Highlights: At the 256-transport limit, reclaim the least recently used quiet daemon transport before its idle deadline while preserving active calls and Chrome owners; improve CLI argument handling and patch minimatch, qs, and Glob security vulnerabilities.
-
Reclaim the least recently used quiet daemon transport only at the 256-transport limit, even before its idle deadline; preserve active calls, Chrome owners, unknown outcomes, and failed retirements. Thanks @vitalijssilins (#469, #468).
-
Patch the development cleanup dependency's Glob cancellation-bypass vulnerability (GHSA-3g3m-2fjr-6pw4) with 14.0.2, preserving Node 24 support and the 48-hour dependency cooldown.
-
Patch the development cleanup dependency's minimatch pattern-amplification vulnerability (GHSA-g3hv-75wg-m249) with 11.0.1, preserving the 48-hour dependency cooldown.
-
Refresh runtime helpers, Rolldown, Vitest/coverage, lint/format tooling, and type definitions while preserving Node 24 support, the 48-hour dependency cooldown, the patched MCP client, and security overrides.
-
Print daemon help before constructing clients or starting, stopping, or migrating daemons, while preserving help-shaped logging values. Thanks @HengYangDS (#483, #484).
-
Return exit code 1 from generated CLIs for MCP tool results with
isError: true, preserving every output format. Thanks @goutamadwant (#480, #481). -
Preserve boolean, null, and JSON-looking CLI values as strings when required by the tool schema, and discard stale coercion hints when explicit JSON or call expressions overwrite them. Thanks @jaeminbird (#477).
-
Accept UTF-8 BOM-prefixed JSON/JSONC configuration and editor imports. Thanks @jaeminbird (#478).
-
Write a bare
generate-cli --bundlebeside its template, with safe handling of ambiguous output paths. Thanks @KrasimirKralev (#479). -
Report emit-ts, daemon, and timeout argument errors once without internal stack traces. Thanks @KrasimirKralev (#482).
-
Preserve empty quoted arguments in stdio command strings and reject empty executable names. Thanks @remote-controlled-man (#486).
-
Reserve the generated CLI's
--rawJSON option when assigning schema flags, keeping conflicting tool properties independently callable. Thanks @remote-controlled-man (#487). -
Reject extra list targets and unknown options before contacting a server, while preserving exact configured names beginning with hyphens. Thanks @remote-controlled-man (#492).
-
Run CodeQL weekly and on pull requests or manual dispatch, retaining Actions and JavaScript analysis without duplicate scans on every main push.
-
Reuse the existing pinned Bun runtime for macOS CI formatting while retaining native typechecks and Node-only local commands.
-
Patch the development fixture's qs stringify denial-of-service vulnerability (GHSA-6pq8-jhm2-2vcw) with qs 6.16.1, preserving the 48-hour dependency cooldown.
-
Classify orderly daemon socket EOF as a transport disconnect so
daemon stoptolerates shutdown before a reply, while preserving authentication/protocol errors and never replaying tool calls. -
Update es-toolkit to 1.53.0 while preserving Node 24 support and the 48-hour dependency cooldown.
-
Add a runnable, isolated deed.page MCP example for publishing static HTML, with private owner-token storage and tested failure handling. Thanks @f-o-x11 (#472).
-
Let
--toolandtool=override the tool of a configuredserver.toolselector instead of silently calling the selector's tool, matching the ad-hoc HTTP path and the tool-calling docs. Thanks @KrasimirKralev (#474).
Verification: npm, registry tarball, release CI, release rehearsal, and native assets. npm integrity: sha512-H0rzo7Zcbg7b/mkoqKAbeZkneUIE+ugeR7KrPUzThmi3jvTBOIMajVz0viv98ugiT5AJr3Z4zkkV0FJew66VlA==.