ComputerPilot MCP v0.8.0 - Cross-Platform Preview

ComputerPilot MCP v0.8.0 - Extensibility & Agent Foundation

ComputerPilot MCP v0.8.0 introduces the Extensibility & Agent Foundation, enabling operators to integrate external Model Context Protocol (MCP) servers alongside native tools through a strictly bounded, supervised stdio runtime.

This release preserves the native 150-tool baseline (on Windows full profile) and default zero-extension operation. External extensions are strictly opt-in, disabled by default, and require explicit local operator approval before execution.

Highlights

Bounded External stdio Transport and Process Lifecycle

• Dedicated Connection Ownership: Each configured external MCP provider process is entered and exited by exactly one connection owner task (bounded_stdio_transport).
• Clean Process Tree Reaping: Enforces native process tree ownership using Windows Job Objects (preventing orphan child/grandchild processes upon abrupt termination or exit) and POSIX process groups on Linux and macOS.
• Finite Deadlines: Bounded timeouts cover startup, handshake, discovery, and tool execution. Slow providers cannot block healthy providers or delay native readiness.
• Bounded Wire Buffers: Input buffers, line lengths, and JSON-RPC frames are strictly capped to prevent unbounded memory allocation under high throughput or malformed responses.

Schema Validation and Monotonic Catalog Generations

• Offline Strict Schema Validation: Provider tool schemas are validated using an offline, non-network JSON Schema validator adhering to a deterministic, bounded keyword subset. Remote references, unbounded recursion, and pattern expressions are rejected.
• Immutable Schema Fingerprint: The first accepted schema fingerprint for each tool is frozen for the entire runtime lifespan. Dynamic schema mutation during reconnects is withheld to protect client predictability.
• Monotonic Generations: Tool catalogs are tracked as strictly monotonic published generations inside ExtensionRegistry. Catalog updates trigger coalesced notifications and increment monotonic generation numbers without performing unneeded RPC during listing.

Guarded Execution and Core Output Envelopes

• Guarded Call Boundary: Calls pass through ExtensionLifecycleManager.execute_guarded_call, capturing an immutable admission lease and re-validating tool policy immediately prior to dispatch.
• Standardized Core Envelope: All external tool calls return a standardized ExtensionResult structure (ok, source_type='external_mcp', extension_id, provider, tool, outcome, content, structured_content, truncated, limits, artifact, error, message).
• Bounded Previews and Sanitized Artifacts: Large structured results are truncated into bounded inline previews. Operators can optionally enable disk-backed sanitized JSON artifacts managed by the existing retention policy.
• Comprehensive Secret Redaction: Credential literals and environment tokens are scrubbed from stdout, stderr, logs, audit trails, health snapshots, and artifacts.

Two-Stage Mutation Checkpointing and Uncertainty Durability

• Two-Stage Dispatch Barrier: Mutating tools operate under a two-stage journal barrier (prepared -> may_dispatch) using schema-1 operation journals.
• Uncertainty Protection (No Blind Replay): If an external provider disconnects, crashes, times out, or returns ambiguous results after may_dispatch, the operation is durably recorded as uncertain. Blind replays and speculative retries are strictly prohibited.
• Bounded Admission Quota: Unresolved operations are capped at a quota of 128. Resolved records are compacted (1,000 operations / 30 days) without evicting unresolved records.
• Manual Reconciliation: Full support for inspecting, acknowledging, and resolving uncertain operations through dedicated recovery APIs.

Adaptive Execution Router Integration

• Advisory Route Recommendations: The Adaptive Execution Router incorporates external tools as external.mcp candidates when operator intent mappings match.
• Deterministic Priority: Determinism is capped at 4 for external tools, ensuring native determinism 5 tools take precedence on ties.
• Explainable Policy Metadata: Recommendations provide explainable candidate rankings with operator policy estimates while keeping router recommendations strictly advisory.

