All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.
-
Improve release workflow with PR-based version bump (#8) (
12b77d4)* feat: add GitHub Actions CI workflow (#4)- feat: add GitHub Actions CI workflow
- Test & lint on push/PR to main
- Multi-OS matrix (ubuntu/macos)
- Type check, biome, bun test coverage
- Separate build job after tests pass
-
fix: update CI triggers to include develop branch
-
feat: implement security hardening with command validation and input filtering (#3)
-
feat(security): add command validation for dangerous patterns and privilege escalation
명령어 검증 기능을 추가하여 위험한 패턴과 권한 상승 명령어 실행을 방지합니다. MCP_PTY_USER_CONSENT_FOR_DANGEROUS_ACTIONS 환경 변수를 통해 사용자 동의를 요구합니다.
- feat(security): add command validation for dangerous patterns and privilege escalation
명령어 검증 기능을 추가하여 위험한 패턴과 권한 상승 명령어 실행을 방지합니다. MCP_PTY_USER_CONSENT_FOR_DANGEROUS_ACTIONS 환경 변수를 통해 사용자 동의를 요구합니다.
- feat: enhance security with command validation and input filtering
- Add dangerous pattern detection in normalize-commands (rm -rf /, fork bombs, etc.)
- Expand privilege escalation detection (15+ commands including doas, su, run0, etc.)
- Implement input validation for PTY write operations (block dangerous ANSI sequences)
- Add MIT LICENSE file
- Update biome config to allow control characters in security regex patterns
- Fix linting issues and ensure all checks pass
Security improvements prevent:
- Command injection attacks via shell wrapping
- Privilege escalation bypasses
- Terminal manipulation via malicious ANSI sequences
- Unauthorized system modifications
- refactor: improve security validation with AST-based analysis
- Replace regex-based validation with bash-parser AST analysis
- Add comprehensive security test suites (59 new tests)
- Fix ANSI escape sequence validation to allow safe color codes
- Extract PRIVILEGE_ESCALATION_COMMANDS to shared constants
- Remove false positives (chmod 644/755 now allowed, rm -rf /tmp allowed)
- Add dangerous command detection: mkfs, dd to block devices, redirect to /dev/sd*
- LICENSE: add trailing newline
- fix: apply biome lint suggestions
- Use optional chain for target?.text
- Remove unused biome-ignore comments
- feat: make pwd mandatory in start tool (#1)
pwd 파라미터를 필수로 하여 작업 디렉토리 문제를 해결. 명령어가 올바른 디렉토리에서 실행되도록 보장.
-
feat: add automated NPM release workflow (#5)
-
feat: add automated NPM release workflow on main merge
-
docs: enforce English for all documentation and technical writing
-
fix: use fast-forward merge for linear history in release workflow
-
build: enable bundling for workspace dependencies
-
build: remove TypeScript sources from NPM package (CLI-only)
-
docs: add library type definitions to future plans
-
fix: make PtyOptions.cwd optional with process.cwd() fallback
-
fix: add cwd to all PtyOptions objects in tests and utils
-
ci: remove macOS matrix to reduce CI time (Linux sufficient)
-
fix: use global .npmrc to avoid workspace config conflict
-
feat: use PR for version bump to comply with branch protection
-
feat: add dry-run mode for release workflow testing
-
Use PR for version bump to comply with branch protection (
9978533) -
Add dry-run mode for release workflow testing (
4b610f2) -
Enforce absolute path validation for working directory (
01f4b6b)절대 경로 검증을 통해 PTY 프로세스의 작업 디렉토리 모호성을 제거하고 보안성을 강화합니다.- Path normalization utility: 절대 경로 및 틸드(~) 경로만 허용, 상대 경로 거부
- Tilde expansion: ~ 및 ~/를 홈 디렉토리로 확장 (~username은 미지원)
- Directory validation: 존재 여부 및 디렉토리 타입 검증 추가
- Schema update: pwd 파라미터 설명에 절대 경로 요구사항 명시
- Tests: 17개 단위 테스트 및 통합 테스트 추가 (총 45개 테스트 통과)
상대 경로는 PTY 컨텍스트에서 예측 불가능한 동작을 유발할 수 있어 명시적으로 거부합니다.
-
Add project website package for GitHub Pages (
028fb7c)Create static landing page using Bun + React. Includes development server with hot-reloading, production build script with Bun.build API, and basic landing page with features/quickstart sections. -
Enhance website documentation and change default port (#14) (
40e0d13)* refactor(website): migrate to Bun 1.3.0 native build chain커스텀 build.ts/dev-server.ts 제거하고 Bun 네이티브 --hot 서버 및 HTML 번들링 활용. React 19 업그레이드 및 Bun.serve() 라우트 패턴 적용 (HMR/브라우저 로그 스트리밍 지원). AGENTS.md에 Bun 1.3.0+ 기능 가이드 추가.
- feat(mcp-pty): change default HTTP port to 6420 and enhance website docs
기본 HTTP 포트를 3000에서 6420으로 변경하여 React 등 일반적인 개발 서버와의 충돌 방지. 웹사이트에 Bun 런타임 필수 요구사항 경고, @zenyr/bun-pty 기술 스택 설명, HTTP 모드 사용 가이드 추가하여 사용자 온보딩 개선.
