release: v3.0.0 lockstep major + Cloud Connect#29

Merged

1lystore merged 25 commits into

mainfrom

feat/cloud-connect

Jun 15, 2026

Commits on Jun 13, 2026

feat(cloud-connect): P1 vault protocol — key-pinned connect-link, match-code, bind, revoke
1lystore
committed
harden(cloud-connect): fix P1 defects from adversarial security review
1lystore
committed
feat(relay/p2): OAuth 2.1 primitives for Cloud-Connect (keys, PKCE, DPoP, tokens, metadata)
1lystore
committed
feat(relay/p2): OAuth AS state — DCR clients, auth sessions, rotating refresh w/ reuse-detection
1lystore
committed
feat(relay/p2): wire static OAuth discovery + client endpoints into RelayServer
1lystore
committed
feat(relay/p2d): connect-link OAuth grant — /oauth/connect + /oauth/token
1lystore
committed
feat(p2d-2): wire Cloud-Connect OAuth grant to the vault over the WS control bridge
1lystore
committed
feat(p2e): per-vault MCP facade auth gate + cross-cutting security tests
1lystore
committed
feat(p2e-2): MCP data-plane forwarding (relay half) over the WS control channel
1lystore
committed
feat(p2e-2): vault-side MCP handler — Cloud-Connect data plane complete
1lystore
committed
feat(p4a): vault->relay revoke push — instant-revoke fast-fail (#7 complete)
1lystore
committed
test(p4c): extend security regression with 5 Cloud-Connect checks (13-17)
1lystore
committed
feat(p4b): dcp cloud-connect CLI — drive Cloud-Connect from the terminal (OSS standalone)
1lystore
committed
feat: browser /oauth/authorize adapter for vanilla MCP clients (Claude.ai/ChatGPT)
1lystore
committed
test: add local demo cloud-agent script for end-to-end manual testing
1lystore
committed
test: one-command local live E2E (scripts/demo-local.sh)
1lystore
committed
feat(relay): wire DCP_RELAY_PUBLIC_URL env -> RelayConfig.publicUrl
1lystore
committed
fix(relay): don't autostart the server when imported/bundled (esbuild guard)
1lystore
committed
feat(cloud-connect): universal paste-URL connect for any OAuth MCP client
1lystore
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

release: v3.0.0 lockstep major + Cloud Connect#29

release: v3.0.0 lockstep major + Cloud Connect#29
1lystore merged 25 commits into
mainfrom
feat/cloud-connect

Commits on Jun 13, 2026

feat(cloud-connect): P1 vault protocol — key-pinned connect-link, match-code, bind, revoke

harden(cloud-connect): fix P1 defects from adversarial security review

feat(relay/p2): OAuth 2.1 primitives for Cloud-Connect (keys, PKCE, DPoP, tokens, metadata)

feat(relay/p2): OAuth AS state — DCR clients, auth sessions, rotating refresh w/ reuse-detection

feat(relay/p2): wire static OAuth discovery + client endpoints into RelayServer

feat(relay/p2d): connect-link OAuth grant — /oauth/connect + /oauth/token

feat(p2d-2): wire Cloud-Connect OAuth grant to the vault over the WS control bridge

feat(p2e): per-vault MCP facade auth gate + cross-cutting security tests

feat(p2e-2): MCP data-plane forwarding (relay half) over the WS control channel

feat(p2e-2): vault-side MCP handler — Cloud-Connect data plane complete

feat(p4a): vault->relay revoke push — instant-revoke fast-fail (#7 complete)

test(p4c): extend security regression with 5 Cloud-Connect checks (13-17)

feat(p4b): dcp cloud-connect CLI — drive Cloud-Connect from the terminal (OSS standalone)

feat: browser /oauth/authorize adapter for vanilla MCP clients (Claude.ai/ChatGPT)

test: add local demo cloud-agent script for end-to-end manual testing

test: one-command local live E2E (scripts/demo-local.sh)

feat(relay): wire DCP_RELAY_PUBLIC_URL env -> RelayConfig.publicUrl

fix(relay): don't autostart the server when imported/bundled (esbuild guard)

feat(cloud-connect): universal paste-URL connect for any OAuth MCP client

Commits on Jun 14, 2026

fix(security): close 8 pre-launch vulns in vault + relay (no client breakage)

fix(security): address review round 2 — key-corruption bug + relay control binding

fix(security): review round 3 — WS response vault check + vault-scoped revoke

fix(security): self-audit round 4 — close WS unregister + push-token + pair-spam

Commits on Jun 15, 2026

release: v3.0.0 — lockstep major across @dcprotocol/*

fix(security): address CodeQL high-severity findings