v4.31.2

4.31.2 (2026-08-28)

Bug Fixes

• auth: pass Chrome cookie path via argv, not python -c (#4362) (8523d5a), closes #4281
• auth: same-origin redirect policy for OAuth token exchanges (#4378) (f3855b7)
• cli: apply reserved-name gate to novel-feature command names (#4298) (6870e64)
• cli: disambiguate collection vs item command stems (#4294) (62b8950)
• cli: do not kill streaming transfers with the default timeout (#4334) (50ed53c)
• cli: do not preserve files that reintroduce a fresh-generation build break (#4300) (6c9e737)
• client: bind cookie credentials to https canonical host for every token source (#4363) (ea85b49)
• client: treat scheme as part of the origin before replaying auth credentials (#4292) (1eecefc)
• cli: extract items from map-keyed collections (#4335) (81d5a6b)
• cli: fail loud when a JSON endpoint returns HTML (#4391) (a1494f3)
• cli: keep env OAuth secrets out of config.toml (#4393) (e0e0107)
• cli: key response-path unwrap on resource+endpoint identity (#4301) (54360bd)
• cli: normalize text spec checksums (#4264) (4bfd0ec)
• cli: re-mint client_credentials on 401 and unwrap mutation-output envelopes (#4392) (3c9a017)
• cli: rewrite go.mod and name tokens on publish rename (#4333) (1a4ece3)
• cli: send spec-declared query param defaults from sync (#4343) (2880827)
• cli: skip JSON guard on binary response bodies (#4293) (ac1bd4a)
• cli: warn or carry templated hand-edits on cross-spec --force (#4299) (f094593)
• generator: add missing Example to feedback command template (#4290) (bd9fab0)
• generator: fail-closed mcp:read-only for GET RPCs without a mutation signal (#4361) (401a590)
• generator: honor patch records across regen (#4332) (54ad99e)
• mcp,auth: require HTTP MCP caller auth and stdin set-token (#4360) (f2dc1e5)
• mcp: include internal/config env reads in manifest operator declaration (#4377) (56e2e46)
• profiler: stop using page-size defaults as sync pageSize (#4380) (86c6b3d)
• store: nested/id_/unusable record-ID resolution (#4379) (2c57c2e)
• store: stop concurrent-reader SIGBUS on WAL-index mmap (#4359) (74fea21)
• sync: honor per-endpoint base_url overrides (#4331) (3cd6cba)