aiterm-mcp v0.12.3

修正

• Grok/Composer の OAuth 正本を vendor 所有の GROK_AUTH_PATH で渡し、managed home の auth/lock symlink 競合を解消
• macOS の長いPTY入力をUTF-8安全なchunkで完全送信
• 同一sessionへの別process送信を直列化し、stale lockは送信前fail-closed
• runtime error store のlock置換判定をtyped分類へ修正

Linux/macOS/Windows CI、公開npm packageのMCP・Grok・Composer実smokeを確認済み。

aiterm-mcp v0.12.2

BugHub向けruntime error storeと工場診断を追加しました。Windowsのprocess identity・DACL・store試験を正規化し、Linux・macOS・Windowsの公開CIをgreenにしています。収集はローカルかつopt-inで、reporter未設定時は外部送信しません。

v0.12.1 — audit hardening sweep

Clears the remaining low-priority hardening notes from the v0.11.0 audit (docs/11 section C — now fully consumed). Regression suite 203 → 205.

Fixed

• Stop hooks now verify the writeSync return value when appending an event line; a short write (e.g. ENOSPC) is truncated back to the pre-write size and reported, so a fragment can never corrupt the next event line.
• latestAgentDoneEvent no longer goes silently blind past 1 MB of events: it reads a bounded 64 KB tail (dropping the first partial line), keeping agent_event_seen / last_turn_id metadata live on long sessions — and reading less than before for mid-size files.
• Non-agent sessions skip the agent-metadata directory probe on every pty_read via a 2-second absence-only negative cache (read-suffix path only; invalidated on openAgent / closeSession / killAll).

v0.12.0 — 全域監査の確定修正＋agent_transcript 回収

Multi-agent adversarial audit (find → refute → live smoke) of v0.11.0, plus the fixes and one feature that survived it. Audit digest & rejection ledger: docs/11_audit-2026-07-11.md; transcript-read design: docs/12_agent-transcript-read-plan.md. Regression suite 183 → 203.

Added

• pty_read({ agent_transcript: true }) — recover an agent session's most recently completed turn's final assistant message in plain text from the vendor's structured session transcript. Fixes long answers being truncated by the wait:"agent_done" screen tail (pane height ≈ 24 lines). Codex joins on the Stop-hook turn_id; Grok/Composer take the assistant rows after the last real user row. Explicit errors instead of silent empties.
• pty_list now marks agent sessions (agent=<kind> agent_done=true, plus vendor_session_id once bound) so a resumable agent session is identifiable after an MCP server restart.
• codex_agent launch responses surface the inherited managed-config reality (mcp_servers count, approval_policy, sandbox_mode, hook-trust bypass) so a "review-only" child isn't silently full-access.

Fixed

• Stale agent wait locks are now reclaimed (dead-pid liveness check); a crashed waiter no longer blocks wait:"agent_done" on that session forever. closeSession/killAll also honor live cross-process wait locks. Agent metadata writes are atomic (temp+rename).
• reduceOutput bounds over-long single lines, so a TUI's absolute-cursor repaint stream can't blow the response token budget past the line-count fold.
• UTF-8 start-boundary safety for mid-multibyte offsets (8 MB truncation & incremental reads) — no more leading U+FFFD.
• The pytest reducer no longer replaces non-pytest output with a fabricated "Pytest: No tests collected" (evidence guard; golden fixtures stay byte-exact).
• Destructive-command tripwire absorbs -- (rm -rf -- /) and re-checks the post-rtk-rewrite text.
• Inverted line_range ("5:3") is an explicit error instead of a silent empty.
• Quiescence completion attribution is now deterministic: the stability window is re-validated after the foreground-shell probe, so output landing during the probe is attributed to its mark/until instead of quiescent (found by CI on slow macOS runners).

Tests

tools/call dispatch coverage (unknown tool / bad args / inverted range), wait-lock reclamation, transcript recovery for both vendor shapes, line/byte guards, tripwire gaps. 203/203 green on ubuntu & macOS, Node 18/20/22.

v0.11.0 — GPT-5.6/Grok 4.5 モデル整合（model 引数・effort 実態合わせ）

GPT-5.6 / Grok 4.5 世代へのモデル整合リリース。

Added

• model argument on all three agent launchers. codex_agent forwards it as -m; grok_agent / composer_agent override --model. Empty/whitespace values are rejected before a session exists.
• Managed CODEX_HOME pin override. With agent_done: true, explicitly passed model / reasoning_effort also rewrite the matching top-level pins in the managed config.toml copy, so terminal pins (e.g. an ultra effort pin = proactive multi-agent delegation ON) no longer silently leak into interactive children. Unspecified keys and [table] sections are preserved verbatim.
• Effective-config reporting. Codex launch responses always state the effective model/effort and where each came from (argument / terminal-config inheritance / CLI default), with an explicit warning when the effective effort is ultra.

Changed

• grok_agent default model: grok-build → grok-4.5. The old slug no longer exists in the live model catalog.
• reasoning_effort on grok_agent / composer_agent is now a pre-launch error instead of a silent no-op: the grok CLI's --effort is headless-only (grok -p) and the interactive TUI warns and ignores it; Composer doesn't support reasoning effort at all. The former low/medium/high/xhigh/max enum is gone. codex_agent keeps an unconstrained string (CLI-version dependent, up to ultra).

