@withpica/mcp-server 2.85.1 → 2.86.1

package/CHANGELOG.md

@@ -11,6 +11,37 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.86.1] - 2026-07-03
+
+### Fixed
+
+- **`pica_execute`** — an unknown wrapped tool name is now refused
+  pre-dispatch with `UNKNOWN_TOOL`, the three closest registered tool
+  names as `suggestions`, and a pointer to `pica_tool_details` — replacing
+  the bare `EXECUTION_ERROR "Tool not found"` that left agents retrying
+  guessed name variations blind. The `EXECUTION_ERROR` pass-through
+  envelope also mirrors its code/message into `structuredContent`.
+- **Audit telemetry** — dispatcher and executor error envelopes returned as
+  content-text JSON (without `structuredContent`) now have their
+  `error_code`/`error_message` lifted into the mcp audit event, so
+  error-grouping pipelines see a code instead of an opaque error row
+  (26 code-less ChatGPT dispatcher failures in 14 days were invisible to
+  ops triage).
+
+## [2.86.0] - 2026-07-02
+
+### Changed
+
+- **`pica_merge_duplicates`** — now `approvalMode:"human"` (ADR-288): a
+  delegated-agent caller (OAuth connector / `pica_grant_*`) no longer gets
+  refused — the call freezes into a pending human approval, the org owner
+  approves out-of-band, and PICA replays the frozen merge server-side.
+  Blocked merges (custody provenance, distinct-ISRC losers, tunecode
+  collision) fail the approval cleanly with the blocking reason and zero
+  partial mutation. Resource scope corrected `admin` → `write:catalog`
+  (matching the backing route) so catalog-scoped delegated agents can
+  propose; first-party callers still need the destructive tier as before.
+
 ## [2.85.1] - 2026-07-01
 
 ### Changed