Skip to content

v1.5.0 - Credential isolation and configuration integrity

Choose a tag to compare

View all tags
@haiqigeng haiqigeng released this 20 Jul 17:06
· 2 commits to main since this release
v1.5.0
397ae5d

Highlights

  • Isolates each local MCP process to the environment keys declared for its selected tool/provider instead of exposing the complete local credential map.
  • Fingerprints Codex managed TOML blocks so Apply and reset preserve analyst modifications; exact v1.4-generated blocks migrate safely.
  • Installs only selected-provider runtimes, does not upgrade a healthy Node.js runtime, and no longer installs unrelated Git.
  • Emits documented remote MCP configuration for Claude Code and Gemini CLI, including environment-backed bearer headers where required.
  • Replaces broad analytics-account inventories with target-first, minimally disclosing read-only smoke tests.
  • Expands regression coverage from 26 to 36 tests and updates CI to the current official Node 24-based checkout action.

Upgrade Notes

  1. Update the skill, then run Apply -Client Selected -Preview before the real Apply.
  2. An unchanged v1.4 Codex managed block is recognized and migrated. A block changed by the analyst is preserved and Apply stops for explicit review.
  3. Run CheckMcpUpdates before Apply when local MCP packages are selected, then reload the configured client.
  4. Existing ignored credentials, tokens, package locks, evidence, and machine-specific state remain local and are not part of this release.

Verification

  • GitHub Actions: passed on commit 397ae5d with PowerShell 7 and Windows PowerShell 5.1.
  • Pester: 36/36 tests passed.
  • JSON schemas, PowerShell parsing, fixture tests, catalog review, and skill metadata: passed.
  • Release audit: passed; no local credential/runtime files in the 35-file tracked archive.
  • Audited archive SHA256: 7AC243B9027B85FBDB212D56CDFE2D090DA31D6F2E0C63F9F4529785DD312F96.

See README.md for first use and CHANGELOG.md for the complete change list.

Assets 2
Loading