v0.3.0

Changelog v0.3.0

All notable changes to kprun are documented in this file.

The format is based on Keep a Changelog,
and this project adheres to Semantic Versioning.

[0.3.0] - 2026-07-04

Added

• kprun mcp — native stdio↔HTTP bridge for hosted MCP servers: vault-backed
  {{FIELD}} auth headers, Streamable HTTP with session management, automatic
  fallback to the deprecated HTTP+SSE transport (#25)
• {{FIELD}} template substitution in vault entry fields (e.g. bearer tokens and custom headers)
• Non-interactive vault unlock for automation (KPRUN_KEYFILE or OS keyring only; no stdin prompt)

Changed

• README documents kprun mcp bridge, transport options (auto, streamable-http, sse), and client config examples
• README documents kprun mcp caveats found during manual testing

Fixed

• GET stream survives session re-init: shared session id with retry on 404 instead of exiting permanently
• JSON-RPC: no duplicate -32603 error when an SSE stream errors after a result was already forwarded
• SSE reader-thread failures log the underlying error to stderr instead of failing silently

Security

• Bumped keepass to 0.13.11, pulling quick-xml 0.41.0 and fixing RUSTSEC-2026-0194
  and RUSTSEC-2026-0195 (high-severity memory-exhaustion DoS in NsReader)

---

Full commit list

• fix(mcp): survive session re-init on GET stream
• docs: fix --transport sse value in README
• docs: document kprun mcp bridge
• feat(mcp): legacy HTTP+SSE transport with auto fallback
• feat(mcp): session re-init, error frames, GET stream
• feat(mcp): add streamable HTTP bridge
• test(mcp): add scriptable mock MCP HTTP server
• feat(mcp): add shared SSE parser
• feat(cli): add kprun mcp subcommand surface
• feat(core): add non-interactive vault unlock
• feat(core): add {{FIELD}} template substitution
• docs(readme): add mcp caveats from manual test findings (#39)
• chore(deps): bump keepass to 0.13.11 to fix quick-xml advisories (#40)