Skip to content

v0.1.5

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Jun 23:49
· 30 commits to main since this release
v0.1.5
a39bf31
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

madari v0.1.5

The sync-safety release: secret env values stay out of repo-scoped configs, diagnostics now detect drift between your registry and what clients actually run, and sync is guaranteed to leave entries it doesn't manage exactly as it found them.

Secret env placement policy

  • Manifests can mark secret env keys: [secret_env] keys = ["VAULT_TOKEN"], or --secret-env on add/install.
  • madari sync claude-code (project scope, the repo's .mcp.json) refuses to materialize static values for secret keys. Refused entries are reported with guidance while other servers sync normally — and a secret value that was materialized before being marked is scrubbed from the repo file on the next sync.
  • New: madari sync claude-code --scope user targets the user-scoped ~/.claude.json, where secret values are allowed. Scope is always declared explicitly, never inferred from paths, and each scope tracks its managed entries independently.

Drift detection

  • madari status and madari doctor now diff materialized client entries against your manifests and report stale (values changed), missing (deleted from client config), and orphaned (no longer desired) entries — each with the exact madari sync … command that reconciles it.
  • Drift is warning-level and never changes exit codes by itself. status/doctor --json gain a drift array; the managed array gains a scope field (backward-compatible additions, documented in docs/cli-reference.md).

Sync safety hardening

  • Unmanaged entries now preserve their JSON value (#40). Previously, sync rewrote every mcpServers entry through madari's typed model, silently dropping fields it didn't know ("note": …) and destroying hand-added remote server entries ({"type": "sse", "url": …} became {"command": ""}). Sync now only serializes entries it manages or adds; everything else passes through untouched, including server shapes madari does not model. If you sync into configs with hand-managed entries, this fix alone is worth the upgrade.
  • Pre-existing unmanaged entries are never silently adopted, even when their values match a manifest (since v0.1.4 follow-ups, now fully honored on the write path).

Also

  • ADR-002 records why the launcher-shim architecture was rejected (survivability, transparency) — madari stays out of your servers' launch path.

Migration

Automatic — no action needed. [secret_env] is opt-in; existing manifests, state files, and JSON output remain valid (schema_version stays 1; new fields are additive).

Assets

Prebuilt binaries for linux/darwin/windows on amd64/arm64. Verify with:

shasum -a 256 -c SHA256SUMS --ignore-missing
Assets 9
Loading