v0.1.0-rc.15
Pre-release
Pre-release
·
45 commits
to main
since this release
Added
- README-verbs lint gate (#762).
scripts/check-readme-verbs.ts
(wired intopnpm lint) mechanically diffs the README's capability-verb
claims against the registered CLI command tree and fails the gate when
the README advertises a verb the CLI does not ship — a structural
defense against the #751 drift class.
Changed
- MCP README tool catalog recounted: 88 → 129 tools (#769).
packages/mcp/README.mdunderstated the registered MCP surface — it
claimed 88 tools, omitted thesurveysdomain from the per-domain
breakdown, and carried stale per-domain counts. Recounted against the
canonical tool enumeration: 129 tools across 10 domains,surveys
added, per-domain counts refreshed and reconciled to the total.
Docs-only; the README ships in the@ttctl/mcptarball. - Expand npm keywords on the
ttctlumbrella package (#771). Broadened
for registry discoverability ahead of the first stable (toptal,
freelance,mcp-server,model-context-protocol). - CI: Codecov upload moved to a dedicated OIDC coverage job (#761,
#759). The upload now authenticates via OIDC, andCODECOV_TOKENis
scoped to the upload step rather than the whole workflow.
Fixed
- Drop the unshipped
timesheet updateverb from the README (#751).
The root README's Timesheets bullet advertised anupdateverb with no
UpdateTimesheetinvocation in core and notimesheet updateCLI
command; corrected to "list, view, and submit". Restore when #458 lands. - Generate coverage at the repository root so the Codecov upload
delivers (#760). Coverage was produced per-package, leaving the upload
step with nothing to deliver; it is now generated at the root level.
Security
- Disposition the 9 transitive
npm auditadvisories (hono ×7,
ip-address, qs) via a documented allowlist (#770). All nine arrive
through@modelcontextprotocol/sdk's optional HTTP/SSE transport stack
(hono / express-rate-limit / qs / ip-address) and require an active HTTP
request handler; ttctl's MCP server is stdio-only, so the vulnerable
paths never enter its runtime module graph — present-but-unreachable (a
security-architectreview confirmed the reachability claim). They are
pinned per-GHSA inpnpm-workspace.yamlauditConfig.ignoreGhsas(so
future advisories still surface), with the full triage and reachability
proof in ADR-011 and the posture plus re-review trigger inSECURITY.md.
A reachablefast-uriadvisory surfaced during triage was closed with a
pnpm.overridesbump.