Durable Thinking v3.1.2

Distribution metadata release.

• Adds an official MCP Registry manifest for deploy-your-own remote Workers.
• Publishes Registry metadata from GitHub Releases with secretless GitHub OIDC authentication.
• Pins and checksums the Registry publisher instead of executing an unversioned download.
• Keeps npm publication disabled because Durable Thinking does not ship a local stdio executable.

The live OAuth reliability fixes from v3.1.1 remain unchanged.

Durable Thinking v3.1.1 — hosted-client OAuth reliability

OAuth reliability release for hosted MCP clients.

Fixed

• Allows the consent form's same-origin POST to follow its redirect to GitHub without weakening the rest of the page CSP.
• Replaces eventually consistent KV-backed consent and callback state with short-lived HMAC-authenticated state.
• Retries transient authorization-grant reads during hosted-client token exchange.
• Preserves path-specific protected-resource discovery for /mcp and /mcp-compat.
• Allows Claude and ChatGPT web origins by default while rejecting unrelated browser origins.

Verification

• Confirmed the complete GitHub OAuth flow and authenticated Claude connection in production.
• Added regression coverage for DCR, S256 PKCE consent, CSP, CORS, and protected-resource metadata.
• Passed all 36 tests, TypeScript checks, MCP App and server-contract checks, and the Wrangler production build.

Use https://<worker-host>/mcp-compat for current hosted web clients. See the updated README for setup and troubleshooting details.