Observability and Operator Console

• Read-Only Health Projections: Bounded in-memory health snapshots project discovered, approved, eligible, and live tool counts with monotonic ages and zero provider RPC.
• Local Control Panel: The loopback control panel (http://127.0.0.1:8766/) features a dedicated, read-only external extensions dashboard displaying provider statuses, capabilities, and telemetry.
• Rolling Telemetry: Per-owner rolling outcome counters (last 64 calls) track durations and failure modes without dynamic provider labeling.

Offline Configuration and Publication

• Strict Schema 1: Operator configuration (extensions.json) enforces strict schema version 1, unique IDs, absolute executable paths, and env-only credential references.
• Atomic File Publication: Configuration updates use exclusive file locks, atomic staging, and Compare-and-Swap (CAS) revision checks.
• Restart-Only Semantics: Configuration changes take effect only upon runtime restart; dynamic hot-reloading is disabled to ensure operational predictability.

Upgrading and Compatibility

• Baseline Compatibility: Public server identifier remains ali_windows_agent_mcp. Full-profile native tool count remains 150 on Windows.
• Opt-In Requirement: Extensions are disabled by default (MCP_EXTENSIONS_ENABLED=false). Existing environments run without behavioral change.
• Disabling Extensions: Setting MCP_EXTENSIONS_ENABLED=false or leaving configuration unconfigured reverts runtime behavior completely to native mode.
• Data Preservation: Removing or renaming extension definitions preserves all historical recovery journals, audit logs, and unresolved operation records.

Packaging Contract

v0.8.0 provides deterministic source-and-runtime release archives:

• computerpilot-mcp-v0.8.0-windows-amd64.zip
• computerpilot-mcp-v0.8.0-linux-amd64.tar.gz
• computerpilot-mcp-v0.8.0-linux-arm64.tar.gz
• computerpilot-mcp-v0.8.0-macos-amd64.tar.gz
• computerpilot-mcp-v0.8.0-macos-arm64.tar.gz
• SHA256SUMS.txt

Each package includes RELEASE-MANIFEST.json and excludes tracked local state, secrets, virtual environments, and test caches.

ComputerPilot MCP v0.7.1 - Cross-Platform Preview

ComputerPilot MCP v0.7.1 - Windows Console Shutdown Reliability

ComputerPilot MCP v0.7.1 is a focused patch release for Windows console shutdown behavior after the v0.7.0 Adaptive Execution Router release.

The patch does not add or remove MCP tools, change workflow schemas, alter execution-router policy, or change the cross-platform capability contract. It fixes the Windows launcher/supervisor interrupt path so intentional console shutdown is graceful on the first Ctrl+C and promptly forceable on the second.

Highlights

Graceful first Ctrl+C

• Run the live ComputerPilot bootstrap through the virtual-environment Python process rather than keeping PowerShell in the live process chain after environment creation.
• Let the Supervisor receive Windows console interrupts directly.
• Treat the first Ctrl+C as an intentional graceful stop request.
• Preserve lifecycle drain/stop coordination instead of immediately killing the runtime.
• Prevent an intentional exit code 130 / Windows Ctrl+C termination from entering the launcher crash-restart loop.

Prompt forced shutdown on the second Ctrl+C

• Track console interrupt count inside the Supervisor.
• Let a second Ctrl+C set an explicit force-stop signal.
• Abort a long runtime drain/stop wait when force-stop is requested.
• Shorten process cleanup waits during a forced shutdown so the operator can exit promptly.
• Record whether shutdown cleanup was forced in the drain result.

Signal-path safety

• Use a re-entrant Supervisor lock for the console-shutdown path so a signal arriving while the main thread is already inside lock-protected lifecycle code cannot deadlock itself.
• Install the SIGINT handler only from the main thread and restore the previous handler during Supervisor teardown.
• Keep scripts.bootstrap and scripts.supervisor in one Python process for the live start path so console control signals are not obscured by an intermediate PowerShell process.

