proton-drive-mcp 1.3.0 → 1.3.1

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 1.3.1 — 2026-10-01
+
+### Changed
+- Trusted Publishing is now configured on npm for this package; the publish workflow keeps the `NPM_TOKEN` fallback until an OIDC publish has been confirmed.
+
+### Fixed
+- `drive_find_duplicates` with `verify`: the "verify budget reached" note now names the limit that was actually hit (bytes or file count) instead of always listing both.
+
 ## 1.3.0 — 2026-09-30
 
 Proton Drive has no search, and its end-to-end encryption rules out server-side indexing. This release adds the client-side layer: find things, understand what uses your space, and clean up safely. 4 builders worked in parallel, then 3 verifiers (live on a real account, an independent security review, packaging/CI) and a re-check of every fix. Review findings fixed before release include two ReDoS vectors in search and a local-path guard gap.

package/dist/services/analytics.js

@@ -155,7 +155,8 @@ export async function verifyGroups(groups, hash, o) {
         }
         const groupBytes = g.members.reduce((s, m) => s + byteSize(m), 0);
         if (totalBytes + groupBytes > maxTotal || totalMembers + g.members.length > maxMembers) {
-            out.push({ ...g, verifyNote: `skipped: total verify budget reached (maxVerifyTotalBytes ${maxTotal}, ${maxMembers} files)` });
+            const limit = totalBytes + groupBytes > maxTotal ? `maxVerifyTotalBytes ${maxTotal}` : `${maxMembers} files`;
+            out.push({ ...g, verifyNote: `skipped: verify budget reached (${limit})` });
             continue;
         }
         totalBytes += groupBytes;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "proton-drive-mcp",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "MCP server and CLI that gives Claude full access to Proton Drive — upload, download, share, and manage your end-to-end encrypted files without leaving the conversation.",
   "type": "module",
   "main": "dist/index.js",