Changelog

Release notes fromCHANGELOG.mdwith the newest changes first.

Unreleased

• Fixed: Postgres bootstrap checks the legacy OAuth index in its active schema, so a same-named index in another schema cannot make startup fail.

• Tests: Postgres identity, OIDC, and store-parity fixtures now use isolated schemas. Parallel runs no longer replace or delete another test’s identity key during enrollment or KEK rotation.

• Site: redesigned the homepage around a working approval example, clearer setup paths, mobile navigation, and the shared light/dark palette. Refined the ticket-bot SVGs and rebuilt favicons, app icons, and social cards; the social generator now imports brand tokens and preserves SVG masks.

• Fixed: credential drawers match approvals by item ID, keeping same-name staging and production credentials separate. Failed loads offer Retry, late responses cannot overwrite a different drawer, and a pending credential lookup cannot interrupt navigation.

• Console: first-use guidance, a clear-filters action, and persistent error notices. Site copy controls prevent overlapping requests and provide manual-copy guidance when clipboard access is blocked. Browser CI now covers the marketing site and docs search as well as the console.

• Fixed: Always-allow / Connect Also allow this agent for a user-OAuth account stands the source credential the agent names (SPOTIFY_SECRET on api.spotify.com), not only the hidden token mint (POST accounts.spotify.com/api/token on SPOTIFY_REFRESH). A user-path http_request reads <ITEM>_REFRESH for the send the way it already reads a sibling client secret; it does not create an Inbox grant whose requested_scope is the token endpoint (BOTP-14). A direct POST of the refresh item to the token host still needs its own approval. Same for GitHub, Google, Slack, and Stripe Connect.

• Site: remaining docs name the laptop hosted kernel (npm run hosted:dev) and portable self-host. Homepage, FAQ, troubleshooting, Guided setup, Start, Install, Self-hosting, Copy-paste prompts, and the connect pages no longer describe Fly plus Neon as the only run path, or :8888 as the hosted connect URI.

• Fixed: unauthenticated POST /mcp initialize, ping, and tools/list are 401 with the same WWW-Authenticate resource_metadata and scope="mcp" as GET /mcp and tools/call. Grok Bot’s AuthenticateMcpServer builds the Authorize browser URL from that first JSON-RPC 401; a 200 handshake left needsAuth with no_auth_link (Authorize spun, then Retry, no browser) after PR #15 put the challenge on GET only (BOTP-13). A preconfigured avm_ Bearer still skips the card. Cursor desktop OAuth and DCR (including grokbot:// and https://www.cursor.com/agents/mcp/oauth/callback) are unchanged.

• Added: npm run hosted:dev boots the hosted kernel on loopback with sqlite-hosted (or --postgres / VAULT_HOSTED_DEV_DATABASE_URL). Secrets land in gitignored .botpasses-hosted/secrets.json (mode 0600). OTP codes print in the terminal, not in structured logs. Plane dev binds 127.0.0.1 when VAULT_BIND_HOST is unset and is refused when FLY_APP_NAME is set. Run one process per sqlite file; a second writer can get SQLITE_BUSY. Self-host accepts any Postgres 16 URL and a custom https origin; first-party staging/production still pin botpasses.com. Hosted connect on loopback is {origin}/connect/callback; the CLI vault callback stays http://127.0.0.1:8888/callback.

• Fixed: link previews and other cross-origin fetches can load the public site icons and social cards. A foreign Origin on GET/HEAD/OPTIONS of marketing and discovery URLs (/og.png, /logo.png, /favicon.ico, and the rest of the public site) is 200 and reflects Access-Control-Allow-Origin. /api, /console, /collect, and auth pages still 403 that Origin with no allow header. The Host allowlist is unchanged.

• Fixed: docs code blocks use the brand tokens (navy, muted, teal, and the other tested pair colours). A GitHub Shiki theme used to paint its own hex on the light elevated background, so the self-hosting copy-paste prompt was unreadable. Light and dark pages now follow the same contrast contract as the rest of the site.

• Site: copy-paste bootstrap prompts on the homepage and /docs/prompts so an agent can set up hosted MCP, a local laptop vault, or a self-hosted plane. Start, Guided setup, Install, Self-hosting, and the connect pages link them. You type secrets on Botpasses, never in chat.

• Fixed: MCP OAuth dynamic client registration accepts RFC 8252 loopback http://localhost:<port>/… as well as 127.0.0.1 and [::1]. Cursor (and other hosts) register http://localhost:8787/callback in the same DCR set as cursor://… and https://www.cursor.com/agents/mcp/oauth/callback; rejecting localhost used to fail the whole registration with redirect_uri must be https, loopback http…. The avm_ Bearer path is unchanged. javascript:, data:, file:, and http to a non-loopback host are still refused.

• Fixed: an unauthenticated GET /mcp (SSE listen) is 401 with WWW-Authenticate resource_metadata, same as POST /mcp tools/call. Streamable HTTP hosts open that stream after initialize; without the challenge they showed Authorize → Retry and never opened the browser (BOTP-13). DCR accepts the grokbot: desktop scheme and logs dcr_redirect_rejected with scheme and reason only. Grok Bot still needed a 401 on initialize itself (see the handshake fix above).

• Changed: user connect uses one redirect URI for every provider: https://botpasses.com/connect/callback on production, https://staging.botpasses.com/connect/callback on staging, and {origin}/connect/callback on the laptop hosted kernel. The CLI vault callback stays http://127.0.0.1:8888/callback. The Store credential and Collect forms show and copy that URI next to Kind when Kind is Client ID and secret; the Connect dialog shows it again before opening the vendor. /integrations/:provider/callback stays as an alias for apps that already registered it.

• Security: operator inboxes (users, invites, OTP lookup) and live OAuth adapter bearers (refresh, auth code, device code, access token, session, interaction) are stored as a keyed HMAC plus an AES-GCM wrap under the identity DEK. Grant ids stay plaintext so revoke still joins. Magic-link tokens are stored as SHA-256, not the URL token. A Neon dump without the platform KEK no longer yields inboxes or those tokens. Item names, last-4, hosts, and Grant ids remain. Rollback runs scripts/email-restore-plaintext.ts and scripts/oidc-restore-plaintext.ts before reverting the image.

• Site: /security names bound item AAD (orgId|itemId|allowed_hosts_json|inject), email-at-rest, and OAuth-token-at-rest. Last-4 is not stripped from connector bodies. The raw origin cap is 1 MiB, then redact, then 256 KiB. A dump without the KEK hides values, inboxes, and bearer tokens, not names. Bootstrap MFA is skipped only with VAULT_BOOTSTRAP_ALLOW_PLANE=1.

• Infra: CI smoke installs Playwright Chromium from Playwright’s CDN, not Google’s Chrome apt repo, so a Packages.gz hash mismatch cannot fail the job.

• Site and console: official brand. Navy #14213D, teal #00C2A8, Inter wordmark botpasses (no .com). Navy ticket at /mark.svg; white ticket at /mark-on-dark.svg (dark surfaces and social cards). Favicon is the simplified eyes, perforation, and barcode on a navy tile. The local vault serve console uses the same tokens. Social cards and home-screen icons rebuild from the official rasters (node site/scripts/og.mjs, node site/scripts/write-icons.mjs).

• Site: the homepage, social cards, and webmanifest drop the dangling “It never gets the key.” The second sentence is now the same claim as the FAQ: the model does not get the key.

• Site: social cards and icons. /og.png is a 1200x630 card that names Stripe, Slack, and GitHub. /og-square.png covers LinkedIn, Slack, and iMessage square slots. /logo.png is the JSON-LD Organization logo (no longer the landscape card). Android Chrome 192/512 icons and /site.webmanifest ship next to the existing favicon and Apple touch icon. Rebuild with node site/scripts/og.mjs and node site/scripts/write-icons.mjs.

• Repository: tracked files must not contain a local home path, a Linear workspace URL, or a Neon project-slug shape. Operator identifiers stay in gitignored .env.ops. The check scans for those shapes so the real values are not stored in the test.

