mcp-pacemaker 2.0.1 → 2.1.0

package/CHANGELOG.md

@@ -7,10 +7,110 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.1.0] - 2026-10-12
+
+Target release: 2.1.0. This candidate has not yet been published.
+
+### Added
+
+- Explicit managed `upgrade --to`, read-only plans, isolated `--sxs` instances with
+  retained OS-assigned listeners, stable launchers, admission control and a durable
+  activation/recovery journal. Bare `upgrade` and `--self` remain compatible.
+- Preserve ports and host wiring during managed replacement; retain the previous
+  package and restrict rollback to verified, unchanged pre-admission state.
+- Add one-time restart-only migration for the exact Windows 1.3.0 registration,
+  with interactive uncertainty acknowledgement, held process identities, partial
+  observed-descendant receipts and scoped task/CLI rollback. No machine reboot.
+- Refuse unsupported or unknown supervisor/autostart identities before interruption.
+- Add explicit Windows original-account upgrades with a task-only administrator
+  controller and authenticated original-user worker. Keep current-user scope as
+  the default, preserve task security/account settings, and refuse unavailable or
+  changed logged-on session identity. Real elevated two-account qualification
+  remains required; `--all-users` is unsupported.
+
+### Fixed
+
+- Contain Windows bridge descendants in a kill-on-close Job Object before any
+  workload starts, preventing nested cmd/Node trees from surviving abrupt bridge
+  loss. Fail startup if containment cannot be established.
+- Preserve existing task security during legacy migration instead of resubmitting
+  its owner, allowing an ordinary user to update an eligible Administrators-owned
+  task without changing its permissions.
+- Handle Task Scheduler's equivalent XML serialization during post-write checks
+  and restoration, including rediscovery after rollback. Keep raw revision
+  preconditions, original backups and complete resource-security checks intact.
+- Avoid Windows upgrade-authorization failures caused by slow thread enumeration
+  and already-terminated thread records while retaining complete identity and
+  authority checks.
+- Capture larger legacy process trees with bounded discovery and distinguish
+  reused parent PIDs from proven descendant relationships.
+- Recheck shared-session test cooldown deadlines after early timer delivery before
+  acquiring a replacement generation.
+- Wait for the metrics test process and its stdio to close before removing fixture files.
+- Pin the Windows process-lifetime and task-channel helpers to their own packaged directory
+  instead of inheriting the caller's working directory. A process's working directory cannot
+  be removed on Windows, so a detached helper previously blocked removal of the instance,
+  configuration and staging directories with `EPERM`.
+- Report the native refusal reason when the task channel declines a request, instead of a
+  bare refusal with no cause.
+
+### Security
+
+- Refuse elevated or unverified default Windows upgrade and recovery before
+  staging, task writes or runtime launch, preserving the original runtime authority.
+- Raise the CLI's `smol-toml` floor to `1.9.0`.
+- Move the dashboard build to Tailwind CSS `4.3.3`, removing the vulnerable
+  `braces` and `postcss-selector-parser` dependency paths, and pin `source-map-js`
+  to `1.2.2`.
+- Retire the 2.0.2 producer exception from fresh native and OSV scans. New releases
+  require complete clean producer evidence; historical receipts retain their
+  original source bindings and expiry.
+
+### Changed
+
+- **Breaking for privileged callers.** The bridge, supervisor and default upgrades now verify
+  the caller before any runtime work and refuse an elevated or root caller at startup with
+  `User-runtime execution refused: …`. This is not Windows-only and not upgrade-only: on Linux
+  and macOS a `root` process is refused, which includes the default user in most container
+  images. There is no override; run as an ordinary account. Shipping this in a minor release is
+  deliberate — the previous behaviour let a bridge run with authority it could not verify.
+- Update the Tailwind PostCSS adapter, class-merging dependency, generated dashboard
+  assets and license attribution while retaining the existing theme configuration.
+
+## [2.0.2] - 2026-10-06
+
 ### Fixed
 
