v0.3.0

0.3.0 (2026-09-26)

⚠ BREAKING CHANGES

• core: the CLI JSON and MCP structured content of these five operations change from SchoolSoft's field names to the domain shapes (studentId -> id, startDate -> start with a Stockholm offset, menu -> days, entries -> events, isRead -> read, ...). Nothing is published yet.

Features

• auth: own OAuth/PKCE flow with configurable client id; log token claims (b58c767)
• cli: add --format text views for people (866cfb9)
• cli: add --format text views for the five typed operations (bed7b95)
• cli: add doctor --verify and --all-children, and make verify-live (1dd65b9)
• cli: doctor --verify, a live parse check of the typed operations (6bad4ff)
• cli: registry-driven commands, exit codes, configure, doctor (ebc5176)
• core: add an http hint surface and messages for connector refusals (2ffeb2c)
• core: add full calendar access for assistant integrations (b12ba16)
• core: add report_absence behind allowWrites, preview by default (af3282a)
• core: add report_absence behind allowWrites, preview by default (85f6c9f)
• core: add the domain model and the response drift error (6f5d679)
• core: add the request budget: token bucket, in-flight cap, backoff and circuit breaker (6ee833f)
• core: browser provider for capabilities SchoolSoft only offers as web pages (ffd9e65)
• core: declared page contracts, structure verification, subject rooms via REST (8a8dd96)
• core: gated reads through the web-login session (GDPR gate) (bf7956b)
• core: key saved sessions, history and settings by account (034edcd)
• core: key saved sessions, session history and settings by account (134ff8c), closes #26
• core: one request budget and a circuit breaker towards the school portal (e889657)
• core: point the drift hint at doctor --verify (a1c3e3a)
• core: portal adapter — API first, headless browser where SchoolSoft has no API (#3) (3847afb)
• core: return validated domain objects from five operations (c0c3713)
• core: send every request to the portal through one budget per process (c7ac340)
• core: session history, read cache, durable refresh and opt-in keepalive (d845357), closes #8
• core: session longevity, offline half (history, read cache, durable refresh, opt-in keepalive) (0d8deec)
• core: user-facing error contract, silent recovery, background login (#7) (69aa6b2)
• core: user-facing error contract, silent session recovery, background login, swedish messages (1ec8a8d)
• core: verify every typed read operation against the live portal without keeping data (afc0857)
• core: version config, session and history files and refuse newer ones (fabac8c)
• core: versioned state and config files, refusing ones from a newer build (b6f9686)
• core: web login session for SchoolSoft's GDPR-gated pages (143c924)
• guardian data layer (Eva + webview REST), child-in-focus, messages tools (b083d9d)
• http: add parent-hosted connectors, calendars and setup guides (5310830)
• http: add parent-hosted OAuth connectors (73ad1ed)
• http: generate read-only REST routes and the session endpoint from the registry (4d4d0a6)
• http: generated REST read routes and a session endpoint for custom UIs (6b68113)
• http: mark runtime refusals with a reason and refuse ungranted children earlier (a5df841)
• http: tell apps and the parent when the school portal pushes back (3a8d02a)
• http: version the connector's encrypted repositories inside the payload (9c175cf)
• plugins: marketplace, mcpb manifest, per-host skill metadata, validators (2ba06f3)
• skill: schoolsoft skill with generated command reference (6805a59)
• two-surface foundation — one core, MCP + CLI/skill, host plugins, docs, CI (#1) (66de77d)

Bug Fixes

• auth: persist JWT expiry, refresh on unknown expiry, retry once on 401 (dfcdb97)
• auth: use the parent login route instead of ssp-node's hardcoded student route (7820da1)
• auth: user-type-aware token→cookie exchange; keep tokens if exchange fails (6b9442e)
• ci: do not fail the closed-PR hook when a run finished before it was cancelled (9612423)
• core: escape the callback error page in its new home (merge main) (452cef2)
• core: escape the identity provider's error text on the callback page (0ad9e25)
• core: web login watches every tab, the IdP may continue in a popup (e64d691)
• gitignore e2e-report.md (stray echo -e artifact) (86d6023)
• http: address authentication scan findings and CI drift (0ee129a)
• http: compare the owner password in a fixed-size slot, without a hash (2514e94)
• http: compare the owner password in constant time regardless of length (24b2317)
• http: harden the connector before live acceptance (c2bc046)
• http: rate limit the portal callback and warn about unsolicited consent links (7938024)
• http: revoke on authorization code replay and let anonymous caps make room (e56cec2)
• http: trust no forwarding header by default and never refuse the owner (230aff9)