trackqa 0.1.0 → 0.1.1

package/README.md

@@ -7,22 +7,19 @@ credentials. The connector does not install or authenticate the AI client itself
 
 ## Package status and installation
 
-The locally prepared release candidate is **trackqa@0.1.0**, with the `trackqa`
-executable. On November 4, 2026, npm identity `eronny`, verified email and completed
-`auth-and-writes` 2FA were checked. The registry returned 404 for `trackqa`; the name
-has not been reserved and first-publication acceptance is not guaranteed. The
-private flag was removed only for authorized local release-candidate preparation.
-**The package has not been published. Publication requires separate approval.**
-No alternative release identity is substituted.
+**trackqa@0.1.0** was published and independently verified on November 4, 2026.
+The locally prepared **v0.1.1 candidate** removes manual public-key setup for the
+official hosted TrackQA service. **v0.1.1 is not published; publication requires
+separate approval.** The original v0.1.0 artifact is retained unchanged.
 
 To verify an approved local tarball in a disposable directory:
 
 ```powershell
-npm install --ignore-scripts --no-audit --no-fund <absolute-path-to-trackqa-0.1.0.tgz>
+npm install --ignore-scripts --no-audit --no-fund <absolute-path-to-trackqa-0.1.1.tgz>
 npm exec --offline -- trackqa --help
 ```
 
-After the intended package is approved and published, the target workflow is:
+After v0.1.1 is approved and published, the official hosted workflow is:
 
 ```powershell
 npx trackqa connect
@@ -32,9 +29,11 @@ npx trackqa status --client codex
 npx trackqa disconnect --client codex --project <project-UUID>
 ```
 
-These registry commands are a future distribution workflow, not instructions to
-fetch an unverified package now. With a local installation use
-`npm exec --offline -- trackqa ...`. No client is selected by default.
+Until v0.1.1 is published, the bare registry command still resolves to v0.1.0 and
+retains that version's manual public-key requirement. Validate this candidate
+through a local tarball installation and `npm exec --offline -- trackqa ...`.
+Bare `connect` prompts for a client; `--client codex` is optional. No client is
+selected by default.
 
 ## Requirements and first use
 
@@ -46,13 +45,10 @@ fetch an unverified package now. With a local installation use
   MFA factors are currently refused as unsupported.
 - Free callback port **5173** on localhost. Stop a conflicting development server
   through its own terminal before setup; the connector never terminates it.
-- The deployment's **public anon/publishable Supabase key**, supplied using the
-  existing `TRACKQA_PUBLIC_KEY` environment variable. `VITE_SUPABASE_ANON_KEY` is an
-  alternative. Obtain this public value from the deployment operator; never use a
-  service-role key, database password, OAuth token or MCP bearer token.
+- Official hosted TrackQA's validated **public anon key is included**. No manual
+  `TRACKQA_PUBLIC_KEY` setup, application checkout or `.env` file is required.
 
 ```powershell
-$env:TRACKQA_PUBLIC_KEY = '<deployment-public-anon-or-publishable-key>'
 npm exec --offline -- trackqa connect --client codex
 ```
 
@@ -60,6 +56,24 @@ The installed package uses its included shared runtime helpers; it does not need
 the application checkout or its environment files. Source-checkout fallback to the
 app's public-key setting is development-only. No `.env` file is packaged or created.
 
+### Advanced: custom public configuration
+
+The connector continues to pin its backend URL. A custom deployment uses a custom
+build pinned to its own backend, with a matching public key supplied through
+`TRACKQA_PUBLIC_KEY` or, alternatively, `VITE_SUPABASE_ANON_KEY`. A key override
+alone does not change the destination. No runtime URL override was added.
+
+```powershell
+$env:TRACKQA_PUBLIC_KEY = '<matching-deployment-public-anon-or-publishable-key>'
+```
+
+Explicit environment values take precedence over the development-file fallback
+and official default. Invalid explicit values fail closed. Legacy anon JWTs with
+a different project reference are rejected; opaque publishable keys cannot be
+associated with a deployment offline and must be validated by that backend.
+The official default is never used for a different pinned deployment. Never use
+a secret/service-role key, database password, Owner session or MCP bearer token.
+
 Select one client and one project, inspect the token-free preview, and approve
 installation, project MCP enablement if needed, and one scoped connection. The
 connector launches the client with the credential only in the child environment.

