v0.2.0

Security

• take the zip inflation ratio over the bytes actually read, and serve a site's fallback per version and under nested routes
• keep upload nonces until their URL expires, bind metrics to loopback, read token hash from stdin, and give every served file a CSP (breaking)
• review the threat model against the code shipping in 0.2.0
• serve only the approved version publicly, close a gate race, bound zip directories and login checks (breaking)
• give every view response the security headers, and redirect a missing slash relatively

Added

• meta.json schema 2, projects, artifact_set_meta and multi-term search; run mcp-vitrine migrate after upgrading (breaking)
• per-link passcodes and revoke, scheduled unpublish, and anonymous view counts
• /api parity: get, delete, metadata edits, links and revoke over HTTP
• render GitHub-flavoured Markdown: tables, task lists, footnotes, front matter and heading anchors
• zip site uploads with a SPA fallback, and request bodies streamed to disk
• the vitrine client command: publish, list, get, link, revoke, tag, delete and open over /api
• render JSX and TSX components offline, from a runtime vitrine ships
• an operator dashboard at /_admin/, off until VITRINE_ADMIN_PASSWORD is set

v0.1.0

The first release. Everything below is new.

Added

• MCP server over Streamable HTTP at /mcp: nine artifact_* tools (create, update, get,
  list, link, set visibility, revoke links, upload URL, delete), the artifact:// resources for
  reading an artifact back, its files and its history, a share prompt, and server instructions
  that carry the sharing policy. Every tool has a title, all four annotation hints and described,
  bounded parameters.
• Private by default. Every artifact starts private, behind signed, expiring, revocable
  /s/… links. It becomes public at /a/<id>/ only through artifact_set_visibility, after a
  human approves through MCP elicitation. Both protocol eras are supported (2025-11-25
elicitation/create and 2026-07-28 InputRequiredResult), and the gate fails closed on
  decline, timeout, error or a client that cannot ask. New content on a public artifact goes
  through the same gate.
• Versions behind one URL. Updating keeps the id and the link; @<n> pins a version, and
  the newest retain_versions are kept.
• Viewing in any browser: multi-file artifacts with relative links, Range for media,
  Markdown, CSV/TSV and JSON renderers, and agent-written HTML in a CSP sandbox with an opaque
  origin (no allow-same-origin).
• Uploads for files a model should not emit byte by byte: multipart POST /api/artifacts
  and PUT /api/artifacts/{id}, and single-use signed upload URLs (artifact_upload_url, then
  curl -T).
• Hashed bearer tokens with scopes (read, write, share, publish), one per client, so
  revocation and the audit log stay per client.
• Idempotent create with client_ref, so a retried call never makes a duplicate.
• Audit log of every state change in audit/<YYYY-MM>.jsonl, fsync'd before the change is
  acknowledged, holding ids and client names, never content.
• Limits: streaming body limits, per-version size and file count, a storage quota, and
  per-client and per-IP rate limits.
• The mcp-vitrine CLI: serve, config check, token new|hash, secret new, sweep,
  audit, an online backup and forward-only migrate.
• Configuration from VITRINE_* variables or a TOML file, with secrets accepted from the
  environment only and unknown keys refused. Every key is in
  docs/configuration.md.
• Optional Prometheus metrics on a separate metrics_port (the metrics extra), never
  labelled by artifact id or title.
• A container image, ghcr.io/edgar971/vitrine, for amd64 and arm64: non-root, fine with a
  read-only root filesystem and no capabilities, signed with cosign and shipped with an SBOM.
  Each release is tagged with its version, and stable follows the newest one.
• Deployment examples in examples/: a TOML file, Compose with Caddy for TLS,
  and Kubernetes manifests (Pod Security restricted, default-deny network policy).
• A Hermes Agent plugin (integrations/hermes/) that publishes files
  already on disk, with a skill and the /share and /artifacts commands.
• Documentation: the spec, design, the
  threat model, operations and the
  decision records.