Compatibility

• Public package/project identity remains computerpilot-mcp / ComputerPilot MCP.
• Protocol-level MCP server identifier remains ali_windows_agent_mcp.
• Windows full-profile catalog remains 150 unique tools.
• deterministic-v1 routing behavior from v0.7.0 is unchanged.
• Workflow schema remains v6.
• Semantic Browser, Native Documents, durable jobs, recovery, workflows, and existing tool profiles are unchanged.
• Linux/macOS portable-core behavior is unchanged; this patch targets the Windows console launcher and Supervisor interrupt path.

Packaging contract

v0.7.1 publishes deterministic packages for:

• computerpilot-mcp-v0.7.1-windows-amd64.zip
• computerpilot-mcp-v0.7.1-linux-amd64.tar.gz
• computerpilot-mcp-v0.7.1-linux-arm64.tar.gz
• computerpilot-mcp-v0.7.1-macos-amd64.tar.gz
• computerpilot-mcp-v0.7.1-macos-arm64.tar.gz
• SHA256SUMS.txt

Release archives continue not to vendor upstream Secure MCP Tunnel or Cloudflared binaries. Managed tunnel runtimes remain selected/downloaded/verified independently by the existing runtime-management path.

Linux arm64 and macOS amd64 remain deterministic package/updater targets without a dedicated native hosted-runner execution claim. Windows amd64, Linux amd64, and macOS arm64 continue to receive native hosted validation through the repository release gates.

Validation expectations

The patch release is gated by:

• focused Windows launcher/bootstrap/Supervisor regression tests;
• full pytest;
• Ruff;
• mypy;
• compileall;
• launcher validation / Full Doctor;
• deterministic five-target packaging and checksum verification;
• CI on Windows, Linux, and macOS for Python 3.10 and 3.12;
• Platform Release Validation on Windows, Linux, and macOS for Python 3.12;
• Release Packaging Smoke.

See docs/V0.7.1-VALIDATION.md for the recorded release evidence.

Known limits

• The first Ctrl+C requests graceful shutdown, so a mutation-aware drain may still take bounded time when work is active. Pressing Ctrl+C again requests the force-stop path.
• This patch does not introduce new visual-grounding, external-MCP extension, or delegated-browser capabilities. Those remain future roadmap work.

ComputerPilot MCP v0.7.0 - Cross-Platform Preview

ComputerPilot MCP v0.7.0 - Adaptive Execution Router

ComputerPilot MCP v0.7.0 adds a deterministic, explainable execution-routing layer that helps agents choose the strongest available typed capability before falling back to less structured interaction. The release keeps execution inside the existing typed tools and deliberately does not add a universal arbitrary-action dispatcher.

Highlights

Deterministic execution routing

• Add a shared execution metadata catalog for filesystem, code/LSP, Git, process, system, Excel, DOCX, PDF, semantic browser, Windows UI Automation, and raw desktop tools.
• Add structured execution intents and route candidates with explicit determinism, risk, recoverability, capability-confidence, cost, latency, and fallback metadata.
• Add the versioned deterministic-v1 policy with stable lexicographic ranking and inspectable tie-breakers rather than opaque model scoring.
• Prefer native structured routes when they are available, such as filesystem operations over editor interaction, LSP rename over typing, native document adapters over GUI automation, and semantic browser actions over raw coordinates.

Read-only routing diagnostics

• Add execution_candidates for bounded candidate inspection.
• Add execution_recommend for one deterministic recommendation plus optional bounded explanation data.
• Enrich recommend_tools with execution metadata from the same shared catalog without changing its existing keyword score/order contract.
• Keep the live MCP registry authoritative: catalog metadata cannot make an unregistered or profile-excluded tool routable.

There is intentionally no execution_run tool in v0.7.0.

Hard safety constraints

Hard constraints are applied before ranking and cannot be overridden by route scores:

• raw desktop routes require explicit permission;
• destructive work cannot automatically fall back to raw desktop input;
• destructive ambiguous semantic targets fail closed;
• stale semantic references do not degrade to screen coordinates;
• unsupported platform/profile capabilities are excluded;
• macro-preservation requirements eliminate document routes that cannot prove the required fidelity;
• visual.desktop remains reserved and unavailable in v0.7.0.