package/dist/tools/trackqa-connect/src/auth.js

@@ -4,6 +4,10 @@ import { parseEnv } from 'node:util';
 import { googlePkceSignIn, GooglePkceError } from '../../mcp-pilot/google-pkce.mjs';
 import { boundedJson, ConnectorError, requireValue, SUPABASE_URL, UUID } from "./core.js";
 import { fixtureMembershipRoute, fixtureRequestAllowed, fixtureScopeState, observeFixtureResponse } from "./testing/copilot-fixture-scope.js";
+// Public browser configuration, paired with the official hosted project in the
+// app's trusted VITE_SUPABASE_URL / VITE_SUPABASE_ANON_KEY configuration.
+// This is not an Owner session, MCP bearer credential, or service-role key.
+export const OFFICIAL_PUBLIC_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6Im16ZXVpbXFmcnN3cndvYXFqZG1wIiwicm9sZSI6ImFub24iLCJpYXQiOjE3ODgzMTUxMzMsImV4cCI6MjEwMzg5MTEzM30.w12klp31YCC3bydpI07QnewBoEi3pv6qFG0xxsMDOyY";
 export function isPublicKey(key) {
     if (/^sb_publishable_[A-Za-z0-9_-]+$/.test(key))
         return true;
@@ -14,11 +18,22 @@ export function isPublicKey(key) {
         return false;
     }
 }
-export async function publicKey(env = process.env) {
+function keyMatchesDeployment(key, deploymentUrl) {
+    try {
+        const claims = JSON.parse(Buffer.from(key.split('.')[1], 'base64url').toString());
+        // Legacy hosted anon keys identify their project. Opaque publishable keys
+        // cannot be associated offline; the destination still validates them.
+        return claims.ref === undefined || deploymentUrl === `https://${claims.ref}.supabase.co`;
+    }
+    catch {
+        return key.startsWith('sb_publishable_');
+    }
+}
+export async function publicKey(env = process.env, deploymentUrl = SUPABASE_URL) {
     let value = env.TRACKQA_PUBLIC_KEY ?? env.VITE_SUPABASE_ANON_KEY;
     // Local development only: read the existing app's public key, never load its
     // other variables into process.env or pass them to the coding client.
-    if (!value) {
+    if (value === undefined) {
         for (const file of ['.env.local', '.env']) {
             try {
                 const text = await readFile(new URL('../../../' + file, import.meta.url), 'utf8');
@@ -31,13 +46,19 @@ export async function publicKey(env = process.env) {
             catch { /* No secret or filesystem error details leave this function. */ }
         }
     }
+    // Never send the official default to another deployment. A custom build must
+    // supply its own public key; invalid explicit overrides never fall back.
+    if (value === undefined && keyMatchesDeployment(OFFICIAL_PUBLIC_KEY, deploymentUrl))
+        value = OFFICIAL_PUBLIC_KEY;
     requireValue(value && value.length <= 8192 && isPublicKey(value), 'public_key_required');
+    requireValue(keyMatchesDeployment(value, deploymentUrl), 'public_key_deployment_mismatch');
     return value;
 }
 // The CLI receives only a checked human API closure. Raw Auth tokens and the SDK
 // client never reach the client adapter or the recovery store.
 export async function withOwner(options, action) {
     requireValue(isPublicKey(options.key), 'public_key_required');
+    requireValue(keyMatchesDeployment(options.key, SUPABASE_URL), 'public_key_deployment_mismatch');
     if (options.fixtureScope)
         fixtureScopeState(options.fixtureScope);
     const posts = new Set();