• Site: FAQ, homepage FAQ, and the grant-vault definition now say the model does not get the key.

• Docs: root SECURITY.md tells researchers to email [email protected] (same process as the site disclosure page). Ops and plan docs no longer name a Neon project slug, a Linear workspace URL, or a local home path. Those identifiers live in gitignored .env.ops (see .env.ops.example). User-facing copy now says the model does not get the key.

• Site: the homepage hero rotates the named API (Stripe, Slack, GitHub, and dozens more) so the promise is not Stripe-only. The highlight sizes to the current name so the period stays next to the word. The first paint and no-JS heading stay “Stripe”. Motion stops when the system asks for reduced motion, the tab is hidden, or the word is hovered.

• Changed: the Agents list groups standing approvals by credential. One Clear control ends the pair (every grant for that agent and credential), instead of repeating the same row for each grant. Hosts and last used stay on the grouped row.

• Site: SEO and AIO/GEO. Every public page ships Organization and WebSite JSON-LD, llms.txt / llms-full.txt alternate links, and index, follow. The homepage defines Botpasses in the first sentence and adds FAQPage, HowTo, SoftwareApplication, and a grant-vault DefinedTerm. Docs pages add TechArticle (FAQ page also FAQPage). llms.txt is generated from the docs collection; llms-full.txt is every docs page in one file. Production robots.txt points AI crawlers at both and lists Sitemap: https://botpasses.com/sitemap.xml. Conventional discovery URLs that crawlers and browsers request are real files, not JSON 404s: /sitemap.xml (the public urlset), /favicon.ico, /apple-touch-icon.png, and /security.txt (same bytes as /.well-known/security.txt). Entries carry lastmod.

• Fixed: API hostnames must be DNS names (api.example.com). A host with spaces, shell characters, a path, or a port is refused at assertAllowedHostname, so local setup, find_items, and http_request cannot put vault set --host api.example.com;… in the result.

• Docs: homepage, OG card, console, and docs copy now lead with a person and a concrete noun. Same promise: your agent can call an API and does not get the key.

• Added: MCP setup walks Collect, optional user Connect, and Always-allow for Spotify, Stripe (secret key), GitHub, Google, and Slack. A miss on a recipe host now prefills Collect (SPOTIFY_SECRET, Client ID + secret, both Spotify hosts). Collect can write a standing grant when Always allow this agent to use this credential is checked (default off). After you connect MCP, ask “Set up Spotify so you can call the API for me.”

• Fixed: http_request to api.spotify.com /v1/playlists/{id}/tracks (GET, POST, PUT, DELETE) is sent as /v1/playlists/{id}/items (Spotify February 2026 playlist content rename), so agents on the legacy path no longer get an opaque origin 403. A DELETE JSON body that still uses tracks is sent with items. Other /tracks paths are unchanged. The result sets path_rewritten, requested_path, and rewritten_path; next.for_model names the rewrite. Grant scope still uses the path the agent sent.

• Fixed: request_grant no longer returns a standing grant as active when the stated host, method, or path is outside grant_scope. A token-scoped item_standing (for example POST accounts.spotify.com /api/token) does not satisfy a playlist call; the tool creates or reuses a pending grant for the requested scope so the operator can approve it. http_request still refuses the out-of-scope call with scope_denied. Grant lookup before consume picks an active grant that covers the call when more than one is open.

• Docs: the OAuth client-secret how-to and Guided setup name the shared redirect URI (https://botpasses.com/connect/callback on production) instead of a per-provider /integrations/<provider>/callback.

• Added: Inbox Always approve for this agent (opt-in item_standing for one credential and one agent, on hosts already on the item). Default Approve stays one call. A matching later http_request proceeds without a new Inbox card and writes audit auto_approved (item name, client, host; never values). Clear the standing approval from the agent row, Approvals, or the credential drawer. Approve with limits can check the same box.

• Fixed: console. Closing the credential drawer or the connect dialog returns to the list only while the route still names that item, so a close event delivered after a newer route (another item, a deep link) no longer sends the page back to the list.

• Changed: an agent that calls a provider path which answers only for a signed-in user (Spotify GET /v1/me) with the app client secret and no <ITEM>_REFRESH is refused before dialing. The result is { status: "user_connect_required", provider, item_name, refresh_item_name, connect_url, need_id, hint } with next steering; nothing is sent, so a one-call approval comes back instead of being spent on a 401. The request lands in the Inbox as ” needs a account for ” (need_items.kind = connect, migration 013; repeated calls reuse the row; audit connect_requested). Its Connect button, and the connect_url deep link (#credentials/item/<id>?connect=&agent=&need=), open the connect dialog with the Client ID prefilled and “Also allow to use the connected account” checked, so the callback writes the agent’s standing policy on the refresh item, closes the card (need_fulfilled), and the agent’s retry succeeds through the user-token path without a second approval. Deny on the card marks the need denied (POST /api/need-items/:id/deny, audit need_denied); the collect page refuses a connect need. dry_run reports reason: "user_connect_required". The local plane returns the same status without connect_url and a hint naming vault set <ITEM>_REFRESH --inject refresh.

• Infra: the GitHub default branch is dev, so deploy-staging can run after ci on dev. Provider-test fixtures no longer use Slack-shaped token strings that gitleaks treated as leaks.

• Fixed: the hosted Postgres pool no longer sends statement_timeout or options as startup parameters. Neon -pooler (PgBouncer) refuses those, so the process never listened and Fly’s /ready check failed. Client-side connect/idle timeouts and application_name stay. Fly HTTP check grace is 60 s.

• Infra: deploy-staging starts a Machine flyctl left stopped and waits until https://botpasses-staging.fly.dev/ready is 200, so a rolling-update leftover cannot go green while the origin is down.

• Fixed: a leftover VAULT_BOOTSTRAP_TOKEN on staging without VAULT_BOOTSTRAP_ALLOW_PLANE=1 no longer exits 78. Auth still ignores the token; boot logs bootstrap_token_ignored. The previous refuse-to-boot guard crash-looped the Fly Machine.

• Security: the browser-side CSRF cookie readers (console and collect bundles, the auth pages, the invite page) read __Host-bp_csrf first and fall back to the plain bp_csrf only when the host-prefixed cookie is absent. A plain cookie a subdomain plants can no longer shadow the real token and break every mutation on the HTTPS origin.

• Security: the hosted entry point (npm run hosted, startHosted) refuses to start without VAULT_MODE=hosted (exit 78 with a message naming it). Every hosted boot guard is keyed on that mode, so an unset mode used to run the process with no plane check, an empty session secret, test auth accepted, and a bootstrap token needing no flag. VAULT_OIDC_PREVIOUS_JWK with the wrong shape is now the same exit 78 at boot instead of exit 1 after the KEK was unwrapped and Postgres opened.

• Security: proxy headers are trusted per header. Fly-Client-IP counts only on Fly (FLY_APP_NAME); behind a proxy the deployer runs (VAULT_TRUST_PROXY=1) only the last X-Forwarded-For hop counts, so a client can no longer choose its own address for every rate limiter, or claim a Cloudflare address to unlock CF-Connecting-IP, by sending a Fly header. The request id follows the same rule: Fly-Request-Id is reused on Fly, a client-chosen x-request-id is never reused, and a UUID is minted everywhere else.

• Security: POST /mcp on vault serve is one session per client. initialize answers with an Mcp-Session-Id header (400 without it on later frames, 404 when unknown or idle for 8 hours), so a second client’s initialize no longer renames the agent that another client’s grants are keyed on. vault mcp --remote carries the header. Stdio vault mcp is unchanged: one session per process.

• Fixed: local POST /api/items and /api/secrets take username (HTTP Basic user, OAuth client id, or AWS access key id; null clears it), and the local console’s store form has a username field, which HTTP Basic requires.

• Docs: the self-hosting page shows hosted mode started with VAULT_BIND_HOST and PORT (the --host and --port flags are local only), lists VAULT_BIND_HOST, PORT, and VAULT_SITE_ROOT, and no longer lists VAULT_TRUST_PROXY twice; .env.example lists VAULT_KEK_NEW.