Durable workflow integration

• Upgrade the workflow store to schema v6 with optional structured execution intent metadata.
• Persist selected route, router policy version, bounded route decision metadata, and bounded fallback history.
• Persist and validate the selected route before routed workflow side effects begin.
• Require routed workflow decisions to match the fixed allowlisted action route.
• Preserve prior behavior for workflows that do not declare an execution intent.
• Keep uncertain side effects reconciliation-only: the router does not blindly reroute or replay an uncertain operation.

Observability

• Add bounded in-memory router metrics to server_health, including decision count, no-route count, rejected-candidate count, fallback rate, route distribution, native/semantic/raw usage, latency summary, and bounded recent decisions.
• Add an English-only Execution Routing section to the loopback Control Panel.
• Keep routing telemetry metadata-only; it does not retain raw prompts, document bodies, screenshots, credentials, or secrets.

Catalog and compatibility

• Increase the Windows/full-profile catalog from 148 to 150 tools with the two read-only routing diagnostics.
• Keep public project/package identity as ComputerPilot MCP / computerpilot-mcp.
• Keep the protocol-level MCP server identifier ali_windows_agent_mcp for existing clients and tunnel configuration.
• Keep the v0.6 native document domain, v0.5 semantic browser capabilities, recovery model, durable jobs, and workflow engine intact.

Configuration

New router settings:

MCP_EXECUTION_ROUTER_ENABLED=1
MCP_EXECUTION_ROUTER_POLICY=deterministic-v1
MCP_EXECUTION_ROUTER_EXPLAIN=1

Unsupported policy names fail closed when router APIs or routed workflow steps are invoked; they do not prevent the MCP server from starting.

Packaging contract

v0.7.0 continues deterministic packaging for:

• computerpilot-mcp-v0.7.0-windows-amd64.zip
• computerpilot-mcp-v0.7.0-linux-amd64.tar.gz
• computerpilot-mcp-v0.7.0-linux-arm64.tar.gz
• computerpilot-mcp-v0.7.0-macos-amd64.tar.gz
• computerpilot-mcp-v0.7.0-macos-arm64.tar.gz
• SHA256SUMS.txt

Linux arm64 and macOS amd64 remain deterministic package/updater targets without a dedicated native hosted-runner execution claim. Windows amd64, Linux amd64, and macOS arm64 continue to receive native hosted validation through the repository release gates.

Every release archive contains RELEASE-MANIFEST.json with project computerpilot-mcp, version 0.7.0, the exact source commit, target, file count, and managed-runtime policy.

Known limits

• v0.7.0 recommends routes but does not introduce a universal execution dispatcher.
• visual.desktop is reserved for a later visual-grounding phase.
• Windows UI Automation and raw Windows desktop routes remain capability-gated and are not emulated on Linux/macOS.
• Browser automation still requires Playwright and installed browser runtimes.
• Release archives continue not to vendor upstream tunnel-client or Cloudflared executables.

Release evidence

See docs/V0.7.0-VALIDATION.md for local release-preparation validation, cross-platform PR gates, exact-SHA publication gates, and artifact/checksum verification.

ComputerPilot MCP v0.6.0 - Cross-Platform Preview

ComputerPilot MCP v0.6.0 - Native Document Intelligence

ComputerPilot MCP v0.6.0 adds first-class native document adapters for Excel, DOCX, and PDF so common document work can be performed through structured MCP tools without launching desktop applications.

Highlights

Excel

• Add structured workbook inspection and sheet listing for .xlsx and safely supported .xlsm files.
• Add bounded range reads, value/formula search, formula inspection, and table metadata.
• Add guarded range writes/clears, sheet add/rename/delete, formula assignment, and table creation.
• Serialize same-file mutations while allowing independent workbooks to proceed concurrently.
• Support optional SHA-256 preconditions so stale external edits are rejected before mutation.
• Preserve XLSM VBA project bytes only when staged serialization verifies they remain byte-identical.
• Reject macro-bearing XLSX files and unsupported macro-loss scenarios instead of silently stripping content.
• Validate OOXML archive paths, duplicate members, encryption flags, CRC integrity, entry limits, expanded-size budgets, and excessive compression before OpenPyXL parsing.

