v0.0.39

Install

brew install stacklok/tap/mecatl

Installs both mecated (the server) and mecatui (the terminal UI).

Changelog

Features

• d2200ab: feat(mecated): streamline direct MCP OAuth onboarding (#1689) (@jhrozek)
• 2eba2cc: feat(provider): ask for the prompt cache through the protocol, not the vendor (ADR 0346) (#1573) (@aponcedeleonch)
• 5b0db5a: feat(sdk): add MCP authorization lifecycle (#1692) (@samuv)
• 0bf37d0: feat(sdk): add run-ID-addressed controls (#1642) (@samuv)
• 4c31f11: feat(sdk): expose MCP workspace enrollment (#1690) (@samuv)
• 9ccf838: feat: complete provider setup UX on unified configuration (#1441) (@JAORMX)
• d144947: feat: configure command runners (#1605) (@jbeda)

Fixes

• 0fe7b47: fix(acceptance): resolve stale ac-trace proofs (#1600) (@jbeda)
• 37d0d74: fix(acceptance): update ac-trace for proposed plans (#1591) (@jbeda)
• 5a47fdf: fix(app): give custom-provider context-window failures an actionable message (#1646) (@jhrozek)
• e492ab4: fix(cliconfig): explain stale provider credential IDs (#1665) (@jhrozek)
• 0f81ec7: fix(docs): update SDK callback authority trace (#1672) (@jbeda)
• 4a20eb4: fix(engine): record advertised tool schema bytes (#1677) (@jhrozek)
• 2f33adf: fix(mcp): authorize client-registered MCP tools in session capability set (#1627) (@kantord)
• fbefea1: fix(mcp): separate OAuth login and handshake deadlines (#1624) (@jhrozek)
• 96c11c2: fix(mecatui): clarify TUI dialog copy (#1655) (@danbarr)
• 77c381a: fix(mecatui): clarify provider onboarding (#1636) (@danbarr)
• f295b43: fix(mecatui): clarify session handoffs (#1657) (@danbarr)
• 853ed2b: fix(mecatui): clarify trust and memory copy (#1656) (@danbarr)
• 47af20b: fix(mecatui): give a clear error for an invalid custom provider name (#1628) (@jhrozek)
• 8227371: fix(mecatui): handle model selection in worktrees better (#1567) (@kantord)
• 389d18d: fix(mecatui): make the newline chord reachable and the hint honest on every terminal (#1550) (@aponcedeleonch)
• 5daad13: fix(mecatui): simplify in-TUI help (#1664) (@danbarr)
• 0d53864: fix(mecatui): simplify mode-specific CLI help (#1654) (@danbarr)
• 6a392dd: fix(opencode): send required session header (#1652) (@jhrozek)
• 6c75a42: fix(perf): compact long-horizon trend history (#1640) (@danbarr)
• a60ad34: fix(providers): honor live custom model input modalities (#1659) (@jhrozek)
• d1b659c: fix(sdk): decode daemon HTTP timestamp and duration objects (#1686) (@samuv)
• 23adf32: fix(site): restore mobile navigation drawer (#1704) (@samuv)

Other changes

• a711451: Release v0.0.39 (#1727) (@toolhive-release-app[bot])
• 7cf4e5d: Update README with conda-forge installation method (#1703) (@keponk)
• 2b07145: build: simplify Helm unittest setup (#1599) (@ChrisJBurns)
• f29d734: mecak8s: make operator flag help concise and actionable (#1669) (@danbarr)
• b8bb85d: mecated: simplify command and flag help (#1667) (@danbarr)
• a54a5ba: mecatequi: simplify CI help and exit guidance (#1668) (@danbarr)
• dd6f5bc: perf(osfs): reduce stateless Grep scanning allocations (#1625) (@JAORMX)
• 1712363: perf(productmetrics): export metrics every 30m instead of 60s (#1610) (@Nashon-Steffen)
• 2c1605f: perf: reuse overlay rendering work and stabilize test fixtures (#1576) (@JAORMX)
• 498971e: plan(sdk): harden malformed-success decode errors (#1698) (@samuv)
• 110017f: plan: SDK HTTP well-known-type JSON compatibility (#1684) (@samuv)
• ad1cfe3: plan: TypeScript SDK MCP authorization lifecycle (#1687) (@samuv)
• a8dc61e: plan: ask for the prompt cache through the protocol, not the vendor (ADR 0346) (#1572) (@aponcedeleonch)
• 297817d: plan: bounded mecatui scroll and cursor controls (#1593) (@jbeda)
• b9f8cc5: plan: direct MCP onboarding (#1626) (@jhrozek)
• 39aecc9: plan: expose SDK MCP connector enrollment (#1688) (@samuv)
• 2a0c9cb: plan: mecatui-owned configurable terminal titles (#1616) (@jbeda)
• 7cfce15: plan: run-ID-addressed SDK controls (#1635) (@samuv)
• 12a7ef1: refactor(engine): drop the deprecated Subagent max_tokens argument (#1634) (@blkt)
• e14c88d: slack-bot: DM manual permission approvals instead of auto-approving (#1707) (@kantord)
• 9ac4798: slack-bot: relabel "Allow always" button to "Allow for session" (#1724) (@kantord)

Verify

cosign verify-blob \
  --certificate-identity 'https://github.com/stacklok/mecatl/.github/workflows/release.yml@refs/tags/v0.0.39' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --bundle checksums.txt.sigstore.json checksums.txt
sha256sum --check --ignore-missing checksums.txt
gh attestation verify mecatl_0.0.39_darwin_arm64.tar.gz --repo stacklok/mecatl