package/dist/tools/trackqa-connect/src/cli.js

@@ -16,7 +16,7 @@ import { adapterLabel } from "./clients/adapter.js";
 import { ConnectorError, display, parseArgs, requireValue } from "./core.js";
 import { Store } from "./state.js";
 import { connect, disconnect, status } from "./workflow.js";
-export const help = `TrackQA Connect 0.1.0 - Windows, Owner-operated MVP release candidate
+export const help = `TrackQA Connect 0.1.1 - Windows, Owner-operated MVP release candidate
 Usage after installing the approved package or local tarball:
   trackqa connect --client codex
   trackqa status --client codex
@@ -34,7 +34,8 @@ VS Code optional: --vscode-path <trusted installed absolute Code.exe>; supported
 Claude connect only: --claude-only excludes other MCP servers for this session (opt-in).
 No client is selected by default. AI-client accounts are separate from TrackQA sign-in.
 Requires Node >=22.19, Windows, a free localhost callback port 5173 and Google Owner authorization; MFA accounts are unsupported.
-Set TRACKQA_PUBLIC_KEY to the deployment's public anon/publishable key. Never supply a secret or service-role key.
+Official hosted TrackQA public configuration is included; no TRACKQA_PUBLIC_KEY setup is required.
+Advanced: TRACKQA_PUBLIC_KEY or VITE_SUPABASE_ANON_KEY overrides the public key for the build's pinned backend. Never use a secret or service-role key.
 No bearer token is saved. The existing 90-day token expiry is unchanged; session cleanup attempts and independently verifies revocation.
 Status is local-only: it does not authorize or test a live MCP connection.
 Disconnect may require fresh Google Owner sign-in. Never pass credentials as arguments.`;
@@ -61,6 +62,8 @@ export async function locations(env = process.env, client = 'codex') {
 }
 const codes = new Set(`usage configuration_busy configuration_write_failed configuration_write_uncertain gemini_auto_update_enabled gemini_compatibility_unverified client_unsupported client_foreground_unsupported client_not_found executable_untrusted executable_changed public_key_required authentication_failed callback_port_in_use callback_unavailable callback_timeout callback_rejected oauth_denied oauth_failed browser_open_failed interrupted identity_unverified profile_required mfa_unsupported owner_required no_eligible_owner_projects project_unavailable project_selection_unavailable request_failed response_invalid response_limit signout_unconfirmed configuration_unreadable configuration_conflict configuration_changed configuration_home_mismatch configuration_location_untrusted installation_unconfirmed removal_unconfirmed recovery_invalid recovery_unavailable existing_connection_recover_first connector_busy_or_stale_lock enablement_unconfirmed issuance_unconfirmed token_invalid cleanup_unconfirmed no_managed_connections client_command_failed client_command_timeout client_response_limit client_launch_failed client_exit_failed verification_initialization_failed verification_discovery_failed verification_connection_status_failed verification_project_scope_failed`.split(' '));
 export function safeCode(error) {
+    if (error instanceof ConnectorError && error.code === 'public_key_deployment_mismatch')
+        return error.code;
     if (error instanceof ConnectorError && ['copilot_runtime_unverified', 'copilot_process_unconfirmed'].includes(error.code))
         return error.code;
     if (error instanceof ConnectorError && error.code === 'vscode_process_unconfirmed')

package/dist/tools/trackqa-connect/src/clients/codex-verify.js

@@ -63,7 +63,7 @@ export async function verifyCodex(executable, codexHome, setup, token, signal, s
         child.stdin.write(JSON.stringify({ id, method, params }) + '\n');
     });
     try {
-        await rpc('initialize', { clientInfo: { name: 'trackqa_connect', version: '0.1.0' } });
+        await rpc('initialize', { clientInfo: { name: 'trackqa_connect', version: '0.1.1' } });
         child.stdin.write(JSON.stringify({ method: 'initialized', params: {} }) + '\n');
         const config = await rpc('config/read');
         const servers = config?.config?.mcp_servers;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trackqa",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Owner-operated TrackQA MCP connector for Windows",
   "type": "module",
   "bin": { "trackqa": "dist/tools/trackqa-connect/src/cli.js" },