DOCX

• Add structure and core-metadata inspection.
• Add bounded paragraph and table-cell reads plus bounded text search.
• Add conservative text replacement, paragraph insertion, simple table-cell replacement, and simple DOCX creation.
• Preserve supported run formatting and fail closed when a replacement crosses differently formatted runs.
• Validate DOCX ZIP structure, required members, traversal attempts, duplicate members, encryption, CRC failures, and decompression limits.
• Keep .docm, tracked changes, comments, headers/footers, and arbitrary WordprocessingML mutation explicitly unsupported.

PDF

• Add PDF page-count, encryption-state, and metadata inspection.
• Add bounded single-page and multi-page text extraction with explicit page/character limits and optional file-backed delivery.
• Add deterministic new-PDF creation from plain text and a documented Markdown subset.
• Reject encrypted PDF text extraction unless the caller provides a decrypted input.
• Keep arbitrary editing of existing PDFs outside the v0.6.0 contract.

Recovery and artifacts

• Return document artifact descriptors containing path, SHA-256, byte size, and media type.
• Use same-directory staging, format-specific round-trip validation, backups, and atomic publication for mutations.
• Durably checkpoint the expected final file hash before atomic replacement so a crash after the side effect can be reconciled without blind replay.
• Add a dedicated documents tool profile while preserving the existing full profile and typed tool catalog.

Dependencies

The native-document runtime uses mature format libraries recorded in the project runtime dependencies:

• OpenPyXL for Excel;
• python-docx for DOCX;
• pypdf for PDF inspection/extraction;
• ReportLab for deterministic PDF creation.

These dependencies are part of the normal portable runtime for v0.6.0.

Compatibility

v0.6.0 includes all v0.5.0 Semantic Browser capabilities.

The protocol-level MCP server identifier remains:

ali_windows_agent_mcp

Existing client and Secure Tunnel configurations therefore do not require an identifier migration.

The document domain is portable across supported Windows, Linux, and macOS hosts. Windows-only UI Automation remains capability-gated and is not required for native document operations.

Packaging contract

v0.6.0 continues deterministic packaging for:

• computerpilot-mcp-v0.6.0-windows-amd64.zip
• computerpilot-mcp-v0.6.0-linux-amd64.tar.gz
• computerpilot-mcp-v0.6.0-linux-arm64.tar.gz
• computerpilot-mcp-v0.6.0-macos-amd64.tar.gz
• computerpilot-mcp-v0.6.0-macos-arm64.tar.gz
• SHA256SUMS.txt

Linux arm64 and macOS amd64 remain deterministic package/updater targets without a dedicated native hosted-runner claim.

Release evidence

See docs/V0.6.0-VALIDATION.md for local release-preparation evidence and required GitHub same-SHA release gates.

ComputerPilot MCP v0.5.0 - Cross-Platform Preview

ComputerPilot MCP v0.5.0 - Semantic Browser

ComputerPilot MCP v0.5.0 upgrades browser automation from selector-first actions into a bounded, structure-first semantic browser subsystem while preserving the existing Playwright process/session lifecycle.

Highlights

• Add bounded semantic page snapshots with accessible roles, names, state, explicit truncation metadata, and generation-scoped node references.
• Add targeted semantic queries so agents can find page elements without serializing the full page tree.
• Add semantic click and fill operations using node refs, roles, accessible names, labels, text, and test IDs instead of screenshot coordinates.
• Reject stale semantic references after navigation or mutation instead of silently acting on changed page state.
• Fail closed on ambiguous semantic mutation targets unless the caller explicitly selects a deterministic match.
• Add structured browser waits instead of relying on arbitrary fixed sleeps.
• Add semantic selection and explicit tab listing, activation, and close operations.
• Add bounded page extraction for text, links, tables, form fields, and selected subtrees.
• Add controlled upload and download handling with explicit local upload paths, sanitized download names, controlled runtime storage, and configured byte limits.
• Add semantic browser health counters for snapshots, latency accumulation, nodes, truncation, action success/failure, stale refs, and downloaded bytes.