Regression suite: 183 tests green (ubuntu / macos CI). Live-launch verified against Codex CLI 0.144.1 (GPT-5.6 Sol/Terra/Luna) and grok CLI 0.2.87 (grok-4.5 / grok-composer-2.5-fast).

v0.10.0 — Codex 初回 prompt wait

変更点

• codex_agent(prompt, agent_done:true, wait:"agent_done") を追加。
• Codex の起動時 prompt を shell argv に載せず、TUI ready 後に送信。
• 起動時 prompt が pending/sent の間は通常 pty_send を拒否して混入を防止。
• agent session の通常 read に initial_prompt / agent_event_seen / completion_attribution=none などの補助 metadata を追加。
• Grok/Composer の初回 prompt wait は post-OAuth smoke まで未公開。

検証

• npm test: 177/177 pass
• MCP tools/call 経由の Codex initial prompt wait smoke pass
• npm aiterm-mcp@0.10.0 publish 済み
• global install smoke pass

v0.9.1 - Codex managed home allowlist

Highlights

• Hardened Codex agent_done managed CODEX_HOME.
• The managed Codex home now only links auth.json, copies config.toml, and writes aiterm-owned hooks.json.
• Other normal ~/.codex entries such as state/cache/session files are no longer symlinked into the managed home.
• This keeps normal Codex hook files untouched while reducing write-through side effects from the managed launch environment.

Verification

• Tag/package verification: local npm test at the release commit passed 167/167.
• npm pack --dry-run --json: passed.
• npm publish --dry-run --access public: passed.
• GitHub Actions CI for tag v0.9.1: Linux, macOS, Windows, and npm publish passed.
• npm published as aiterm-mcp@0.9.1; npm latest points to 0.9.1.
• Post-release finalization on main: server.json was synced to 0.9.1, a release metadata version-sync test was added, and npm test now passes 168/168.
• Official MCP Registry published io.github.kitepon-rgb/aiterm-mcp version 0.9.1 as latest.
• Global install smoke passed for /opt/homebrew/bin/aiterm-mcp: initialize returned 0.9.1 and tools/list returned all 9 tools.

v0.9.0 - agent_done

Highlights

• Added hook-backed agent_done turn completion for codex_agent, grok_agent, and composer_agent.
• Added pty_send(wait: "agent_done") so callers can wait for the agent CLI turn boundary while keeping the persistent PTY model.
• Added managed Codex/Grok/Composer vendor homes so aiterm-owned Stop hooks are installed without editing the user's normal hook files.
• Hardened event matching, wait locks, hook event files, Grok auth lock handling, malformed JSONL handling, cleanup, and screen settling.
• Added a TUI-ready gate so the first unbound wait: "agent_done" send fails before sending text if the agent has not reached an input prompt.
• Documented platform support and usage in README, design docs, ADR, and RAG.

Verification

• Local npm test: 167/167 passed.
• GitHub Actions CI for tag v0.9.0: Linux, macOS, Windows, and npm publish passed.
• npm published as aiterm-mcp@0.9.0.
• Real MCP tools/call smoke verified Codex, Grok, Composer agent_done, plus a normal Python REPL PTY smoke.

v0.8.0 — 全域監査スイープ

全域監査スイープ（多エージェント Find → 敵対的 refuter 検証 → 7ウェーブ実装）。確定バグ 7 件修正＋磨き込み多数。テスト 97→128。

主なバグ修正

• pytest 収集エラーの誤変換を解消: read rtk:true で収集エラーを No tests collected/1 passed（赤を緑に偽装）に潰していた問題を修正。
• mark 完了検出のエコー誤爆を解消: pty_send(mark:true) の sentinel がコマンドエコーに部分一致し長時間コマンドを早期誤完了していた問題を、数字アンカー sentinel で免疫化。
• エージェント起動の破壊ゲート誤爆を解消: codex_agent/grok_agent/composer_agent の初手 prompt に rm -rf / 等の語を含めると起動が拒否されていた誤検知を修正。
• 破壊ゲートのすり抜け（rm -rf ./* 等）・セッションログの復活・UTF-8 境界分断・Windows の bin/cwd WSL 変換 も修正。

挙動変更（Breaking-ish）

• pty_read の until を既定でリテラル部分一致に（従来は正規表現）。正規表現は until_regex: true でオプトイン。
• pty_send(mark:true) は pty_read(wait:true) が until 無しでも完了を自動検出。
• エージェント起動のフラグ・モデル ID（grok-build/grok-composer-2.5-fast）を実 CLI で裏取り済み。

CI / Infra

• ネイティブ Windows CI（非ブロッキング）追加、registry publish の順序堅牢化、テストのフレイキー解消。

詳細は CHANGELOG と docs/03_audit-sweep-2026-07.md。

v0.7.1 — agent launcher hardening

Codex independent review (5 findings) + 2 more found in re-verification. openAgent now validates all prerequisites (effort → CLI bin → cwd) before creating a session and never leaves a leftover session on failure; grok/composer reasoning_effort is schema-enforced (low/medium/high/xhigh/max); pipe-pane failure is detected (no more silently unreadable sessions); auto-naming falls back to nonce names under concurrency (20/20 unique in a 20-process race); codex_agent description no longer claims a pinned model. 97/97 tests. See CHANGELOG for details.