@massu/core 1.16.0 → 1.16.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +31 -0
- package/dist/cli.js +467 -159
- package/dist/hooks/session-end.js +16 -6
- package/dist/hooks/session-start.js +16 -6
- package/dist/hooks/user-prompt.js +4 -3
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -10,6 +10,37 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
|
|
|
10
10
|
> redistributed under the **Apache License 2.0**. Full license + NOTICE:
|
|
11
11
|
> `packages/core/assets/embedder/MODEL-LICENSE`.
|
|
12
12
|
|
|
13
|
+
## [1.16.1] - 2026-07-14
|
|
14
|
+
|
|
15
|
+
### Security
|
|
16
|
+
|
|
17
|
+
- **License-response signing key rotated (SEC-1).** The Ed25519 key that signs `/validate-key`
|
|
18
|
+
responses was rotated after a live private key was found committed in a tracked runbook (SEC-1,
|
|
19
|
+
`docs/reports/2026-07-14-codebase-audit-findings.md`). Production now signs with the new key and
|
|
20
|
+
stamps the new fingerprint `18c04567…`; the bundled client pubkey (`license-pubkey.generated.ts`)
|
|
21
|
+
is regenerated to trust the new key as primary while keeping the old key in the allowlist for the
|
|
22
|
+
transition grace window. A live signature smoke confirmed a real `/validate-key` success is signed
|
|
23
|
+
by the new key and verifies. The drift-guard `no-committed-private-keys.test.ts` forbids
|
|
24
|
+
re-introduction of any private key.
|
|
25
|
+
|
|
26
|
+
### Fixed
|
|
27
|
+
|
|
28
|
+
- **The 2026-07-14 codebase-audit closure is now actually delivered.** The audit-closure fixes were
|
|
29
|
+
committed (`4f4c688`) but never published — `1.16.0` on npm predates all of them. `1.16.1` ships:
|
|
30
|
+
fail-closed engine startup on a fatal DB/ABI error (SF-1), Pro-tier gating of the `/v1` capability
|
|
31
|
+
endpoints (SEC-2), the two wired-but-previously-dead CLI subcommands `massu rule show` /
|
|
32
|
+
`massu rule effectiveness` (DF-1/DF-2), the documented-but-missing webhook-test route (BND-1), and
|
|
33
|
+
the cloud-sync "server-error-as-empty" fix (BND-3).
|
|
34
|
+
|
|
35
|
+
### Added
|
|
36
|
+
|
|
37
|
+
- **CR-64 release-integrity gate — a published version number is immutable.** A pre-push + CI gate
|
|
38
|
+
(`scripts/release-integrity-check.mjs`) fails the moment `packages/core`'s version equals an
|
|
39
|
+
already-published npm version whose `vX.Y.Z` tag is missing or not at HEAD. This closes the class
|
|
40
|
+
where `1.16.0` was published without a git tag or release ceremony and then reused for six more
|
|
41
|
+
commits that read as "SHIPPED" while never delivered to customers. Incident:
|
|
42
|
+
`docs/incidents/2026-07-14-npm-publish-decoupled-from-release-ceremony.md`.
|
|
43
|
+
|
|
13
44
|
## [1.16.0] - 2026-07-14
|
|
14
45
|
|
|
15
46
|
### Fixed — cloud sync had, in practice, NEVER succeeded for a real session
|