Compatibility

Existing selector-based browser tools remain available. Semantic browser tools extend the current Playwright manager rather than replacing it.

Browser sessions continue to use isolated contexts and compatible shared browser-process pooling. Existing idle reclamation and lifecycle behavior remain in place.

The protocol-level MCP server identifier remains:

ali_windows_agent_mcp

Existing client and Secure Tunnel configurations therefore do not require an identifier migration.

Platform and packaging contract

The semantic browser surface is part of the portable browser domain. Browser execution still requires Playwright and an installed compatible browser runtime.

v0.5.0 continues the deterministic five-target packaging contract:

• computerpilot-mcp-v0.5.0-windows-amd64.zip
• computerpilot-mcp-v0.5.0-linux-amd64.tar.gz
• computerpilot-mcp-v0.5.0-linux-arm64.tar.gz
• computerpilot-mcp-v0.5.0-macos-amd64.tar.gz
• computerpilot-mcp-v0.5.0-macos-arm64.tar.gz
• SHA256SUMS.txt

Linux arm64 and macOS amd64 remain deterministic package/updater targets without a dedicated native hosted-runner claim.

Release evidence

See docs/V0.5.0-VALIDATION.md for local release-preparation evidence and the required GitHub same-SHA gates.

ComputerPilot MCP v0.4.0 - Cross-Platform Preview

ComputerPilot MCP v0.4.0 - Operations, Observability & Reliability

ComputerPilot MCP v0.4.0 is a cross-platform operations and runtime-hardening release.

It expands the local Control Panel into an observability and diagnostics surface, strengthens Secure Tunnel health/recovery behavior, improves durable job/workflow/process lifecycle correctness, and reduces unnecessary synchronous/runtime maintenance work.

Highlights

• Rebuilt local Control Panel with incident-first health, sticky navigation, runtime/build identity, resource budgets, storage/performance summaries, transport diagnosis, workflow/recovery visibility, Doctor output, audit history, memory metadata, and redacted diagnostics export.
• Added detailed Recent Jobs views with bounded stdout/stderr, command/cwd/process metadata, cancellation controls, and keyboard-accessible modal interaction.
• Upgraded Recent Operations with search, outcome filters, paging, status chips, full-target inspection, and safe metadata details.
• Added generation-scoped runtime-health and tool-activity snapshots so the Supervisor can distinguish local MCP activity from upstream transport inactivity.
• Added detailed Secure Tunnel transport classifications, bounded transport history, and a conservative confirmed poll-stall watchdog.
• Hardened job/workflow/process recovery against stale PID metadata, process reuse, disappearing children, concurrent migrations, crash checkpoints, stale operation state, and interrupted cleanup.
• Reduced event-loop and maintenance overhead through offloaded health collection, fewer redundant filesystem/database reads, indexed queue access, batched timing writes, and bounded cleanup paths.
• Suppressed expected loopback client disconnect write failures, including Windows WinError 10053, without hiding unrelated server failures.

Cross-platform contract

The portable ComputerPilot MCP core remains available across Windows, Linux, and macOS:

• filesystem/editing and project analysis;
• Git, testing, diagnostics, and code intelligence;
• terminal/process execution with platform-specific ownership;
• browser automation;
• durable jobs, recovery, workflows, and project memory;
• Secure Tunnel managed-runtime selection for supported OS/architecture mappings.

Windows additionally exposes native desktop screenshots/input, semantic UI Automation, Windows CMD, SCM/Registry-backed system inspection, and Job Object process ownership.