-- Resolve native directory watcher paths before watching logs and test control files,
+- Replace the old GitHub-install quick start in the npm package documentation with
+  npm-first installation, exact-version commands, prerequisites and setup boundaries.
+- Preserve npm package-type permissions in isolated consumer checks instead of silently
+  reverting directory, file, Git, or remote dependency restrictions to npm defaults.
+- Resolve native directory watcher paths in publication and compatibility test helpers,
   avoiding Windows short-path watcher crashes without changing the selected files.
+- Restore the legacy publisher's skipped-matrix job and whole-second timestamp handling
+  in reusable secret-collection admission, preserving source and execution checks.
+
+### Changed
+
+- Make the manual npm publisher reusable for explicitly selected stable 1.x/2.x
+  versions, with immutable published comparison peers and no active bootstrap actions.
+- Keep the existing GitHub source-CI, collection/review, preparation, OIDC staging,
+  verification and separately approved owner-publication route for the selected release.
+
+### Security
+
+- Record a temporary **2.0.2-only producer risk acceptance** for `smol-toml 1.8.0`
+  in the CLI runtime and `braces 3.0.3`, `postcss-selector-parser 6.1.4` and
+  `source-map-js 1.2.1` in UI build tooling. The October 6 review keeps the
+  original **2026-10-12T00:00:00Z** expiry and binds both unchanged producer
+  locks and the exact native reports. Raw audit/OSV findings remain visible.
+  Dependency upgrades stay deferred from this documentation release.
+  This is not a patch or a clean advisory result; fresh-consumer findings are
+  not exempted. Remediation and exception removal are required
+  before expiry or the next release. See the
+  [exact advisories, exposure, mitigations and follow-up](docs/npm-publishing.md#temporary-202-producer-risk-acceptance).
+
+## [2.0.1]
 
 ### Changed
 
@@ -445,6 +545,10 @@ one is a trap for anyone building something similar.
 - Do not report a teardown the bridge initiated as a crash. `taskkill /F` exits non-zero, so
   every recycle, idle reap and session close was recorded as a failure, burying real ones.
 
+[Unreleased]: https://github.com/girishkvs/mcp-pacemaker/compare/v2.1.0...HEAD
+[2.1.0]: https://github.com/girishkvs/mcp-pacemaker/releases/tag/v2.1.0
+[2.0.2]: https://github.com/girishkvs/mcp-pacemaker/releases/tag/v2.0.2
+[2.0.1]: https://github.com/girishkvs/mcp-pacemaker/releases/tag/v2.0.1
 [2.0.0]: https://github.com/girishkvs/mcp-pacemaker/releases/tag/v2.0.0
 [1.3.0]: https://github.com/girishkvs/mcp-pacemaker/releases/tag/v1.3.0
 [1.2.0]: https://github.com/girishkvs/mcp-pacemaker/releases/tag/v1.2.0

package/CONTRIBUTING.md

@@ -18,12 +18,16 @@ part of its security posture. The setup CLI and the dashboard may use dependenci
 
 ## Lockfiles must resolve to the public registry
 
-CI fails any lockfile containing a `resolved` URL outside `registry.npmjs.org`. If you work
-behind a private mirror, re-resolve before committing:
+CI fails any lockfile containing a `resolved` URL outside `registry.npmjs.org`.
+Do not bypass a required registry policy to produce those URLs. Restore through the
+approved registry and preserve exact package names, versions and verified archive
+integrities when canonicalizing mirror-specific URLs for the public lockfile.
+Hosted CI must still restore the resulting lock from its configured registry.
 
-```bash
-npm install --registry https://registry.npmjs.org
-```
+For npm 12 mirrors whose metadata and tarball URLs have different prefixes,
+`replace-registry-host` supports command-local URL-prefix mapping back through the
+approved registry. This does not require relaxing `allow-remote`, disabling TLS,
+changing global settings or committing a private registry configuration.
 
 ## Tests
 
@@ -35,8 +39,13 @@ Tests are `node:test` only, no framework. Each test file that starts a bridge ow
 ports, because files run in parallel; the current allocation is listed at the top of
 `test/auth-token.test.mjs`. Pick unused ones for a new file.
 
-Before submitting, run the complete `npm test` command with its normal file concurrency.
-Focused or serialized runs help diagnose failures but do not replace that run. Record the
+Before submitting, run the complete `npm test` command with its normal file concurrency
+(`--test-concurrency=4`, matching the four vCPUs on hosted runners). CI and the local
+publication gate go through `npm run test:contract -- <name>` instead, which adds the
+execution-context preflight and, on Windows, splits the suite into the ordinary-account lane
+and the session lane; `npm run test:contract -- source --check` reports what a lane would run
+without running it. Focused or serialized runs help diagnose failures but do not replace that
+run. Record the
 exact Node and npm versions, OS, architecture, and command; matching only the Node major is
 not enough to reproduce a CI failure.
 
@@ -63,6 +72,14 @@ platform; Windows also exercises the real executable. Those checks do not replac
 byte-for-byte rebuild, and a rolling CI image may not contain the recorded compiler.
 No compiler or PowerShell host runs in the production config-write path.
 