• Fixed: an allowlisted API answering 204, 205, or 304 (a DELETE that returns no content) or a status outside 200 to 599 through the pinned TLS path threw inside the HTTP parser callback, which ended the hosted process and never settled the call. The connector no longer builds a WHATWG Response there: a bodiless answer comes back with its status and headers and an empty body; a status no client may carry is a 502 bad_status. Both count as an origin answer, so a one-call approval stays spent.

• Security: the body_too_large result (an origin body over 1 MiB) returned its origin headers unredacted; a Link header echoing a query:<param> key reached the model. Its headers are now redacted like every other answer’s. http_request refuses double-encoded separators and dots (%252F, %252E, and deeper), a percent-encoded NUL (%00, %2500), and control characters in path, which an origin could decode again.

• Fixed: a refresh-token exchange for a stored <ITEM>_REFRESH sent only refresh_token and client_id, which every provider except a PKCE public client refuses with invalid_client. The exchange now authenticates the app the way the connect exchange did: the client secret item goes out as HTTP Basic (Spotify, Slack) or as client_id and client_secret form fields (GitHub, Google, Stripe Connect), the refresh token rides in the form, both items must allow the token host, and neither value reaches the result or the audit. The same holds when an agent posts <ITEM>_REFRESH to the token endpoint itself through http_request: it needs only its approval on the refresh item, Botpasses reads the sibling client secret (<ITEM>_SECRET, then <ITEM>, same environment), builds the exchange per the provider’s token auth, returns the redacted body with refreshed: true and token_last4, caches the user token, persists a rotated refresh token (refresh_rotated), and audits inject for both items. Without a sibling, a PKCE provider gets the public-client exchange; any other provider is refused before dialing with inject_denied and missing_item instead of a vendor invalid_client.

• Fixed: a token endpoint that answered 2xx with an unusable body (not JSON, no access_token) was audited inject_failed although the credential had been sent; the row is inject. inject_failed now means only that the origin was unreachable before the TLS handshake.

• Fixed: http_request with dry_run reported an expired or spent standing policy as standing; it now applies the same liveness test a real call does and reads the stale row past without deleting it.

• Fixed: the console’s plain Approve on a trusted (avt_) client’s grant was refused with scope_unenforceable whenever the agent had stated a call, because the request’s method, host, and path were inherited. A plain approve for a trusted client is written unrestricted; an explicit methods, path_prefixes, or hosts is still refused.

• Changed: the next.for_model steering for a body_too_large answer tells the model the response was over 1 MiB and to narrow the call (pagination, a smaller page, a fields filter) instead of “retry once”, which spent another one-call approval on the same oversized answer.

• Fixed: token_last4 for a minted token under four characters showed the whole token; it reads **** like every other last4.

• Repository: sha256Hex and last4 in the provider engines are the ids.ts ones; the dead PK-conflict catch in personal-org provisioning (ids are random now) is gone; docs/ops/migrations.md notes the 010 to 012 numbering gap.

• Repository: the local plane’s grant scope type is LocalGrantScope (once or session); it no longer shares the name GrantScope with the hosted scope object.

• Docs: the threat model covers trust decided at boot, proxy trust, single-use sign-in state, the canonical request path, and prompt-grant semantics; ADR 0008 records the hardening decisions and their consequences. The security page links it and names ADR 0006 correctly.

• Repository: npm run botpasses is gone; it ran the same command as npm run vault (the botpasses bin name stays for npx). One nowIso (ids.ts; the local vault imports it there), one sha256Hex, one tokensEqual, one sendHtml, and one VAULT_DEPLOY_PLANE parser (deployPlaneRaw, used by the KMS provider, the bootstrap-token check, and the kek-wrap and kek-rotate commands too) replace their copies; the unused OperatorIdentity.clientIp, the clientIp auth-route option, FindItemsStatus, and loadout.lock.json are removed. .env.example lists FLY_ALLOC_ID and no longer repeats VAULT_OIDC_PREVIOUS_JWK and VAULT_TRUST_PROXY.

• Fixed: vault init on a fresh machine created master.key before its directory existed and failed with ENOENT; the home directory is created first (mode 0700).

• Fixed: the stdio MCP server survives a malformed frame. A line that is not a JSON-RPC request object (null, a number, a string, an array) is answered with -32600 and id: null, a frame without a method is -32600 rather than -32601, and an unexpected error while handling one frame is answered with -32603 instead of ending the process with exit 1.

• Fixed: vault mcp --user-jwt=TOKEN (the equals form) was not recognised and silently served the local vault. --user-jwt in either form selects hosted mode; the token is the flag’s value or VAULT_USER_JWT, and a missing token is an error. --remote with --user-jwt, an unknown option, or a stray argument is refused instead of serving.

• Fixed: Google and Slack user connects sent no scopes and both vendors refused the authorize request. Google now asks for openid email plus the read-only Gmail and Sheets scopes and the per-file Drive scope, with access_type=offline and prompt=consent so a refresh token is issued on every connect; Slack asks for a user token with user_scope (comma-joined users:read,channels:read,chat:write) and the exchange reads the user token from authed_user. A provider whose endpoint requires scopes refuses to build an authorize URL without any (400 scopes_required). With the refresh fix above, a Google or Slack connect now works end to end: the stored <ITEM>_REFRESH is exchanged with the app’s client secret on later calls, on a user path and at the token endpoint directly.

• Fixed: both SQLite stores set busy_timeout to 5 s, so a second writer (vault serve next to vault set) waits for the lock instead of failing at once with “database is locked”.

• Fixed: console. A #credentials/item/<id> deep link opens the drawer after the list has loaded (an unknown id says so and returns to the list); Enter or Space on a focused credential row opens the drawer and it stays open; each panel loads once per navigation and once at boot (hashchange only, popstate fired a duplicate); the backup-code Copy and Download buttons work on every click and a regenerate no longer stacks stale handlers; the confirm dialog focuses Cancel, not the destructive button; a failed deny keeps the confirm open with the server’s message; a load error on Credentials hides the “no credentials match” line; the activity page survives an inbox refresh with the same filter; 59.6 minutes reads “1 hour ago”, not “60 mins ago”.

• Fixed: vault grant refuses --once with --session and --ttl without --session (both were silently ignored); vault <command> --help prints usage for every command instead of “Unknown option”, and vault mcp --help no longer starts serving; vault serve --port must be a whole number from 1 to 65535.

• Fixed: scripts/hosted-backup.ts prints one line to stderr and exits 1 on a usage error or a bad BACKUP_KEY instead of a stack trace.

• Fixed: the migrator identifies an applied migration by its three-digit number. A migration file renamed after it ran is refused with both names instead of being applied again.

• Docs: the site install and connect pages, the CLI reference, both HTTP references, and the README describe the local server as it is (five tools including http_request; GET/POST /api/items next to /api/secrets; --ttl belongs to --session).

• Security: a personal org gets a random id and records who created it (orgs.created_by, migration 010). An owner who was removed from the org they created no longer regains it by signing in; they land in a fresh org. An org a user created that has no members at all (a provisioning that stopped before the owner insert) is reclaimed instead of duplicated.

• Security: item envelopes written before AAD binding (bound to the org id alone) are re-encrypted under org_id|item_id|allowed_hosts_json|inject once at boot (aad_rebind log with rebound, verified, unreadable, batches, stopped, ms; items.aad_version, migration 010). The inject path no longer falls back to the legacy binding. updateItem writes a re-encrypted envelope and the columns it is bound to in one statement. The rebind runs after the server listens, so /health and /ready answer inside the Fly check’s grace period on a large table, and reads rows in pages of 200 (aad_rebind_progress per page; memory bounded by one page). The signal handlers are installed before it: a SIGTERM during the pass ends it at the next page boundary and the drain waits for the page in flight before closing the pool. A rebind that throws logs aad_rebind_failed and the process keeps serving (rows still at version 0 fail closed on inject; the next boot resumes). docs/ops/migrations.md describes the first boot after 010.