Linux and macOS remain preview for the portable core. Native Windows desktop/UI Automation is not emulated on POSIX hosts.

v0.4.0 publishes deterministic packages for five targets:

• computerpilot-mcp-v0.4.0-windows-amd64.zip
• computerpilot-mcp-v0.4.0-linux-amd64.tar.gz
• computerpilot-mcp-v0.4.0-linux-arm64.tar.gz
• computerpilot-mcp-v0.4.0-macos-amd64.tar.gz
• computerpilot-mcp-v0.4.0-macos-arm64.tar.gz
• SHA256SUMS.txt

Linux arm64 and macOS amd64 are package/updater targets. This release does not claim a dedicated native hosted-runner validation lane for those two architecture combinations.

Compatibility

The protocol-level MCP server identifier remains:

ali_windows_agent_mcp

Existing client and Secure Tunnel configurations therefore do not require an identifier migration.

Project release archives continue to exclude upstream tunnel-client/Cloudflared binaries. Tunnel mode downloads and verifies the official managed runtime separately.

Release evidence

See docs/V0.4.0-VALIDATION.md for local and GitHub release-gate evidence.

ComputerPilot MCP v0.3.0 - Cross-Platform Preview

ComputerPilot MCP v0.3.0 - Rebrand Release

ComputerPilot MCP is the new public identity of the project previously published as windows-agent-mcp / Local Developer Agent MCP.

The rebrand reflects the actual scope of the runtime: cross-platform computer use and developer automation over MCP, with native Windows desktop capabilities plus portable filesystem, terminal, browser, Git, testing, durable jobs, recovery, and workflow tooling.

What changes

• GitHub repository name: computerpilot-mcp
• Public project title: ComputerPilot MCP
• Python project metadata name: computerpilot-mcp
• Release artifact prefix: computerpilot-mcp-v<version>
• MCP display title and description: ComputerPilot MCP / cross-platform computer-use and developer automation
• Tunnel updater user agent: computerpilot-mcp-tunnel-updater
• Release manifest project field: computerpilot-mcp
• README, badges, search terminology, package metadata, and GitHub repository metadata are aligned to the new identity.

Compatibility

The protocol-level MCP server identifier remains:

ali_windows_agent_mcp

That identifier is intentionally retained so existing MCP client configurations and Secure Tunnel profiles do not need to be rewritten for the branding change.

Historical v0.2.x releases and documentation retain their original artifact/repository naming where they describe the historical release.

Distribution

v0.3.0 publishes:

• computerpilot-mcp-v0.3.0-windows-amd64.zip
• computerpilot-mcp-v0.3.0-linux-amd64.tar.gz
• computerpilot-mcp-v0.3.0-linux-arm64.tar.gz
• computerpilot-mcp-v0.3.0-macos-amd64.tar.gz
• computerpilot-mcp-v0.3.0-macos-arm64.tar.gz
• SHA256SUMS.txt

As in v0.2.9+, these project packages do not vendor upstream tunnel-client/Cloudflared binaries. Tunnel mode downloads and verifies the official managed runtime separately.

v0.2.10 - Cross-Platform Preview

v0.2.10 - Live Tunnel Runtime Migration Fix

v0.2.10 is a focused patch release for the managed Secure Tunnel bootstrap introduced in v0.2.9.

Fixed

On Windows, an upgrade from an older managed full-client cache could fail when the old tunnel-client.exe was still running from the same upstream version directory. The v0.2.9 installer attempted to replace the whole <version>/<platform> directory, and Windows correctly rejected deletion of the live executable with an access-denied error.

v0.2.10 installs tunnel-client-runtime-cloudflared in a dedicated flavor-specific directory:

.agent_state/tunnel-runtime/<version>/<platform>/tunnel-client-runtime-cloudflared/

This allows the verified new runtime to be downloaded and published while the legacy full-client process keeps running. The next cold start can then select the new managed flavor without requiring the live legacy executable to be deleted first.

