Melange CLI/MCP v0.4.0

Changelog

• afc7194 Add instructions for updating the agent skill
• 5cbd721 Add update instructions for melange-cli
• 459e0bb Enhance README with CLI update instructions
• dd72a29 Merge branch 'feat/mcp-evals' into feat/mcp-docs
• 3c89bce Merge branch 'feat/mcp-http' into feat/mcp-upload
• 2dd1f99 Merge branch 'feat/mcp-oauth' into feat/mcp-evals
• 6aa1e53 Merge branch 'feat/mcp-upload' into feat/mcp-oauth
• f1c2809 Merge feat/mcp-core: melange mcp stdio server, 17-tool catalog (#5)
• a98f593 Merge feat/mcp-docs: registry, client setup, llms.txt, connector prep (#10)
• 5f2dbd8 Merge feat/mcp-evals: eval harness, live e2e, hardening (#9)
• e2c68be Merge feat/mcp-http: Streamable HTTP transport, PAT bearer auth, rate limiting (#6)
• 91f2fc2 Merge feat/mcp-oauth: OAuth resource server, audience, RFC 9728, write scopes (#8)
• 37c1761 Merge feat/mcp-upload: uploadflow extraction + upload_model tool (#7)
• acc66fd Refactor update sections in README.md
• 77fa0e3 Revise README for clarity on installation steps
• 0abee0d Update README for clarity on Melange CLI usage
• 76475b5 Update README.md
• c0165fe ci(release): allow manual dispatch for v0.4.0
• 61c69de ci(release): checkout dispatched tag for manual release
• e8f9778 ci: add the nightly/on-demand live e2e + agent eval workflow
• 7c7d60d feat!: follow the v1 boundary change — precision and variant replace target
• faa36c3 feat(e2e): live mcp e2e script for both transports (make e2e)
• 58cfb48 feat(install): install the CLI and agent skill in one curl command
• 5c7a23f feat(mcp): add AuthHints seam for transport-specific auth remediation
• 541a26d feat(mcp): add MCP server core, stdio command, and whoami tool
• 702a82c feat(mcp): add Streamable HTTP server core (httpserver package)
• b711b86 feat(mcp): add deploy, report, library, and account read tools
• 5c8ce5e feat(mcp): add repo and model read tools
• eaa89ee feat(mcp): add repo write, model write, and download tools
• a0a52a1 feat(mcp): add the local-only upload_model tool
• 37f1c35 feat(mcp): answer scope-blocked calls with an RFC 6750 insufficient_scope 403
• 63fd75a feat(mcp): derive tool output schemas from the OpenAPI spec
• 13ec204 feat(mcp): enforce OAuth audience in the HTTP token verifier
• 10e1b1c feat(mcp): enforce the write scope per mutating tool
• fc3d686 feat(mcp): make a second stop signal close the http drain immediately
• 832cbc3 feat(mcp): real auth verifiers, WWW-Authenticate, and rate limiting for HTTP mode
• 8df804f feat(mcp): send server diagnostics to stderr
• 952ac0e feat(mcp): serve MCP over HTTP from melange mcp --transport http
• 2d1b9ce feat(mcp): serve RFC 9728 metadata and advertise it in 401 challenges
• f4eb0bc feat(mcp): throttle pre-auth request floods by source IP
• 299e31c feat(mcpeval): agent eval harness scoring real Claude agents via MCP (make eval)
• af2a7d7 feat(skill): teach agents to report conversion phases and benchmarks
• be3916f feat(tools): mcploadgen load harness and mcp-loadtest soak (make perf)
• 54b1e33 fix(ci): use dispatched tag for npm version
• e768875 fix(e2e): close the review gaps — DB locality gate, leak-proof hygiene, assertions that can fail
• a98cd82 fix(mcp): declare OpenWorldHint explicitly on every tool
• 17f2eed fix(mcp): drain the HTTP server on SIGTERM, not only SIGINT
• 4ffc019 fix(mcp): emit object-typed outputSchema unions so MCP clients accept the catalog
• 1400bbc fix(mcp): exit 0 when the client hangs up mid-request
• 0da29b6 fix(mcp): filter the SDK's per-connection log noise and align the stdio env guard
• 3977191 fix(mcp): key the pre-auth limiter on the IPv6 /64, not the address
• e84f2ad fix(mcp): path.Clean the canonical resource URL
• b45fed9 fix(mcp): refuse empty --resource values and fail closed on missing aud
• 36fede6 fix(mcp): regenerate schemas and goldens for v1 variant/precision boundary
• cc4e816 fix(mcp): reject ValidateTokens until the MeVerifier exists
• b4c9147 fix(mcp): report a failed upload session unlock instead of dropping it
• fba0e17 fix(mcp): reserve the insufficient_scope 403 for OAuth bearers
• 4f56c03 fix(mcp): retry client resolution instead of caching the failure
• dabb058 fix(mcp): state the http enforcement posture and warn on stdio-ignored resource env
• 8059618 fix(mcp): stop HTML-escaping composite envelope halves
• 37eebb4 fix(mcp): stop leaking backend host and dial detail in token-validation 500s
• 6f429db fix(skill): report the whole model, inline, not one device's slice
• 4e55b1c perf(mcp): share resolved tool schemas across per-request HTTP servers
• 5f7fd41 refactor(api): consolidate the idempotency-key helper into internal/api
• d82bec0 refactor(mcpeval): drop the tools/list schema shim now the catalog is valid
• 243c877 refactor(skill): drop the accuracy-details table from the LLM report
• f6500ab refactor(skill): template the model report, split SKILL.md to assets/
• eedb404 refactor(upload): extract the upload session state machine into internal/uploadflow
• ebcb3d1 refactor: inline the dead helpers manifestOptions and lowerState