v0.6.1

v0.6.1 (2026-07-04)

Features

• http: Add read-only GET /v1/config with mad_get_config MCP parity (ece94c4)

Expose the server's effective operational configuration for operators and agents. Builds on the centralized settings module (#97): the endpoint serializes the resolved Settings snapshot.

• GET /v1/config returns a typed ConfigResponse (hard rule 9): each operational MAD_* tunable as {value, source} where source is env | default (agent timeout, sessions dir/retention, SSE heartbeat, MCP allowed hosts, workspace dir, hook socket, CLI bins). - Credentials are NEVER returned — not even masked. Only set/unset booleans appear under credentials (GITHUB_TOKEN/GH_TOKEN, ANTHROPIC_API_KEY, CLAUDE_CODE_OAUTH_TOKEN, AWS_ACCESS_KEY_ID) (hard rule 2). - Mirrored MCP tool mad_get_config calls the SAME GetConfigUseCase and returns the SAME ConfigResponse model (hard rule 13); the parity and drift tests stay green. - Read-only by design: no write path, no hot reload — the durable owner is the host .env (issue #107).

Use case core/config/use_cases/get_config.py reads the settings snapshot fresh through an injected provider (default load_settings), so the endpoint reflects the process environment at request time and stays testable.

Tests (eight heuristics): OpenAPI contract test + read-only 405 negative twin, env-source vs default-source twins, and an explicit property test asserting a real GITHUB_TOKEN / ANTHROPIC_API_KEY in the env never appears in the HTTP or MCP response body.

Closes #107

Co-Authored-By: Claude Fable 5 noreply@anthropic.com

Claude-Session: https://claude.ai/code/session_01GWHBALtjHVd176YddWc9YP

Signed-off-by: Jose Salamanca jose.salamancacoy@gmail.com

---

Detailed Changes: v0.6.0...v0.6.1