• Security: rotateItem enforces the 64 KiB value cap, and rotate, update, and delete by item id refuse production items on the staging deploy (404) like list and inject already did.

• Security: a grant for a trusted (avt_) client refuses method, path, and host limits at approve (400 scope_unenforceable), explicit or inherited from the request, because /runtime/resolve has no call to check them against; max_calls and ttl_seconds stay. Wrong approval-code attempts survive a code rotation (an agent re-requesting no longer resets the five tries) and POST /api/grants/approve-by-code is limited to 20 attempts per org per 15 minutes (429).

• Security: GET /approve?token= sends a session that has not passed the authenticator step to /verify-totp (or /enroll-totp) like a signed-out visitor goes to /sign-in, instead of a JSON 403.

• Changed: KEK rotation runs while serving. The hosted process accepts VAULT_KEK_PREVIOUS_WRAPPED (or raw VAULT_KEK_PREVIOUS, refused under VAULT_KEK_REQUIRE_KMS=1) next to the current KEK; an org DEK or the identity DEK still wrapped under the previous KEK opens and is re-wrapped in place (dek_rewrapped audit row and log line, kek_previous_loaded at boot). Boot refuses a previous key equal to the current one, both forms at once, or a bad length. vault kek-rotate stays for the offline pass and accepts VAULT_KEK_NEW. Runbook rewritten: set previous, deploy, rotate, remove previous.

• Changed: revoking a grant drops the folder_standing policy only when that grant was activated by it; revoking a prompt, session, or item grant leaves a folder-wide approval in place. Approving item_standing or folder_standing replaces a stale policy row for the pair instead of failing on the unique index. Grants are looked up per (client, item) pair through the grants_client_item_status index rather than by scanning the org, and the hourly sweep deletes revoked, consumed, and expired grants settled more than 30 days ago (sweep_expired logs grants; audit rows stay).

• Changed: the offsite backup envelope starts with BPBK and a version byte, authenticated with the body; hosted-backup.ts decrypt refuses a file without the magic or with an unknown version. Dumps written before this change do not carry the header and must be decrypted with the previous release.

• Repository: clients_oauth_client_id and org_members_org (migration 003) are in schema.ts too, and the Postgres parity test now checks indexes in both directions. Docs say what the item AAD is (README, threat model).

• Security: sign-in counters are atomic in the store. An email-code attempt is claimed with one conditional UPDATE before the hash check (claimOtpAttempt), so concurrent guesses cannot share a slot; POST /api/auth/otp/verify is limited to 50 verifies per address and 25 wrong codes per email in 15 minutes (a verify for an address with no live code, or a correct code, does not spend the per-email budget, so bogus verifies posted for someone else’s address cannot lock that person out), and a verify for an address with no live code costs the same scrypt work as a wrong code. Authenticator attempts are charged the same way (claimTotpAttempt), the replay guard and backup-code consumption are conditional updates (consumeTotpStep, markBackupUsed returns whether it consumed), so the same code or backup code passes exactly once even when submitted twice at once. Confirming an enrollment consumes the pending secret with one conditional update (consumePendingTotp), so two concurrent confirms of the same code replace the secret and mint backup codes exactly once.

• Security: the CSRF token is signed for the session cookie it travels with; a token from another session is 403. On HTTPS only the __Host- cookies are read, only on a request the proxy marks x-forwarded-proto: https; a plain-named cookie is no longer a fallback (cookie tossing cannot fix a session). A cookie value that is not valid percent-encoding is ignored instead of a 500.

• Security: operator sessions are listed and revocable by the org they act in (active_org_id when still a member, else the first membership), not by every org the user belongs to. listMembershipsForUser orders by joined_at NULLS FIRST, org_id on both stores, so “first membership” is the same on SQLite and Postgres.

• Security: VAULT_BOOTSTRAP_TOKEN is honoured on staging and production only with VAULT_BOOTSTRAP_ALLOW_PLANE=1 (break-glass window; unset both afterwards). A leftover token without the flag is ignored (bootstrap_token_ignored) and does not fail boot. When the token is live it logs bootstrap_token_enabled at boot and every use logs auth_bootstrap_used with a token hash, address, method, and path. Proxy headers (Fly-Client-IP, X-Forwarded-For) are used for the caller’s address only behind Fly or with VAULT_TRUST_PROXY=1; otherwise the socket peer counts.

• Security: POST /api/orgs requires a ready session (authenticator step passed), a printable name of 1 to 80 characters, and stays under the new per-user orgs plan limit (10; VAULT_PLAN_LIMITS_JSON key orgs, 402 plan_limit). Invites are limited to 10 per inviting account and 30 per address per hour (429).

• Fixed: POST /api/auth/otp/send emails first and stores the challenge only after delivery, so a mailer outage no longer leaves a dead code that blocks sign-in for ten minutes. A resend while a code is still valid sends a new code and expires the old one (it counts against the 5 per 15 minutes budget); the Resend button works.

• Fixed: session cookies carry the 7-day absolute lifetime instead of the 12-hour idle window, so the server-side idle extension is reachable: activity keeps a session alive for up to 7 days, an idle one still ends after 12 hours.

• Fixed: auth_otp_sent, auth_otp_locked, auth_totp_verified, auth_session_revoked, auth_signed_out, and auth_bootstrap_used log lines are emitted. auth_session_revoked is written after the session is deleted, so a refused attempt (an operator on another member’s session, 403) is not logged as a revocation. The console follows a 403 mfa_required to verify_url or enroll_url instead of showing an error.

• Fixed: OAuth consent completes in a real browser. The consent page’s script posted the decision and then read the redirect’s Location, which browsers hide from scripts, so Allow never left the page. POST /consent now answers a caller that sends Accept: application/json with 200 { location } and the page navigates there itself; a caller that sends the CSRF header without that Accept keeps the 303. A form submit without the header (scripts off) is 403: the consent form carries no CSRF field and POST /consent needs the double-submit token like every other cookie-session mutation. A Chromium smoke test registers a client, opens /oauth/authorize, clicks Allow, lands on the redirect URI with a code, and exchanges it.

• Fixed: re-enrolling an authenticator from the console shows a QR code. /enroll-totp sent a ready operator straight back to the console, and the page would have started a second secret anyway. The page now renders while a re-enroll secret is in flight and reads it back through the new GET /api/auth/totp/pending (the same otpauth_url and qr_svg that totp/start returned, live for ten minutes), calling start only when nothing is pending. A reload during first enrollment keeps its secret the same way. The console’s code dialog also accepts a 10-character backup code now (it cut input at 8 characters, so a backup code could never pass), and says so. A Chromium smoke test re-enrolls from the console with a backup code and confirms the new secret.

• Changed: console, auth, and collect assets are referenced at content-hashed paths (/assets/console.<sha8>.js) and served immutable; the plain names still resolve but are no-cache, so a deploy can no longer be pinned to a stale bundle by a year-long cache.

• Security: JSON routes require Content-Type: application/json (415 otherwise; a bodiless POST still reads as {}), so a cross-site HTML form can never reach a JSON handler whatever the CSRF check says. POST /approve and POST /consent, which back HTML forms, also accept a form body.

• Security: the marketing site is served only on an allowed Host, like every other page; a foreign or loopback Host on a public plane is refused. Health, readiness, discovery, and assets still answer on any Host.

• Repository: the unused src/hosted/collect-js.ts is gone (the collect page has been served from the client bundle); /consent and /device are only mounted with the OAuth provider instead of falling back to an unbacked form.

• Security: hosted boot refuses VAULT_AUTH_MODE=test outright (the process never installs header principals) and requires VAULT_DEPLOY_PLANE to be staging or production; an unset plane used to mean production and skipped the plane guards. VAULT_APPROVAL_HMAC must be 64 hex characters, the kernel refuses a key under 32 bytes, and approval links are bound to the org they were minted for. createHostedServer without an authResolver now authenticates nobody instead of trusting test headers.

