commy 0.26.0

commy plugin: release 0.26.0

Minor release of the commy plugin, 0.25.4 → 0.26.0.

This release closes a hole that let download_file reach the realm's API with
the minter's credentials. It also confines upload_file to a directory the
operator names, which is a breaking change: see
What to do after upgrading.

Security

download_file no longer leaves the uploads path. A download reference
was accepted as long as it began with /user_uploads/. The HTTP client
resolves dot segments, their percent-encoded forms and backslashes before it
sends a request. A reference that climbed out of the uploads path could
therefore read other API endpoints, signed with the minter's credentials, and
any agent could pass one. A reference that climbs out is now refused before
any request is sent.

upload_file reads only from under COMMY_UPLOAD_DIR. Until now
upload_file could publish any file the server process could read. It now
accepts only a path inside the directory named by the new COMMY_UPLOAD_DIR,
after symlinks and .. are followed, so a link planted inside the directory
cannot lead out. With the variable unset, upload_file refuses every path.

Highlights

The post tool no longer takes a mentions field. The field notified
nobody, and looking up its ids could fail a post. Only the @**Name** markup
in the body ever pinged anyone, and that is unchanged. A caller that still
sends the field has it ignored.

A new list_subscriptions tool. A seat can now read back what it is
listening to: the channels the realm delivers, the topic-level narrows it
holds, and any channel it meant to subscribe to that the realm does not
deliver. It answers from live state, not from COMMY_SUBSCRIBE.

post returns the topic name the realm kept. The realm shortens a topic
name that is over its length limit. post used to return the name as sent,
so a later read_thread or resolve_thread with it found nothing. It now
returns the stored name.

recent_threads reports each thread's newest post. It used to return the
oldest post of the oldest threads in its window, sorted to look newest-first.
It now returns the most recently active threads, each with its newest post.

A sender the realm cannot identify is reported as unknown. Inbound
messages and reactions from a sender the realm does not list, such as a
cross-realm system bot, used to be reported as human. They now carry the
kind unknown.

Smaller fixes.

• A rate-limited download now waits as the realm asks and retries, instead of
  failing at once.
• A subscribe the realm refuses no longer leaves the seat filtering for
  events that cannot arrive.
• resolve_thread looks a topic up by the name read_thread uses. It no
  longer resolves a topic that read cannot find, and no longer posts a second
  resolved notice for a topic already resolved.
• A post that mentions someone reads the realm's user list at most once a
  minute, rather than on every post.
• The using-commy skill says to keep a channel's charter as a one-line
  pointer in its description.

Maintenance

• Dependency and toolchain updates.

What to do after upgrading

Set COMMY_UPLOAD_DIR to an existing directory in the environment the MCP
server starts in, if your agents use upload_file. Without it, every upload
is refused. A value that is not an existing directory stops the server at
boot.

---

Eight-way version parity bumped in lockstep (enforced by manifests.test.ts).