v0.2.2

v0.2.2

18 new features and 39 fixes. The theme of this release is state that more than
one request touches at the same time: starting, stopping, saving and installing
now say what actually happened instead of what was hoped for.

Endpoints and reachability

• One endpoint per category — every instance in a category behind a single
  MCP URL, so a client registers one connection instead of sixteen.
• Instance endpoints on the manager port — /mcp/<id> without a second
  listener. Off by default: it makes a localhost-bound instance reachable
  from outside, and that door is opened by a person, not by an upgrade.
• Both can answer on the manager port, on a port of their own, on both or on
  neither — one decision per way in. The category URL segment is a setting.

Operating the installation

• Backup and restore of the manager state — configs, tool code, settings,
  identity policy — with or without credentials.
• Health check that asks the MCP server whether it still replies, instead of
  asking the OS whether the process exists.
• System monitor (CPU, memory, disk, network) plus a per-instance RAM
  column, sortable; status filter and pagination on the dashboard.
• Test call from the dashboard — real code, real credentials, refused on a
  locked instance.
• File storage: an instance that opts in gets content/<id>/, with download
  links that work from a chat client.
• Agent identities — one token per calling agent, so Claude Code, Codex and
  a cron job stop being the same caller. Callers can be removed, not just
  forgotten: entry, rules and token.

For the small models on the other end

• A wrong parameter name now says which one was meant — including the
  nearest real name, any missing required one, and what the tool actually takes.
  It sits in the runner, so every tool reached through this framework gets it.
• Control tool v0.0.13 — list_instances answers in one line per instance
  with the full records behind detail=True; categories, agent identities and
  backup status are reachable at all now.
• manager_url fills itself in instead of defaulting to an address that is only
  right on the machine it was written on.

Fixed

Most of these were found by review or by pointing the finished UI at a running
manager, not by the suite:

• Concurrency: a confirmed stop that left a runner running; a stop that
  deregistered the runner replacing it; a start overtaken by a later one
  publishing its own dead pid; two creates of the same id both answering ok;
  a long save writing a minutes-old config back over newer changes.
• Secrets: a list of plain secrets that was not masked at all; a masked
  value in a list filled back in by position; a backup taken without secrets
  that carried one anyway; keywords redacted because key is a substring
  of it.
• Permissions: an explicit ban ignored where the default was open; removing
  a caller handing their access back through the signed role; a restore dropping
  roles and the global rules.
• Honest answers: a failed restart reported as a completed one; a repeated
  failed install reporting success; a setting that could not take effect
  reported as saved; a restart warning claiming the old runner was still
  serving.
• The suite itself: it wrote into the live settings file, counted its own
  calls into the live usage database, and deleted real files. Each is fixed and
  each has a guard now.
• Copying to the clipboard never worked over plain HTTP — which is how this
  manager is normally reached.

Requirements

The runner is on the MCP SDK 2.x Server API and refuses to start on an
older line rather than failing later. A runner environment created before
this release may still hold MCP 1.x — upgrading the manager does not upgrade
it. See docs/upgrading.md before restarting instances.

Verified on a fresh installation: Python 3.11, FastAPI 0.141.1, MCP SDK 2.2.0,
787 tests green. See docs/fresh-installation.md.
Full detail in CHANGELOG.md.