• Security: vault serve prints two loopback bearers instead of one. The operator bearer opens /api and the console; the model bearer opens POST /mcp; each is refused on the other surface, so an MCP client can no longer approve its own grants. vault mcp --remote forwards stdio to a running vault serve with the model bearer. The local server answers only to a loopback Host, caps JSON bodies at 128 KiB, sends a nonce CSP on the console, and no longer echoes driver or parser errors. vault set --value is gone: pipe the value or type it at the no-echo prompt. master.key is refused when group or others can read it.

• Security: behind Cloudflare the rate-limit address comes from CF-Connecting-IP only when the address Fly saw is inside VAULT_TRUSTED_PROXY_CIDRS (default: Cloudflare’s published ranges; empty disables the header). Deploy and backup secrets move to GitHub environments (staging, production, backup) and flyctl deploy names its app with -a; deploy-prod also refuses a SHA with no successful deploy-staging run.

• Fixed: one request id per request. The inbound x-request-id (or the minted one) is now the same value in the access log, the request_error line, the 500 body, and the Sentry event; error messages are redacted before they are logged. A malformed percent-escape in /collect/:id or a site path is a 400 or 404 instead of a 500 plus a Sentry event; /ready caches its database ping for 5 s. Errors after headers are sent are logged under the request id and the stream is cut; a site file stream error no longer ends the response as if complete.

• Changed: the hosted server sets headersTimeout 15 s, requestTimeout 30 s, and keepAliveTimeout 65 s (SSE streams exempt); one principal may hold at most four open GET /mcp streams (429 past that). Signal handlers are installed before the boot-time sweep; vault serve in hosted mode installs the process guards; a plane without SENTRY_DSN logs sentry_dsn_missing. Docs: .env.example lists VAULT_TRUST_PROXY, VAULT_TRUSTED_PROXY_CIDRS, VAULT_BOOTSTRAP_ALLOW_PLANE, VAULT_OIDC_PREVIOUS_JWK; docs/ops/migrations.md covers statement timeouts.

• Security: a revoked OAuth agent stays revoked. Only a fresh consent (authorization code or device code) reactivates the (org_id, oauth_client_id) row; a refresh token held by another member of the same org for the same client id is refused with invalid_grant, and revoking the agent destroys every consent the org’s members gave for that client id, not only the first consenter’s; the account-scoped sweep for the consenting account then removes only rows with no grant behind them, so that person’s grants for the same client id in other orgs (and their refresh tokens) survive. Consent binds the org the operator session acts in into the OAuth grant, the access JWT carries it as org_id, and /mcp checks the account is still a member of that org instead of picking the account’s first membership (verification no longer provisions an org). Authorization codes, device codes, and refresh tokens are consumed with one conditional write, so two concurrent exchanges of the same code cannot both succeed.

• Security: POST /oauth/revoke denylists JWT access tokens (verified against this server’s keys and bound to the calling client), and revoking a refresh token, or replaying a rotated one, marks every access token issued under the same grant in the ledger (access_events.grant_id, migration 012). Client ID Metadata Document fetches are limited per requesting IP (10 per hour) as well as per target host (30 per hour), capped at 4 in flight, and time out after 3 s. POST /device user-code attempts are limited to 10 per 15 minutes per IP and per OP session. JWT verification allows 30 s of clock skew, no more. DPoP is off (nothing enforced it).

• Changed: the OAuth server accepts only what discovery advertises: token_endpoint_auth_methods_supported is ["none"] (dynamic and CIMD clients are public clients), response_types_supported is ["code"], and response_modes_supported lists the modes the engine really serves (query, fragment, form_post); the engine and the document are built from one set of constants. POST /api/clients/:id/rotate on a revoked agent is 409. VAULT_OIDC_PREVIOUS_JWK publishes the key being rotated out in JWKS and keeps verifying tokens it signed; new tokens are always signed with VAULT_OIDC_PRIVATE_JWK. Runbook: docs/ops/oidc-key-rotation.md.

• Removed: the AgentPass Authority stub (/agentpass/*, VAULT_AGENTPASS, the agentpass list on GET /api/inbox). It reported pending passes as allowed, never used its signing key, and validated without authentication; the table agentpass_passes stays (schema is expand-only) and is unused.

• Fixed: the OAuth request handler now settles once oidc-provider has answered (it awaited a Koa next that never fires), so every OAuth request no longer leaves a pending promise behind.

• Security: the connector no longer hangs when an origin closes the connection mid-response (the call fails at once with a 502 that names the cause), reads at most 1 MiB from an origin before cutting the socket and returning origin_status: 502 with { "error": "body_too_large" }, and asks for uncompressed bodies. Request paths are canonical in every layer: one canonicalRequestPath validates http_request and request_grant paths, is stored as requested_scope, shown on the inbox card, checked against the approval scope, and sent on the wire; backslashes, percent-encoded / \ . inside a segment, and . or .. segments (encoded or with a ;param suffix) are refused, so /v1/read/..%2fadmin and ..;/ no longer pass a /v1/read scope.

• Security: a one-call (prompt) approval is spent as soon as the credential leaves the process. Any origin status, a connection closed mid-response, or a timeout after the TLS handshake consumes it; it is handed back only when the send never left (host mismatch, blocked address, unusable mode, or a DNS, connect, or TLS failure). Operators who expect retries approve with max_calls or session; the inbox card, steering copy, and docs say so. The local once grant follows the same rule.

• Security: the local MCP no longer accepts agent_id or tool_id arguments to act as another agent; every tool refuses arguments outside its schema with JSON-RPC -32602. Cookie sessions that have not passed the authenticator step cannot drive POST /mcp as a model. Another organization’s need is 404 on GET /api/need-items/:id, not 403. Redaction also covers lowercase percent-encoding, form + encoding, HTML entities, and the HTTP Basic pair under the client_id actually sent to a token endpoint.

• Fixed: the user-token path uses a cached access token without spending the <ITEM>_REFRESH approval; when the refresh item has no approval for this agent, http_request returns the pending grant for <ITEM>_REFRESH with a hint instead of silently falling back to an app token; a refresh token the provider rotates replaces the stored value in place (audit refresh_rotated). dry_run reports scope_denied when the approval would refuse the call. content_type must be one of the two supported values and a URL or host with a port other than 443 is refused with a hint. allowed_hosts are stored lowercase and compared case-insensitively. task_description is cut to 500 characters on grants. suggestedNameFromHost yields a valid name for every host (api-v2.example.com becomes API_V2_EXAMPLE_COM, a leading digit gets H_). The provider connect callback carries a reason code (state_expired, provider_denied, exchange_failed, no_refresh_token).

• Local plane: http_request honours client_id, timeout_ms, and dry_run with the hosted payload shapes and returns origin_status and origin_headers; vault set takes the hosted inject vocabulary and --username (HTTP Basic user, OAuth client id, or AWS access key id; local schema 3 adds the column); list_items shows the username.

• Fixed: the production image builds again. The site stage now carries the three repository files the site build reads (src/brand-visual.ts, CHANGELOG.md, docs/security/threat-model.md); .dockerignore lets those two Markdown files through. CI gained an image job that runs docker build and checks the image exits 78 on an unsafe configuration.

0.5.0 (2026-09-04)

• Console: the sidebar sign-in links are hidden while signed in; the Connect account action shows only on OAuth client secrets; the credential drawer shows created and updated times (created_at, updated_at on /api/items); approving or denying re-renders the inbox even while another card’s limits form is open; a pending approval’s button reads Deny. Site: homepage spacing and shorter examples in How it works; docs name the Credentials panel; the docs breadcrumb no longer repeats a section that matches the page.

• Infra: the site builds on Astro 7 (npm --prefix site audit was failing on advisories fixed only in 7.1+); @astrojs/markdown-remark is installed for the docs table rehype plugin. The secrets-scan CI job has pull-requests: read so gitleaks can list the PR’s commits. npm audit in CI and the prod deploy runs through scripts/audit.sh (90 s per attempt, three attempts) because the registry’s advisory endpoints sometimes hang; in CI the audits are their own audit job so they cannot consume the test job’s time budget.

