Skip to content

Engineering Bridge v1.6.0

Latest
Latest

Choose a tag to compare

View all tags
@wudy29 wudy29 released this 28 Oct 03:11
v1.6.0
6e1b53f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

中文

Engineering Bridge v1.6.0 新增中文本地只读任务看板，改进 Codex 启动兼容性与中断诊断，并完成发布前的依赖安全更新。

中文只读看板

  • 新增独立的中文任务看板，结合生产者心跳，仅将可确认的新鲜 queued / running 任务列为当前任务。
  • 将待审阅、已结束及过期或来源未知的历史任务分区折叠展示。
  • 支持显式提供的公开任务标题和工作区显示名称，不从私有指令、输出或诊断信息中生成标题。
  • 新增浏览器本地的历史卡片隐藏与恢复功能；不会删除磁盘记录或改变任务执行状态。
  • 看板仅通过 127.0.0.1:4317 提供只读 HTTP GET，不具备远程认证机制，不应暴露到公网。

Codex 兼容性与诊断

  • 保留 PATH 优先的 Codex 命令解析；POSIX 环境在适当条件下支持从 HOME/.local/bin/codex 回退启动。
  • 保留 Windows 原生及 npm shim 的启动兼容路径。
  • 改进有界错误通知摘要，以及首次本地中断前的诊断快照。
  • 不改变既有任务控制、审批和超时语义。

安全依赖更新

最终发布版本包含：

  • @modelcontextprotocol/sdk 1.32.2
  • zod 4.6.7
  • body-parser 2.4.0
  • fast-uri 3.1.9
  • hono 4.13.14
  • ip-address 10.7.5

另包含必要的兼容传递依赖更新。

这些更新解决了此前发布审计发现的六项依赖告警。2026 年 10 月 28 日使用官方 npm Registry 执行的完整依赖及生产依赖审计均返回零漏洞。此结果仅代表该审计时点，不保证未来没有新公告。

兼容性与验证

  • 15 个 MCP 工具的公开 Schema 保持一致。
  • 每侧 546 次真实 STDIO 对照调用的接受、拒绝和错误分类一致。
  • 历史异步验证记录的重点兼容回归通过。
  • Zod 4 改变了部分输入校验诊断措辞。242 项输入错误中有 236 项文字不同，但 MCP 输入错误码仍为 -32602；292 项业务错误的完整公开响应一致。不保证原始输入错误文本逐字兼容。
  • 最终 main Commit：6e1b53f1297116b8dce996d29a7291917c357b61。
  • 最终 main CI：Ubuntu 767 PASS / 0 FAIL / 4 SKIP；Windows Server 2025 为 664 PASS / 0 FAIL / 104 SKIP。

安全与使用边界

保留 15 工具 MCP 接口及独立的 APPLY、COMMIT、AUTHORIZE 等授权门禁。

异步 controlled-patch validation 仍依赖 POSIX 进程组监督；Windows 不支持该异步执行路径，旧同步与其他工具保持既有行为。

Bridge 重启后，遗留非终态异步验证不会自动恢复执行。看板观测信息不等于持久任务控制或审计日志。

本次 GitHub Release 不代表 npm 发布，也不代表个人生产环境已完成升级或验收。

English

Engineering Bridge v1.6.0 adds a Chinese local read-only task dashboard, improves Codex startup compatibility and interrupt diagnostics, and includes reviewed dependency security updates.

Dashboard and observations

  • Adds an independent Chinese read-only dashboard using producer heartbeats to distinguish currently confirmable queued/running tasks from history.
  • Separates review, completed, and stale or unknown-producer entries into collapsible groups.
  • Supports explicitly public task titles and workspace display names without deriving labels from private instructions, output, or diagnostics.
  • Provides browser-local hide/restore controls without deleting disk records or changing canonical task state.
  • Serves read-only HTTP GET routes on 127.0.0.1:4317. The listener is not authenticated and must not be publicly exposed.

Codex compatibility and diagnostics

  • Preserves PATH-first Codex resolution with a guarded POSIX fallback to an executable HOME/.local/bin/codex.
  • Retains Windows native and npm-shim compatibility.
  • Adds bounded error-notification summaries and preserves the first local pre-interrupt diagnostic snapshot.
  • Does not change existing supervision, write-approval, or timeout semantics.

Dependency security

The final release locks MCP SDK 1.32.2, Zod 4.6.7, body-parser 2.4.0, fast-uri 3.1.9, Hono 4.13.14, and ip-address 10.7.5, plus necessary compatible transitive updates.

The six dependency findings detected at the earlier release gate were resolved. Full and production npm audits against the official registry reported zero vulnerabilities on October 28, 2026. Audit results are time-specific and do not guarantee immunity from future advisories.

Compatibility and verification

  • All 15 public MCP tool schemas match the frozen baseline.
  • 546 actual STDIO calls per side preserved the tested acceptance/rejection classifications and error boundaries.
  • Historical retained-validation record compatibility tests passed.
  • Zod 4 changes raw input-validation diagnostic wording in 236 of 242 tested input-error cases. MCP error code -32602 remains unchanged, and all 292 tested business-error responses match. Raw validation error text is not byte-for-byte compatible.
  • Final main commit: 6e1b53f1297116b8dce996d29a7291917c357b61.
  • Final main CI: Ubuntu 767 passed / 0 failed / 4 skipped; Windows Server 2025 664 passed / 0 failed / 104 skipped.

Safety and release boundaries

The existing 15-tool MCP interface and explicit APPLY, COMMIT, and AUTHORIZE gates remain intact.

Async controlled-patch validation still requires POSIX process-group supervision; the native Windows async execution path remains unsupported. Interrupted non-terminal validations are not automatically resumed after a Bridge restart.

This GitHub Release does not constitute npm publication or acceptance of any personal production deployment.

Assets 2
Loading