Validation

• Focused tunnel/Doctor/package tests passed.
• Full pytest passed.
• Ruff and mypy passed.
• A real Windows migration was executed while the legacy tunnel-client.exe remained live.
• The new managed runtime was installed successfully beside the legacy runtime.
• current.json was updated to the verified tunnel-client-runtime-cloudflared.exe path.
• The legacy process continued running during migration.

No upstream tunnel or Cloudflared binaries are bundled in project release artifacts.

v0.2.9 - Cross-Platform Preview

v0.2.9 - Managed Tunnel Bootstrap

v0.2.9 removes upstream Secure Tunnel executables from the project repository and release artifacts. Tunnel mode now bootstraps the verified upstream runtime on first use.

Highlights

• No tracked or packaged tunnel-client, tunnel-client-runtime, Cloudflared executable, or Cloudflared manifest.
• First tunnel-mode startup automatically detects Windows/Linux/macOS and amd64/arm64.
• The updater queries the latest official non-prerelease openai/tunnel-client release.
• The selected asset is the official tunnel-client-runtime-cloudflared-vX.Y.Z-<os>-<arch>.zip.
• GitHub asset SHA-256 metadata and upstream SHA256SUMS.txt are both verified before extraction.
• Archive path traversal and symbolic links are rejected.
• The downloaded runtime must report the exact release semantic version before it is published into the managed cache.
• Verified runtime state lives only under .agent_state/tunnel-runtime/.
• A previously verified managed cache can be used when a later update check is offline; a fresh install with no verified cache fails closed.
• Project packaging fails if an upstream tunnel runtime file is accidentally tracked at repository root.

Distribution

Project release archives now contain only the MCP project/controller source and metadata. Tunnel and Cloudflared binaries are acquired directly from the official upstream release for the host platform when tunnel mode is first started.

This substantially reduces the Windows project archive size and prevents stale upstream executables from being redistributed by this project.

Compatibility

The explicit MCP_TUNNEL_CLIENT_BIN override remains available for operators that intentionally manage the runtime themselves. Version pinning, required-update mode, prerelease opt-in, and update interval controls remain supported.

The repository name windows-agent-mcp and MCP server identifier ali_windows_agent_mcp remain unchanged.

v0.2.8 - Cross-Platform Preview

v0.2.8 - Connection Resilience Patch

v0.2.8 is a focused patch release on top of v0.2.7. It keeps the cross-platform architecture and release contract unchanged while hardening how the Windows runtime loads the Secure MCP Tunnel control-plane API key.

Fixed

• Strip a UTF-8 BOM before validating CONTROL_PLANE_API_KEY.
• Decode UTF-16 LE/BE key files safely when Windows tooling saved the secret with UTF-16 encoding.
• Normalize surrounding quotes and incidental whitespace without exposing or logging the key.
• Handle invalid/undecodable secret text as a controlled startup/diagnostic failure instead of an unhandled Unicode decode exception.
• Use the same normalization path from bootstrap, Doctor, Supervisor, and managed tunnel runtime helpers.

These fixes address the class of failures where the tunnel process could fail with a malformed control-plane API key even though the stored key itself was valid.

Compatibility

• No tool names or public MCP contracts are removed.
• The project remains capability-aware across Windows, Linux, and macOS.
• The repository name windows-agent-mcp and MCP server identifier ali_windows_agent_mcp remain unchanged.
• Existing .agent_state, .secrets, durable jobs, workflows, and managed tunnel state remain local runtime state and are not packaged into releases.

Artifacts

• windows-agent-mcp-v0.2.8-windows-amd64.zip
• windows-agent-mcp-v0.2.8-linux-amd64.tar.gz
• windows-agent-mcp-v0.2.8-linux-arm64.tar.gz
• windows-agent-mcp-v0.2.8-macos-amd64.tar.gz
• windows-agent-mcp-v0.2.8-macos-arm64.tar.gz
• SHA256SUMS.txt

The deterministic packaging and same-SHA release gates introduced in v0.2.7 remain in force.