• Security: a provider connect that finds an existing <ITEM>_REFRESH resets its hosts and inject mode to the provider defaults, not only its value, so a row someone stored earlier with other settings cannot receive the token; the connect state is bound to the operator who started it; the dev loopback callback is accepted only when Botpasses itself runs on loopback; connects and the agent_client_id standing policy are audited (provider_connected, grant). Origin response headers are redacted on the token-endpoint paths too, including for the minted token.

• Changed: provider user connect is generic. POST /api/integrations/:provider/start and GET /integrations/:provider/callback work for every registry provider with an authorize URL (Spotify, GitHub, Google, Slack, Stripe Connect); the spotify paths are the same routes. The console shows “Connect account” on credentials whose hosts belong to a provider, and one dialog serves them all. The refresh token is stored as <ITEM>_REFRESH, allowed on the provider’s API and token hosts, and the callback refuses a state minted for another provider.

• Changed: connecting an account no longer gives every model client standing access to the refresh token. Pass agent_client_id on the start request to grant one named agent; otherwise approve in the inbox as usual.

• Changed: the hosted sweep also deletes unaccepted org invites more than seven days past expiry (sweep_expired logs orgInvites). VAULT_PLAN_LIMITS_JSON is documented in .env.example and the README.

• Repository: dead code removed (hashBearer, lookupTrusted, updateItemMeta, assertNoSecret, dirnameOf, siteIndexExists, openVaultFromEnv, the store’s getClientByHashedSecret); inject_denied and scope_denied are typed errors (isInjectDenied, isScopeDenied). kernel.ts, kernel-grants.ts, and http.ts are split into modules under 600 lines (kernel-items, kernel-clients, kernel-orgs, kernel-connect, kernel-grant-scope, kernel-grant-approval, http-connect-routes); the SQLite and Postgres stores share one set of row mappers (src/store/rows.ts). Tests that grepped source or README wording now test behaviour.

• Changed: an operator session calling POST /mcp (the stdio shim) uses the plane’s default environment instead of one named in the RPC body; a revoked OAuth client row is reactivated by a fresh consent (client_reactivated audit) because (org_id, oauth_client_id) is unique; deleting an org removes its members’ OAuth payloads only for that org’s clients (a member’s sessions in another org survive). Fly-Client-IP is trusted only behind Fly or with VAULT_TRUST_PROXY=1. Scope path prefixes match on segment boundaries and paths with . or .. segments are refused. Origin response headers are redacted like bodies. Token minting requires the provider token host on the credential’s allowed hosts.

• Team: owners invite by email (7-day link, also copyable from the console), set roles, and remove members; the last owner cannot be demoted or removed. Invited operators accept at /accept-invite with the matching email. Sessions carry an active org and the rail shows a switcher when the user belongs to more than one. New Team panel under Account. Migration 009.

• Plan limits: free tier of 25 credentials, 10 agents, 3 members, 5000 http_request calls per month (VAULT_PLAN_LIMITS_JSON overrides); exceeding one is 402 plan_limit. GET /api/plan and the Account panel show usage.

• Local plane: vault mcp exposes the hosted tool names and shapes, including http_request over the shared connector with per-item hosts and inject mode (vault set --host … --inject …); the agent id comes from the MCP client name. The local console no longer uses innerHTML.

• Added: a provider registry (Spotify, GitHub, Google, Slack, Stripe Connect) drives OAuth token minting and refresh; every vendor hostname and rule left connector.ts and mcp-http.ts. Refresh sends refresh_token and client_id in the form body (RFC 6749 section 6) and the user-token path forwards the request body.

• Added: inject modes query:<param>, cookie:<name>, hmac:stripe_sig|slack_sig|github_sig, and sigv4; unknown modes are refused at store time (400) and at send time (500 inject_unsupported) instead of falling through to Bearer.

• Added: http_request returns origin_status and allowlisted origin_headers, accepts timeout_ms (1 to 30 s) and dry_run. status on origin results is deprecated in favour of origin_status. Out-of-scope calls steer the model to request_grant with the call it needs. MCP instructions no longer name vendors except the providers line.

• Scoped approvals. request_grant and POST /api/grants/request take the host, method, and path the agent will call; the inbox card reads “wants to GET api.stripe.com/v1/balance” and a one-click Approve is limited to that call. “Approve with limits” sets methods, a path prefix, a call quota, and a duration. Standing approvals can expire; session length is a parameter (ttl_seconds, up to 24 h). Out-of-scope calls are refused with scope_denied and audited; quotas mark the grant consumed on the last call. list_items includes allowed_hosts. Grant and policy code moved to kernel-grants.ts. Migration 008 adds nullable scope columns to grants and policies.

• Security: POST /api/grants/request ignores operator_email from model clients; operators may only name a member. GET /approve?token= renders a confirm page and no longer changes state; POST /approve approves. Cookie sessions calling POST /mcp need the CSRF token and a same-origin Origin; GET /mcp requires a principal. Approval emails escape client and item names and go to every verified org member when no address is given (notify_failed is now false when one send succeeds).

• Security: request_grant returns the existing open grant for a client and item instead of inserting duplicates; revoking a grant revokes every open row for that pair and deletes its standing policies; the org rate limit is counted inside the kernel so http_request cannot bypass it. session grants past expires_at read as expired.

• Security: origin bodies are redacted for every encoding of the secret (raw, Basic base64, base64url, URL-encoded, JSON-escaped, hex) and nested OAuth token keys, before the 256 KiB cut; body-wide last-4 masking is gone. Hosted item envelopes bind orgId|itemId|allowedHosts|inject as AAD (migrate-on-read). SSRF blocklist covers multicast, reserved, TEST-NET, NAT64, 6to4, and site-local ranges; the pinned HTTPS path is tested against a local TLS server.

• Breaking for MCP clients: the primary tool is http_request (destructiveHint: true); http.request stays as an alias on tools/call for one release and is no longer advertised. The environment argument left every tool schema (it was ignored). Steering distinguishes 4xx (change the request) from 5xx (retry once); connection failures say what failed without the raw error.

• Fixed: a wrong 8-digit code no longer burns attempts on every pending approval; unexpected server errors are 500 { error, request_id } with an x-request-id header instead of echoing the message; malformed JSON is 400 Invalid JSON; inject is audited after a successful send (inject_denied / inject_failed otherwise); session revoke needs the 12-character id prefix and owner role for another member; deleteOrg removes access events, rate hits, and members’ OAuth payloads; HEAD /console works; new POST /api/clients/:id/environment.

• Repository: http.ts split into http-item-routes.ts, http-client-routes.ts, http-grant-routes.ts, http-mcp-routes.ts, http-util.ts. ADRs renumbered: grant-vault trust model is 0006 and KMS-wrapped KEK is 0007 (they collided with 0003 and 0004). CLAUDE.md is 35 lines again.

• Security: the authenticator step is enforced at sign-in. The email code issues a pending session; operator routes stay 403 mfa_required (with verify_url) until POST /api/auth/totp/verify or enrollment sets mfa_at. Existing sessions re-verify once after deploy. Re-enrolling an authenticator requires a current code and invalidates unused backup codes. Ten wrong codes lock the account for 15 minutes. Per-IP limits read Fly-Client-IP. Authenticator secrets are wrapped under an identity DEK that vault kek-rotate re-wraps. Backup codes are shown in their own step with Copy and Download; nothing redirects past them. New GET /api/auth/me and POST /api/auth/backup-codes/regenerate.

• Security: OAuth access tokens are scoped to the operator’s org (the JWT sub selects the org, then (org_id, oauth_client_id)), so a dynamic client id shared by every user of a hosted MCP client no longer crosses tenants. Consent shows the app name, redirect hosts, and a first-connection notice; the device page renders the field oidc-provider requires so device login works; only the literal allow decision grants. Redirect URIs must be https, IP-literal loopback http, or a named desktop scheme. oidc-provider is told it sits behind the TLS proxy; its session lasts one hour, is never remembered, and ends on logout; cookie keys are HKDF-derived. Client ID Metadata Documents are fetched through the SSRF-pinned fetch. oidc_payloads gained indexed uid, user_code, grant_id, client_id, account_id columns; consumed codes keep their TTL.

