Skip to content

v0.2.1

Choose a tag to compare

View all tags
@askalf askalf released this 11 Jul 01:10
v0.2.1
5759709
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Renamed

  • @askalf/picket → @askalf/fieldpass (#23) — npm-publishable name; picket is squatted unscoped and the registry create-policy blocks colliding scoped names. The GitHub repo is now askalf/fieldpass (old URLs redirect). Legacy picket/picket-mcp bin aliases retained; MCP tool names and PICKET_* env vars unchanged.

Added

  • Streamable HTTP transport for the MCP server (#21) — fieldpass-mcp --http serves picket_observe / picket_gate / picket_login as a URL-type MCP server, so clients that can't spawn a stdio process (the Claude API MCP connector, Managed Agents, remote agent runtimes) can attach. Spec session management with every session sharing one governed browser (verdict cache and keeper leases persist, same as stdio); binds 127.0.0.1 by default with DNS-rebinding protection on loopback, optional constant-time bearer auth (PICKET_MCP_TOKEN), and an unauthenticated GET /healthz liveness probe. stdio stays the default transport.
  • Framework example series (#22) — four runnable, offline, no-API-key examples of real agent-framework engines browsing behind the firewall via the MCP server: LangGraph.js (StateGraph), OpenAI Agents SDK (scripted offline model through the genuine Runner), CrewAI (Flow), and Microsoft AutoGen (AssistantAgent + McpWorkbench). Each reads a booby-trapped invoice page, proves the injection is withheld while benign content survives, has every hijack action refused at the gate, and shows login failing closed with no vault — with captured evidence and pinned versions from real runs in each example's evidence/.

CI

  • npm releases are now tokenless: OIDC trusted publishing via publish.yml (#27), with a daily npm-drift.yml watch comparing the latest GitHub release against the npm registry.

This version is live on npm as @askalf/fieldpass@0.2.1.

Assets 2
Loading