Skip to content

v0.99.28

Choose a tag to compare

View all tags
@github-actions github-actions released this 29 Sep 00:58
v0.99.28
c0912e7

Added

  • Add opt-in, wire-version-four project-scoped attachments with signed
    upload/read/reference/GC frames, bounded private storage, verified atomic
    writes, inert text preview, and Python/TypeScript client entry points.

  • Add opt-in authenticated Streamable HTTP MCP with provisioned native seats,
    project-filtered reads, separately granted mutations, live revocation,
    stable operation identifiers and bounded TLS loopback admission. Stdio
    remains the default; desktop and cloud HTTP compatibility is not inferred.

Changed

  • Admit MCP SDK 1.30.0 across the package extras, runtime environment guard,
    registry launch hint and MCP checks. Refresh the hash-locked Python profiles
    to one compatible dependency set.

Fixed

  • Refuse a hub WebSocket upgrade that repeats Host or Origin with the
    handshake 403 instead of HTTP 500, treat a repeated Authorization header
    on /metrics and /health as no token, and require exactly one Host at the
    dashboard boundary instead of acting on the first value.

  • Report a hub start refused by the anti-rollback check as a three-line operator
    message with exit 2 and the reproducing synapse merkle checkpoint --verify
    command instead of a traceback, and close the checkpoint store on that refusal.

  • Keep the policy-check Action description within GitHub Marketplace's 125-character
    limit and exclude Action-only releases from Core container publication.

  • Classify protected-write representation and custody-replay refusals, and remote
    MCP policy loading, through the stable error taxonomy while preserving their
    historical ValueError and RuntimeError catches.

  • Keep verification aligned with the complete MCP extra, existing POSIX test
    guards and exact platform-specific container build dependencies.

  • Give offline discovery CLI tests their own review configuration and exercise
    overdue-review rejection independently of the production review deadline.

  • Report wrapped-command OS launch failures without a traceback: synapse lock
    returns 127 when an executable or interpreter is missing and 126 for
    other execution refusals, while completing the usual claim release.

  • Report addressed hub errors in lock and release commands instead of hiding
    ACL refusals behind timeouts; lock cleanup releases only confirmed grants.

  • Reject boolean or non-finite evidence freshness in release receipt files and
    non-finite explicit CLI freshness before releasing
    the owned claim.

  • Let Git hooks use the lock owner's identity while a wrapped command runs,
    retaining the durable mutex claim and reconnecting for confirmed cleanup.

  • Update the GitHub Action policy-check example to the released 0.99.27 pair and
    show the checkout needed for a committed policy file.

  • Report an oversized provider HTTP response through the stable, redacted
    provider error API instead of leaking the lower-level bounded-read exception.

  • Refuse query-bearing hub URLs before writing an isolated Codex MCP profile.

  • Refuse unpaired Unicode surrogates in version-three delivery identifiers and
    evidence with a typed invalid_shape frame instead of closing the socket.

  • Reject malformed non-stream provider tool-call collections as redacted
    invalid_shape errors before they reach a worker.

Artifact checksums (SHA-256)

5c5e0995b84cbc644cbc92d23a08c698f9fbf61e13fac8a3337227a935872d96  synapse_channel-0.99.28-py3-none-any.whl
fc5c324baee043996fed1391a7987cef5862aecc6e358068089cee3fce1c8523  synapse_channel-0.99.28.tar.gz
f9bcf64c0a261186ae2b25839af945636db8171e0ff9a411f10348bfc5ef4637  synapse-channel-v0.99.28-sbom.cdx.json
Assets 12
Loading