• Fixed: OAuth-connected agents are created in the plane’s default environment (production on production) instead of always staging, named after the app’s client_name, and record the consenting account.

• Console: panels are Inbox, Credentials, Agents, and Account (with Sign out). Cancel works in every dialog. Confirm dialogs name the credential or agent and what stops working. Credentials has search, environment and kind filters, sort, and a detail drawer with per-item revoke. Agents has a two-step Connect card, a once-shown token modal, an inline environment selector per agent, and Agents, Approvals, Sessions, and Activity tabs with readable activity lines and paging. Inbox polls every 15 s, shows request times and code expiry, and has Deny. Vendor tips (Grok, OAuth client secrets) sit behind disclosures; the deploy plane is only shown on staging. A light theme follows the system. Client JS is built from typed modules under src/hosted/client/ by scripts/build-client.ts; the committed bundle must be regenerated when they change (a test catches a stale bundle). Playwright smoke test covers sign-up through sign-out at 1280 and 390 px.

• Site: docs are Markdown content collections with a generated sidebar, breadcrumbs, and prev/next. New pages: connect Claude Code and ChatGPT, install, troubleshooting, FAQ, self-hosting, rate limits, security disclosure, and using an OAuth client secret. The homepage explains the flow with the real http_request call and a redacted result, names the trust model, and answers common questions; the security page imports the threat-model table, encryption, connector hardening, and the canary tests. Canonical URLs have no .html (old forms 308), unknown site paths get an HTML 404, hashed assets are immutable, llms.txt and security.txt ship, docs search works, and /changelog renders this file. Site and console share one token source.

• Repository: vendored agent-harness scaffolding (.cursor/*, .loadout/, processes/, .claude/{agents,commands,hooks,settings.json}, loadout docs) removed; INSTALL.md now describes Botpasses. Migrations 006_identity_mfa.sql and 007_oauth_tenancy_and_payload_columns.sql mirror the schema changes (007 needs a duplicate check on existing databases; see the file header).

• Schema migrations are real: scripts/migrate.ts applies migrations/NNN_*.sql under an advisory lock, records schema_migrations, and runs as the Fly release_command over DATABASE_URL_DIRECT. Boot no longer runs DDL once that table exists (it logs schema_bootstrap when it still has to, for dev and test databases). New 005_indexes_and_rate_hits.sql brings the SQL files to parity with schema.ts; a Postgres test asserts it. Runbook: docs/ops/migrations.md.

• Hosted process sweeps expired rows at boot and hourly (sweep_expired log line with counts): email OTP challenges, operator sessions, approval challenges, oidc payloads past expires_at, cancelled or expired needs older than 24 h, rate_hits windows older than 2 h.

• Postgres pool has connection (5 s), idle (30 s), and statement (15 s) timeouts, TCP keep-alive, and application_name=botpasses-<plane>. Resend and Sentry calls time out after 10 s. A database that cannot be opened at boot exits 78 with a message instead of an unhandled rejection. SIGTERM drains for 25 s, then cuts open connections (SSE), ends the pool, zeroes the KEK, and exits; a second signal is ignored. Unhandled rejections and uncaught exceptions log one line and exit 1.

• Sentry uses the envelope endpoint with X-Sentry-Auth, release=botpasses@<version>, environment=<plane>, and a redacted message (machine tokens, bearer values, and pg key details stripped). observe.ts exports logRequest (method, path, status, ms, request id from x-request-id or generated) and logAuthEvent (emails hashed). Alerting on kek_raw_fallback and backup failures: docs/ops/alerts.md.

• CI: a smoke job installs Playwright and Chromium and runs npm run test:smoke, the browser walk through the console (the test skips with a reason where they are missing; BOTPASSES_PLAYWRIGHT_PKG and BOTPASSES_CHROMIUM point at other installs). test/store-parity.test.ts runs the same item, grant, client, session, team, need, and delete-org scenarios on SQLite and, under test:pg, on Postgres.

• CI: eslint (typescript-eslint type-checked with no-explicit-any, no-floating-promises, switch-exhaustiveness-check), gitleaks, npm audit for site/, migrations applied twice against Postgres, 80 percent line-coverage gate, and a job that fails on dev/main pushes while the GitHub default branch is not dev (docs/ops/default-branch.md). All actions pinned to commit SHAs; permissions: contents: read everywhere; Dependabot also watches github-actions and docker.

• deploy-staging runs on workflow_run of ci instead of repeating the suite. deploy-prod requires the production environment, verifies staging_sha is a full SHA on dev, and runs audit, lint, migrations, and the suite with Postgres before flyctl deploy.

• backup-prod installs PGDG postgresql-client-16 (matching the Neon major), pins aws4fetch, and ends with a backup-verify job that downloads the object and decrypts it with BACKUP_KEY.

• Dockerfile pins node:22.22-bookworm-slim and ships scripts/; .dockerignore excludes **/node_modules, site/dist, docs, tests, and agent harness directories. .mcp.json and .cursor/mcp.json pin @upstash/context7-mcp and @playwright/mcp.

• .env.example documents every variable with a required-per-plane table, including FLY_APP_NAME, VAULT_BIND_HOST, VAULT_PORT, VAULT_SITE_ROOT, and what DATABASE_URL_DIRECT is for.

• npm scripts: lint, test:coverage, test:pg, site:build, migrate, dev, and a pretest that says “run npm run site:build first” when site/dist is missing. Package version is 0.5.0.

• vault set, list, and the other local commands no longer load pg, the AWS KMS SDK, or the hosted kernel; serve (hosted), kek-wrap, kek-rotate, and mcp --user-jwt import them on demand.

• Store Kind is API token or Client ID and secret. Username and password is gone from Kind. HTTP Basic stays under Change how it is sent. Client ID and Client Secret labels appear for app secrets. Empty hosts prefill api.spotify.com, accounts.spotify.com. Submit stores client_secret so the vault pill says app secret, not token. Each row has Edit (same form, prefilled; blank value keeps the secret). Rotate and Delete stay.

• Grok Bot: Authorization: Bearer avm_… is sufficient. Handshake methods (initialize, ping, tools/list) no longer 401, so a connect card / needsAuth is not forced when the Bearer is already configured. DCR accepts desktop redirect schemes (cursor://, grok://) as well as https and loopback http.

• Prompt grants reactivate after a failed origin HTTP (401/410/5xx). One inbox approve can retry Spotify token mint. The origin status and body are returned (empty 410 is the origin, not a Botpasses consume error).

• Spotify client-credentials helper: Client Secret is not injected as Bearer on accounts.spotify.com. inject=client_credentials or client_id + stored secret mints with HTTP Basic and application/x-www-form-urlencoded, caches the app token, then calls api.spotify.com. Access tokens are [redacted]. GET /v1/search works; GET /v1/me tells the model it needs user OAuth.

• Spotify user connect (Authorization Code + PKCE) stores a refresh token in the vault. Console inbox approve/retry copy, collect/store Client Secret preset, and Grok docs updated. No new 8-digit code after a failed call.

• MCP OAuth discovery is RFC 8414 complete (response_types_supported: ["code"], grants, token auth methods). Path-aware well-known and openid-configuration serve the same documents. WWW-Authenticate uses an absolute PRM URL. Browser MCP hosts (Grok) may call /mcp and /oauth from another origin; operator /api still rejects a foreign Origin. CORS Origin and the PRM host are bound to that request, not a process-global slot.

• Hosted backup fails closed if R2 is unset. Dump encryption lives in backup-envelope (tested). Restore: docs/ops/restore.md. Staging Neon history is 7 days; the root branch is protected.

