v2.5.0

Multi-provider expansion + the foundation for the Servonaut Cloud account
and MCP relay. No breaking API changes.

Highlights

OVHcloud is the second first-class provider

Dedicated servers, VPS, and Public Cloud all managed from the same
instance list as AWS EC2. Guided setup via servonaut --setup-ovh, and
a sidebar section for DNS zones, IP management, snapshots, block
storage, billing, SSH keys, and Public Cloud instance creation. 206 new
tests covering the full OVH surface.

Servonaut Cloud account

Sign in from the TUI's Account screen to enable:

• Config sync — client-encrypted snapshots of your config.json
  pushed to / pulled from servonaut.dev. Passphrase never leaves your
  client.
• MCP relay (foundation) — Servonaut now establishes a Mercure SSE
  connection to servonaut.dev on login. The backend sees the CLI as
  online and can dispatch MCP tool calls through the relay channel; the
  agent-facing dispatcher and hosted tool surface ship in an upcoming
  release.

MCP relay infrastructure

The TUI opens an in-process relay listener for the lifetime of the TUI
window. For always-on reachability, run servonaut connect --bg — the
CLI and TUI cooperate over ~/.servonaut/relay.lock so they can't both
listen at once.

New servonaut connect subcommand family:

• --bg / --stop / --status — background listener + backend-view
  status (flags divergence when heartbeats aren't landing).
• --reconnect — heal a stale SSE socket (stop + start).
• --force-bg — SIGUSR1 a TUI's in-process listener to hand over to a
  detached bg listener.

MCP tool additions

New tools registered on the local MCP server:

• Session: whoami (no token leak), api_request (authenticated
  REST proxy with 401-refresh, 1 MiB cap, 30/min rate limit, header
  allowlist).
• Relay: relay_status (backend view), relay_reconnect (heal
  stale connection, idempotent on healthy), mcp_tool_call (JSON-RPC
  2.0 wrapper for hosted MCP — used by future hosted tools).
• OVH (read-only introspection): ovh_ssh_keys, ovh_invoices,
  ovh_firewall_rules. Additional OVH tools exist but are being
  refined and will be featured in a later release.

The built-in TUI chat now delegates to the same ServonautTools
implementation as the MCP server — single source of truth in
src/servonaut/mcp/tool_schemas.py. Fixes a bug where the chat
couldn't see OVH or custom servers.

Security

• ~/.servonaut/auth.json chmod'd to 0600 with atomic writes. Older
  world-readable files are silently fixed on next load.
• Relay lifecycle log (~/.servonaut/logs/relay.log) redacts
  authorization / token / secret / api_key values and detects
  Bearer / JWT content on unrecognised keys.

Smaller wins

• Per-host extra_ssh_options for legacy boxes
  (HostKeyAlgorithms=+ssh-rsa, custom keepalives).
• Login modal widened and the verification URL wrapped in a real OSC 8
  hyperlink so clicks open the full URL regardless of wrapping.
• Unreleased plan features (Premium AI / GCP / Azure / Teams) filtered
  from the login screen until they ship on the CLI.

Upgrade notes

• No config migration required — all new keys are optional with
  defaults.
• Users who previously ran servonaut connect --bg manually can keep
  doing so; the TUI will detect the existing listener and report
  external listener (PID N) instead of starting a duplicate.
• Free-tier users see an "Upgrade to connect" indicator in the sidebar
  after logging in — no Mercure fetch is attempted, so there's no
  network cost to seeing the indicator.

Under the hood

• 1599 tests (up from 718 at v2.4.13). New suites: test_relay_lock,
  test_relay_manager, test_relay_log, test_mcp_whoami,
  test_mcp_api_request, test_mcp_relay_reconnect,
  test_mcp_relay_status_and_tool_call, test_main_relay, plus
  expansions to test_auth_service and test_chat_tools.
• Tool registration centralised: adding a new tool = one entry in
  tool_schemas.py + one method on ServonautTools. Chat and MCP
  surfaces pick it up automatically.

Full changelog: v2.4.13...v2.5.0