openclaw/mcporter v0.13.1

v0.13.1 — Relay and OAuth hardening

on GitHub

CLI

• Authenticate OpenClaw extension-backed Chrome control with Browser Relay Authentication v2 over one retained loopback socket from HMAC challenge through CDP upgrade, never transmitting the host key or retrying legacy relay auth, while preserving configurable prefer / require / off routing and the OS-protected one-use child handoff.

• Tear down both sides of streamed mcporter serve --http responses on client aborts or body errors, preventing orphaned readers. (PR #280, thanks @SebTardif)

Daemon

• Invalidate keep-alive Chrome DevTools state when relay policy, URL, timeout, OpenClaw credential paths, or the derived relay keyId change, keep require fail-closed across retries, and expose the last safe relay decision in mcporter daemon status.

• Keep the daemon alive after asynchronous log-file ENOSPC/EIO failures by handling writer errors immediately and falling back to console logging. (PR #280, thanks @SebTardif)

OAuth

• Honor MCPORTER_OAUTH_NO_BROWSER across serve/daemon OAuth flows, fail once with actionable reauthorization guidance without logging authorization URLs, and restart daemons when the normalized setting changes. (PR #284 / issue #283, thanks @vitalijssilins)

• Accept RFC 7591 dynamic-client-registration arrays and timestamps in mcporter vault set while preserving null-compatible partial client information and provider metadata. (PR #288 / issue #286, thanks @feniix)

• Sanitize malformed mcporter vault set JSON diagnostics and reject non-finite expires_at / expiresAt token values before persistence. (Follow-up to PR #287, thanks @Yigtwxx)

Tooling

• Refresh pnpm, GitHub Actions runtimes, and mature security overrides for fast-uri, Hono, ip-address, and nanoid.

• Remove the obsolete scoped-commit helper and use standard Git commands in isolated worktrees.

Verification

• npm: mcporter@0.13.1

• Registry tarball: mcporter-0.13.1.tgz

• Integrity: sha512-Dvg4RUQ+noFX8VmJYRwtz9lk7Iv+gk6FNwaQJBuUD9DJuQZ0otuDHK8kIvvwwLB4ueGUZM7imhg38q61sGYyOg==

• Protected native verification: run 31286204049

• Trusted npm publication: run 31286370006

• Homebrew update: run 31286435647