device or login credential is lost, revoke both, and revoke all other sessions when the affected login cannot be identified.

Validation and known limits

The release gate checks regressions, documentation/translations, generated source, archives, reproducibility, clean package installations and dependency audits. These are gate requirements, not evidence of a new live four-hour campaign. Historical RC4 validation and its 20/21 independent ACKs belong to v1.0.0. Private advisory fork checks are not a substitute for the release gate on exact integrated public main before publication.

#161 remains open with the public-path stall root cause unconfirmed. posted, queued and submitted are submission evidence, not consumption or ACK. Unknown outcomes never authorize automatic resend. Package publication, hosted remediation, fleet installation and production restarts are separate operations.