+Windows bridge lifetime containment uses a **separate** packaged helper. Build
+and byte-for-byte verify it with `tools/windows-process-lifetime/build.ps1` and
+`-Verify`; see its README for the ownership and failure contract. Do not change
+the immutable config-security helper to update the lifetime helper. Run both
+`test/windows-process-lifetime.test.mjs` and `test/windows-lifetime-startup.test.mjs`
+on supported Windows/Node versions. They retain owned PID/creation-time cleanup
+receipts and TCP heartbeat observations outside Git.
+
 Batch tests must cover the full five-second trailing debounce, merging complete snapshots,
 Reload now, requests during a flip, stale active revisions, whole-batch Cancel/Undo and late
 commit outcomes. Use controlled clocks for scheduling boundaries and real file/HTTP cases for
@@ -77,9 +94,17 @@ sleeping a fixed interval.
 
 ## Real-version compatibility gates
 
+The dashboard uses the Tailwind 4 PostCSS adapter. Its optimizer stays disabled
+until generated selectors and license attribution have been checked; Vite still
+minifies the final CSS. Keep the inline Vite and standalone PostCSS settings
+consistent, and run the UI tests before regenerating the dashboard and notices.
+
 These are separate, mandatory CI gates, not substitutes for `npm test`. The root CI job runs
-CLI/API pairs on Windows, Linux and macOS with Node 20, 22 and 24. The Linux/Node 22 UI
-job runs one Chromium browser matrix after building the dashboard.
+CLI/API pairs on Linux and macOS with Node 20, 22 and 24. The Windows pair runs in the
+`windows-ordinary` job through `tools/windows-ci/ci-ordinary-user.ps1 -Contract compatibility`,
+which prepares, exercises and removes its fixtures inside a disposable standard account: the
+fixtures record the temp root that owns them, so an administrator-prepared pair is refused. The
+Linux/Node 22 UI job runs one Chromium browser matrix after building the dashboard.
 
 ```bash
 npm ci
@@ -103,15 +128,22 @@ instead of installing bundled Chromium. CI uses bundled Chromium, not that overr
 Both standalone test commands **fail** when preparation is missing or candidate bytes have
 changed. Clean and prepare again after changing package files, built assets, or Node major.
 
-Scope is explicitly **1.3.0, 1.3.1, 2.0.0 and 2.0.1**, not arbitrary compatible-looking versions.
+Historical compatibility baselines remain explicitly **1.3.0 and 2.0.0**.
+Candidate versions must be canonical stable **1.x legacy / 2.x current** versions.
+The owner selects the actual release and any exact opposite-major patch pair;
+support in the harness alone is not evidence that every patch was tested.
 The same harness runs in both maintained branches:
 
 | Preparation | Selected legacy / current pair |
 |---|---|
-| Default in the 2.0.1 checkout | Immutable 1.3.0 / packed 2.0.1 |
+| Default in the selected 2.1.0 checkout | Immutable 1.3.0 / packed 2.1.0 |
 | Default in the 1.3.1 checkout | Packed 1.3.1 / immutable 2.0.0 |
 | `npm run compat:prepare:baseline` | Immutable 1.3.0 / immutable 2.0.0 |
-| `npm run compat:prepare -- --peer-root <opposite-patch-checkout>` | Packed 1.3.1 / packed 2.0.1 |
+| `npm run compat:prepare -- --peer-root <opposite-patch-checkout>` | Packed explicit 1.x peer / packed 2.1.0 |
+
+These selections are not qualification evidence. The 2.1.0 candidate requires fresh
+exact-byte gates; selecting it does not select an opposite-major patch pair.
+Earlier 1.3.1/2.0.2 and 1.3.1/2.0.1 results remain historical.
 
 Run both API and browser gates for the explicit patch pair before publishing either complete
 dual-major release set. The two default CI pairs alone do not establish that combined result.
@@ -175,7 +207,7 @@ API, admin mutation, SSE and MCP requests go to the real backend, without respon
 Nested JS assets are included. The old-tab upgrade case does not substitute assets: it stops
 the actual selected 1.x process and starts the selected 2.x process on the same port before refresh.
 
-No other version compatibility is claimed. Writable downgrade is checked on a fresh
+Only the executed exact version pairs establish compatibility. Writable downgrade is checked on a fresh
 synthetic config with default ownership and inherited security. The test does not change
 tokens, elevate, or set ACLs. It checks unchanged caller authority and, on Windows, the actual
 selected 1.x helper's full/partial audit visibility. Caller-context hashes are not direct measurements
@@ -200,6 +232,10 @@ the user's global prefix, host configuration, live bridge, or npm credentials. I
 resolved caller registry/cache and offline setting without a mirror fallback. Registry
 signatures and provenance are separate post-publication checks, not inferred from this smoke test.
 
+The consumer preserves npm's effective `allow-directory`, `allow-file`, `allow-git`, and
+`allow-remote` values, including environment overrides. It does not replace restrictions
+with defaults or grant permissions when an install is rejected.
+
 ## Changing how a host is wired
 
 Host adapters live in `HOSTS` in `bin/cli.mjs`. Each one declares where that host's config