• Access is issue plus inventory. The Connect nav is gone (#connect still opens Access). Rows show last-4 of the machine bearer (••••abcd), created, first/last access, and fetched names. The full token is shown once at issue or rotate. Audit log on a row opens that client’s activity (actions and names only). http.request and trusted resolve write an inject audit event.

• Sign-in, sign-up, enroll, consent, device, and collect use the same brand fonts and card chrome as /console. Verify is hidden until a code is sent. Inbox needs say Store the credential. Vault empty offers Store credential. Connect copies the MCP URL and one-time token. Rotate no longer shows the item id.

• Staging console lists and stores only staging items. GET /api/items with no environment returns every env this deploy plane serves (staging only on staging; both on production). Explicit environment=production on staging is still 404. Failed Store, Rotate, or delete/revoke show the API error inside the open dialog. A failed Access snapshot shows an error, not an empty panel. Collect and approve-by-code still flash on the page. Issue Grok uses the same environment list as Store. Secret fields stay filled until the request succeeds.

• Console and collect pick how a credential is sent from Kind (API token → Bearer, username and password → HTTP Basic). Inject is behind “Change how it is sent.” Username stays hidden unless Basic is in use.

• /enroll-totp shows a local QR code, an otpauth:// link, and the grouped secret after POST /api/auth/totp/start. The QR is SVG generated on this origin (not a third-party image).

• Hosted mail sends through Resend on the verified public hosts. Staging From is Botpasses <[email protected]>; production is Botpasses <[email protected]>. Fly uses a sending-access key per plane. OTP mail is a short letter plus the code (not two bare paragraphs). A still-valid unused code is not emailed again.

• Public and internal MCP + HTTP API reference: hosted tools (http.request, find, grant), operator /api, OAuth, local vault serve. No get_secret.

0.4.1 (2026-08-31)

Grant-vault hardening: honest trust model, KMS-wrapped KEK, surface locks.

• Hosted is a grant-vault, not zero-knowledge. ADRs 0003-grant-vault and 0004-kms. Threat table: docs/security/threat-model.md.
• AWS KMS unwraps the platform KEK at boot (VAULT_KEK_WRAPPED). Expand/contract: raw VAULT_KEK still boots until VAULT_KEK_REQUIRE_KMS=1. vault kek-wrap / vault kek-rotate on a laptop. Runbook: docs/ops/kek-rotation.md.
• Hosted HTML/JSON: CSP nonce, DENY frames, nosniff, HSTS, no-store. Disallowed CORS Origin is 403 with no ACAO.
• Collect GET is a shell. Need details require an operator GET /api/need-items/:id.
• Store-backed org rate limit. POST /api/clients/:id/rotate invalidates the old avm_ / avt_ hash.
• Local envelopes bind AAD to the secret name (migrate-on-open). vault serve requires HMAC-SHA256(master, "botpasses-loopback") on /api and POST /mcp.
• CI: npm audit --omit=dev --audit-level=high. Dependabot weekly for npm.

0.4.0 (2026-08-31)

Marketing site, first-party operator accounts, same-origin OAuth, and the Access panel. Clerk is removed.

• Hosted / is the Astro marketing site. Console is /console. Design tokens live at /design.
• Operators create an account with email OTP and required TOTP. Sessions are HttpOnly cookies plus signed CSRF.
• This origin is the MCP authorization server (oidc-provider 9.12). PKCE S256 only. Access JWTs aud=${origin}/mcp, 600s. RFC 7009 /oauth/revoke.
• Access panel lists operators, clients, grants, sessions, and the issuance ledger. Revoke a client, grant, or other session from that screen.
• Env: VAULT_SESSION_SECRET, VAULT_OIDC_PRIVATE_JWK. No CLERK_*.
• ADRs 0003, 0004, 0005.

0.3.4 (2026-08-31)

MCP tells the model when to use Botpasses, so the user does not have to paste a procedure.

• Hosted initialize instructions: if the user wants a third-party API called, run http.request in the same turn. Do not list_items first. Example: “get my Spotify profile” → GET https://api.spotify.com/v1/me. Never ask for a secret in chat.
• http.request is the primary tool: host or a full https path URL is enough. It finds the credential, requests a grant when inject is denied, and returns next.for_model plus next.arguments to retry.
• Concurrent prompt consume still hits the origin once. The other call returns a pending grant (not inject_denied), so the model can ask the operator to approve again.
• need_item is not MCP isError (models stop on errors). host_mismatch still is.
• Tool and param descriptions state when to use each tool versus siblings.
• Operator console and README: after the Grok connector is on, ask for the task in plain language.

0.3.3 (2026-08-31)

Public origins are botpasses.com, not botpasses.ai.

• Prod https://botpasses.com, staging https://staging.botpasses.com.
• Documented Clerk FAPI clerk.botpasses.com / clerk.staging.botpasses.com and Resend mail.botpasses.com.
• Hosted boot requires VAULT_PUBLIC_URL to match the deploy plane origin. MCP, CLI, and emails never use a platform default hostname.
• Canonical constants: src/brand.ts. Identity ADR: 0002.

0.3.2 (2026-08-30)

Agents can find named credentials and operators can enter a missing key on Botpasses. The model does not get the key.

• MCP find_items matches an exact item_name and/or exact API hostname. Results are found, ambiguous (up to 5, with allowed_hosts), host_mismatch, or need_item.
• A miss returns a path-only collect_url (/collect/{needId}, no query HMAC). Sign in on Botpasses and POST fulfill as the operator. Model and trusted tokens cannot fulfill.
• Fulfill stores the item and an active prompt grant for the requesting client, then http.request injects in-process. Local MCP miss tells the operator to vault store and does not mint a collect URL.
• Inbox lists pending needs next to grants. Console store form uses an inject select and host example api.spotify.com.

0.3.1 (2026-08-30)

Hosted console and Grok Bot can run without Clerk.

• Operator HTML at / is public; APIs still require auth. Paste VAULT_BOOTSTRAP_TOKEN (32+ chars) to operate.
• POST /api/clients/model issues a one-time avm_… bearer for remote MCP (Grok Bot header auth). avt_… trusted tokens still cannot call MCP. Model tokens still cannot /runtime/resolve.
• Process env: VAULT_BOOTSTRAP_TOKEN.
• GitHub repository is naffis/botpasses (old naffis/agent-vault URL redirects).

0.3.0 (2026-08-30)

Product identity is Botpasses. Hosted origins are https://botpasses.ai and https://staging.botpasses.ai.

• Display name, MCP serverInfo.name, /health product, and npm package name are botpasses / Botpasses.
• CLI bins: botpasses and vault (same entry). Default local home is $HOME/.botpasses.
• Fly apps: botpasses-staging, botpasses-prod. Nightly backup object prefix is botpasses-.
• Hosted email From comes from VAULT_EMAIL_FROM (required at boot when RESEND_API_KEY is set).
• Process env prefix stays VAULT_*. AgentPass paths are unchanged.

0.2.0 (2026-08-30)

Hosted multi-user grant vault (Fly + Neon + Cloudflare) alongside the local sqlite CLI.

• Store secret and login items per org environment (staging | production).
• Grant policies: prompt, session, item_standing, folder_standing (standing rows short-circuit request_grant).
• Operator approve via web inbox, Resend magic link, or hashed 8-digit code. MCP has no revoke_grant; operator POST /api/grants/:id/revoke remains.
• Model MCP tools: list_items, request_grant, list_grants, http.request. Connector attaches the granted credential to the item allowlist, DNS-pins the origin, and redacts values from the result.
• Trusted clients call POST /runtime/resolve. Model tokens cannot.
• Local vault serve listens on 8788. /health no longer includes a key fingerprint.
• Hosted process (VAULT_MODE=hosted) uses Neon Postgres, refuses VAULT_HOME (exit 78), one Fly Machine per app.
• Hosted MCP stdio: vault login then vault mcp --user-jwt with VAULT_PUBLIC_URL and a Clerk session JWT (never CLERK_SECRET_KEY).
• AgentPass Authority HTTP is dark unless VAULT_AGENTPASS=1.