-
SummerCMS v0.5.0
jakub released this
2026-10-24 04:31:40 +00:00 | 345 commits to master since this releaseThe MCP module is complete: with the account link, OAuth consent and plugin
tools (sm-user-plugin v0.1.11, sm-oauthserver-plugin v0.1.3,
sm-journal-plugin v0.2.4), one /mcp endpoint serves an administrator's
backend tools and the frontend user's tools to an MCP client. pier stays
opt-in (summercms_mcp build tag and mcp.enabled).Added
- bouncer: auth_time is stamped at sign-in and carried unchanged through
every refresh, for proofs that need a fresh sign-in. - pact: HasFrontendTokenScopes lets plugins declare member token scopes;
ValidTokenScopeName is the shared scope-name rule (a padded name fails
boot). - pact: MCPPrompt.Writes puts a write-directing prompt under the read/write
grant ceiling.
Changed
- pier: a backend grant acts only as the administrator its consent named.
- pier: a token or client revocation ends only that token's or client's
sessions; resolvers see the client address, also on stream re-checks. - pier: a personal token whose scopes no longer resolve gets its own error
instead of "account unknown". - pier: the Redis session store needs a standalone Redis (no Cluster).
Fixed
- pier: session slots are reserved atomically; expired stateful sessions
are reaped; an ended session is never written back by a request in
flight; no session lock is waited on under the router lock. - pier: returning identities with wider grants see the new tools; a guard
error while re-filtering no longer narrows a session; a shared stateless
server no longer flaps its tool set; LRU eviction spares servers with a
live listen stream. - pier: path values the mux never delivers are refused; tools/call without
arguments is an empty object; prompt Render errors stay out of the
client's answer. - cabana: backend subject events fire after the transaction commits; the
backend middleware refuses a dispatch marker carrying a frontend
principal. - cabana and admin: My account action URLs refuse javascript:, data:,
protocol-relative and control-character URLs; a failing section or
Applies is marked without breaking the others; prompted record actions
answer a localized error for a bad payload. - admin: save shortcuts commit a draft inside a field type's shadow root;
plain keys are ignored inside shadow roots and custom field elements.
Downloads
- bouncer: auth_time is stamped at sign-in and carried unchanged through