Automatic 1.35.1

Added

• A new automatic_set_mcp_server_enabled tool lets an agent enable or disable one of a project's MCP servers. It refuses the automatic server, a server the project does not use, and a server that an attached profile provides. Run automatic_sync_project afterwards. (1f3508c)
• Codex supports the Interrupt hook event. The Hooks event picker offers it, and sync writes it to .codex/hooks.json. (b96ded7)
• The Pi agent now shows a note about MCP servers. The pi-mcp-adapter blocks project servers until you approve them in Pi, so a synced server may not start until then. (0981712)

Changed

• The task log is stored in SQLite at ~/.automatic/task_log.db. An existing task_log.json is imported once and renamed to task_log.json.migrated. (1b6b457)
• The bundled library is now v0.2.1. Its rules tell agents to fix a defect they find instead of reporting it and leaving it open. (adc92e5)
• Debug builds keep secrets in ~/.automatic-dev/dev-secrets.json instead of the OS keychain. Release builds still use the keychain. This is for developers only. (b3a9681)

Fixed

• Project sync no longer lets a project's agent files overwrite a saved MCP server. A repository's .mcp.json could replace a saved server's URL and headers, and every project that used the server picked up the change. A discovered server is now added only under a name the registry does not hold. A hand edit to a server in an agent file is no longer copied back. Sync writes the saved config over it. (92d4d5b)
• The GitHub server from Discover now installs with its Authorization header. The token stays in an environment variable and is never written to disk. Sync rewrites the variable reference for Cursor, OpenCode and Codex. The server editor shows which variables a header uses. (17fedb0)
• A failed read of an MCP server config is no longer treated as a missing server. A locked keychain or a denied prompt used to make cloud sync delete the server from the cloud library, make project sync drop it from agent files, and make a pull save empty values over stored secrets. These cases now stop with an error that names the server. A failed registry listing stops the same way. Sync checks the registry before it changes any file. (ee23394, 95147d5, 3a166e0)
• A failed cloud sync write no longer causes data loss. Before, the next sync could delete the asset from the cloud library or upload the older local copy over the newer one. (6ef58f9)
• A denied or locked keychain can no longer replace the env-encryption key. This used to leave every encrypted MCP server value unreadable. A decrypt with no stored key now reports the missing key and creates nothing. (2a5808b, 0daef59)
• On Linux, secrets are stored in the Secret Service over D-Bus. The kernel keyring was emptied on reboot, which lost the env-encryption key, API keys and OAuth tokens. Secrets in the old store are copied across when they are read. If the Secret Service is missing, the error says what to set up. (cc43182)
• Revoking an MCP server's OAuth token now also deletes its client id and refresh token. A failed delete stops the revoke, so you can retry. (055add8, 61b98e5)
• A server config found in a project file can no longer carry an env value that looks like ciphertext. Such a value is stored as empty. Before, it made cloud sync and that project's sync fail until you deleted the server. (27f1c06)
• An MCP server's OAuth token is now stored under the server's name and its URL, so the token is only sent to the URL it was issued for. Deleting a server deletes its OAuth token and credentials. Renaming it moves them. Saving it with another URL deletes them. Before, a new server created under a deleted server's name looked signed in and was sent the old token. A token from an older version moves to the new entry the first time it is used at the server's saved URL. If you go back to an older version, sign in to the server again. (dc1f628, b0fe6a6, 1284a3b)
• Installing from a remote source now checks the repository name, the resource names and the manifest paths. A manifest could name a resource such as ../../../x and write a file outside the library, or point at a file outside the clone. A name that ends with a dot is refused, because Windows drops the dot. (56e6694, b3db806, 784a7d6)
• On Linux, a locked keyring no longer makes a stored secret look missing, which could have replaced the env-encryption key. The old kernel keyring copy is removed once the Secret Service holds the value. Two copies of Automatic that start together no longer race while they move a secret. (3d718c6, 80b24b4)
• The OpenCode restart banner on the MCP Servers page stays dismissed. (da9f039)