Skip to content

WORKLOG.md

Latest commit

 

History

History
86 lines (67 loc) · 9.84 KB

WORKLOG.md

File metadata and controls

86 lines (67 loc) · 9.84 KB
Raw

Worklog

Current guidance

The manual live test scripts remain intentional tools. Read the README's testing guidance and each script's prerequisites before running one against a budget; this cleanup used no credentials or live financial data. Historical setup and release notes remain dated evidence, while the linked guides describe current behavior.

October 13, 2026: documentation cleanup

Preserved the complete previous worklog in the dated archive below, including the icon work, releases, prior audits and open questions. The current file now points to maintained guidance. Source, tests, dependencies and workflows are unchanged. No npm publication, Worker deployment or YNAB operation ran for this cleanup.

Later, PR #39 corrected the README's old-hostname guidance to match the completed October 11 cutover. Clients still using the old hostname should add the current URL and reconnect; already migrated clients need no change. Documentation checks and all nine GitHub jobs passed before merging at 5ae8b40. Those checks are dated merge evidence, not reruns for this worklog update. No financial operation or deployment ran.

October 17, 2026: agents 0.28.1 and SDK override removal

Resolved #30 in 3f29218. The Worker now uses agents ~0.28.1, which peers @modelcontextprotocol/sdk 1.32.1, so the temporary override is gone. A test that read the old partyserver package now checks agents' own getAgentByName path instead.

Verification: root unit tests 240/240, safety and eval checks passed, Worker tests 60/60, npm audit reported 0 vulnerabilities in both packages, and all nine CI jobs passed (run 39060667124). Worker version ade63bcc-cf12-4996-8b30-04185176fee7 is deployed at 100% and replaced d3da76f6-9578-448c-b2d1-450fc78f586d. Unauthenticated checks of /, /mcp and the OAuth metadata passed. No signed-in tool call ran against the new version; that remains #24. If a reconnected client misbehaves, redeploy d3da76f6, which has no migration dependency.

October 23, 2026: ip-address override and Worker redeploy

9103ef4 raised the ip-address override to 10.7.4 in both packages, clearing the quadratic-time Address6 zone parsing advisory and the express-rate-limit advisory that depended on it. Worker tests and the bundle dry run passed, npm audit reported 0 vulnerabilities in both packages, and CI passed. The root npm test is the live script, so it read the real budget: every read passed, and every write was refused by the consent gate with "No write was attempted." Worker version b2aa17ce-1b56-4ccf-be83-b7f15071fa03 is deployed at 100% from 9103ef4 and replaced ade63bcc-cf12-4996-8b30-04185176fee7. Unauthenticated checks of /, /mcp, Origin handling, /authorize and the OAuth metadata matched the pre-deploy baseline, and a tail showed every request ok with no exceptions. Signed-in verification still belongs to #24. If a reconnected client misbehaves, roll back to ade63bcc.

October 23, 2026: security review

Reviewed the hosted OAuth and consent flow, encrypted credential storage, the preview-token write gate, token redaction and the workflows. No code defect was found. 4a7ef80 raised zod to 4.6.7 in both lockfiles for GHSA-mrhx-c7xc-m3w5 (high). GitHub updated that advisory at 18:26 UTC, after the morning's passing audit, so the next CI audit step would have failed. Root unit tests 240/240, safety and eval checks, release check, discovery smoke, Worker tests 60/60 and the bundle dry run passed; npm audit --omit=dev reports 0 vulnerabilities in both packages. Later, f8cc573 raised body-parser from 2.3.0 to 2.4.0 (the root override and the Worker lock) for GHSA-27r3-jxmh-p828 (high), published at 20:53 UTC; it also moved content-type, iconv-lite and qs by a patch or minor each, and the same checks passed. The root live npm test did not run. The Worker is not redeployed, so the deployed bundle keeps the older zod until the next deploy.

The callback state is deliberately cookie-free (Mistral's embedded browser dropped cookies in July), so a YNAB sign-in link from someone else's flow still reaches the final confirmation page in the victim's browser. That page names the client, redirect and access level and needs a same-origin click; binding the flow to a browser cookie would close the gap at the cost of that client.

Historical record

The complete worklog through October 13, 2026 is an exact copy of the previous file. It stays at the repository root to preserve each relative link's original context. The preservation record records the source revision, byte count and SHA-256 digest.

Previous entry links