@lcv-ideas-software/cross-review 4.1.0 → 4.2.0

package/CHANGELOG.md

@@ -7,6 +7,58 @@ standard `v00.00.00`; npm package versions remain SemVer.
 
 ## [Unreleased]
 
+## [v04.02.00] — 2026-05-17
+
+**Minor — bounded MCP session listing and cancellation semantics cleanup.** This
+release addresses the operational findings reported against v4.1.1 while keeping
+the runtime API-only.
+
+### Changed
+
+- `session_list` is now paginated and summary-only by default
+  (`limit=25`, `max=100`, `offset=0`) and accepts `outcome_filter` plus
+  `detail`. This prevents large local histories from producing multi-megabyte
+  stdio payloads; callers that need a full session should use `session_read` or
+  request a bounded `detail="full"` page explicitly.
+
+### Fixed
+
+- `session_cancel_job` no longer terminal-aborts a session when no running job
+  matches the request. It now returns `requested=false` with
+  `reason="no_running_job_matched"` and leaves the session resumable.
+- `session_init` now honors `response_format="markdown"` instead of falling
+  through to JSON serialization.
+- Added smoke/runtime-smoke guards for bounded `session_list`, non-terminal
+  no-job cancellation, and the markdown `session_init` response path.
+
+## [v04.01.01] — 2026-05-17
+
+**Patch — release the hard-gate cleanup as a published package.** The previous
+hard-gate cleanup was synchronized without a package-version bump; this patch
+formalizes the change as npm package `4.1.1`, preserving the rule that every
+patch shipped to `main` receives a publishable SemVer increment.
+
+### Fixed
+
+- Removed the dead global ESLint waiver for
+  `@typescript-eslint/no-explicit-any`; strict enforcement already passes on the
+  current source tree.
+- Restored README coverage under Prettier by removing the README masks from
+  `.prettierignore` and formatting the file instead of hiding the drift.
+- Added smoke coverage that prevents future linter/formatter masking of
+  `README.md`, `src/**`, and `scripts/**`, and pins the TypeScript unused-var
+  rule as an error.
+- Made `runtime-smoke` polling terminal-outcome aware and increased the polling
+  deadline to 60 seconds so slow-but-converged stub sessions are not reported as
+  timeouts.
+- Replaced two CodeQL `js/file-system-race` patterns with atomic/file-descriptor
+  based flows: session metadata placeholder creation now relies directly on
+  `writeFileSync(..., { flag: "wx" })`, and the migration race harness snapshots
+  lock state through `openSync` + `fstatSync` on the opened descriptor.
+- Added a scoped StepSecurity suppression for generated `dist/**` artifacts in
+  the publish workflow's pre-publish build job, then resolved the existing
+  actionable generated-file detections.
+
 ## [v04.01.00] — 2026-05-17
 
 **Minor — security hardening of session-store concurrency, write-path