Skip to content

v0.13.1 — Relay and OAuth hardening

Latest
Latest

Choose a tag to compare

View all tags
@steipete steipete released this 09 Aug 00:32
· 2 commits to main since this release
v0.13.1
This tag was signed with the committer’s verified signature.
steipete Peter Steinberger
SSH Key Fingerprint: WmI9lVtd7F2c5XyRHbZVO3yYYJzwsSNzcZQMPT147HI
Verified
Learn about vigilant mode.
3df0af4
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

CLI

  • Authenticate OpenClaw extension-backed Chrome control with Browser Relay Authentication v2 over one retained loopback socket from HMAC challenge through CDP upgrade, never transmitting the host key or retrying legacy relay auth, while preserving configurable prefer / require / off routing and the OS-protected one-use child handoff.

  • Tear down both sides of streamed mcporter serve --http responses on client aborts or body errors, preventing orphaned readers. (PR #280, thanks @SebTardif)

Daemon

  • Invalidate keep-alive Chrome DevTools state when relay policy, URL, timeout, OpenClaw credential paths, or the derived relay keyId change, keep require fail-closed across retries, and expose the last safe relay decision in mcporter daemon status.

  • Keep the daemon alive after asynchronous log-file ENOSPC/EIO failures by handling writer errors immediately and falling back to console logging. (PR #280, thanks @SebTardif)

OAuth

  • Honor MCPORTER_OAUTH_NO_BROWSER across serve/daemon OAuth flows, fail once with actionable reauthorization guidance without logging authorization URLs, and restart daemons when the normalized setting changes. (PR #284 / issue #283, thanks @vitalijssilins)

  • Accept RFC 7591 dynamic-client-registration arrays and timestamps in mcporter vault set while preserving null-compatible partial client information and provider metadata. (PR #288 / issue #286, thanks @feniix)

  • Sanitize malformed mcporter vault set JSON diagnostics and reject non-finite expires_at / expiresAt token values before persistence. (Follow-up to PR #287, thanks @Yigtwxx)

Tooling

  • Refresh pnpm, GitHub Actions runtimes, and mature security overrides for fast-uri, Hono, ip-address, and nanoid.

  • Remove the obsolete scoped-commit helper and use standard Git commands in isolated worktrees.

Verification

Assets 7
Loading