-
docs: add opencode credit to README
-
feat: add opencode credit to website and README
-
ci: remove --frozen-lockfile to allow lockfile updates in PRs
-
chore: sync lockfile with workspace package updates
- Update mcp-pty version to 0.0.3
- Standardize website package name to @pkgs/website alias
- Sync workspace dependency mapping
-
docs: translate README to English and update default port to 6420
-
chore: trigger CI
-
fix: correct YAML indentation in CI workflow
-
Implement two-stage release workflow with manual version control (
e8ea970)- Refactor release.yml: Manual version selection (patch/minor/major) via workflow_dispatch- Add changelog.yml: Separate workflow for CHANGELOG generation and GitHub Release
- Add cliff.toml: Conventional commits configuration for automated changelog
- Remove automatic push trigger; require manual workflow dispatch for safety
- Decouple NPM publish from CHANGELOG/Release creation for independent operation
Enables safer, more predictable releases while maintaining automation for changelog generation.
-
Optimize CI workflow with parallel tests and Bun caching (#34) (
115c0da)* feat: optimize CI workflow with parallel tests and Bun caching- Add GitHub Actions cache for Bun modules (key: bun.lock)
- Enable parallel test execution with --concurrent --max-concurrency=6
- Parallelize lint commands (check & format run concurrently)
- Pin Bun version to latest, add --no-save for CI stability
- Expected 40-45% CI time reduction (60-90s → 40-50s)
- refactor: implement test isolation via callback pattern for concurrent execution
- Add withTestSessionManager/withTestPtyManager higher-order functions
- Eliminate test-scoped let/const variables (DRY principle)
- Implement callback-scoped cleanup with finally blocks
- Re-enable --concurrent --max-concurrency=6 in CI
- Verified: 180 tests pass with zero race conditions
- ~50-60% CI time reduction (60-90s → 30-40s)
- fix: resolve test isolation race conditions in concurrent execution
- Implement SessionTracker proxy to track only per-test created sessions
- Refactor pty-process.test.ts to use withTestPtyProcess helper
- Refactor mcp-server.test.ts to use withTestSessionManager helper
- Verified: 195 tests pass with --concurrent --max-concurrency=6 (0 failures)
- CI time reduced to ~26s (~70% faster than sequential execution)
- docs: update AgentLog 015 with final test isolation results (70% CI speedup)
-
Add examples and demos for MCP client configs and use cases (#38) (
5b46020)* feat: add examples and demos for MCP client configs and use cases-
Add claude_desktop_config.json for stdio MCP client setup
-
Add http-server.ts for HTTP server deployment
-
Add use-cases.md with examples for dev server, interactive tools, build processes
-
Add AgentLog documenting implementation
-
-
Add 64KB output buffer size limit for LLM context safety (#44) (
7c7433f)* feat: add 64KB output buffer size limit for LLM context safety- Prevent unbounded memory growth from long-running processes
- Maintains FIFO behavior: oldest output discarded when limit exceeded
- 64KB optimized for LLM context windows (Claude ~8-200K tokens)
- outputBuffer still used by toPromise(), getOutputBuffer(), and MCP resources
- xterm/headless manages terminal rendering separately
-
docs: add agentlog for outputbuffer size limit implementation
-
style: apply biome format to http-server example
-
Resolve NPM publish authentication issue (#7) (
61fd9f0)* feat: add GitHub Actions CI workflow (#4)- feat: add GitHub Actions CI workflow
- Test & lint on push/PR to main
- Multi-OS matrix (ubuntu/macos)
- Type check, biome, bun test coverage
- Separate build job after tests pass
-
fix: update CI triggers to include develop branch
-
feat: implement security hardening with command validation and input filtering (#3)
-
feat(security): add command validation for dangerous patterns and privilege escalation
명령어 검증 기능을 추가하여 위험한 패턴과 권한 상승 명령어 실행을 방지합니다. MCP_PTY_USER_CONSENT_FOR_DANGEROUS_ACTIONS 환경 변수를 통해 사용자 동의를 요구합니다.
- feat(security): add command validation for dangerous patterns and privilege escalation
명령어 검증 기능을 추가하여 위험한 패턴과 권한 상승 명령어 실행을 방지합니다. MCP_PTY_USER_CONSENT_FOR_DANGEROUS_ACTIONS 환경 변수를 통해 사용자 동의를 요구합니다.
- feat: enhance security with command validation and input filtering
- Add dangerous pattern detection in normalize-commands (rm -rf /, fork bombs, etc.)
- Expand privilege escalation detection (15+ commands including doas, su, run0, etc.)
- Implement input validation for PTY write operations (block dangerous ANSI sequences)
- Add MIT LICENSE file
- Update biome config to allow control characters in security regex patterns
- Fix linting issues and ensure all checks pass
Security improvements prevent:
- Command injection attacks via shell wrapping
- Privilege escalation bypasses
- Terminal manipulation via malicious ANSI sequences
- Unauthorized system modifications
- refactor: improve security validation with AST-based analysis
- Replace regex-based validation with bash-parser AST analysis
- Add comprehensive security test suites (59 new tests)
- Fix ANSI escape sequence validation to allow safe color codes
- Extract PRIVILEGE_ESCALATION_COMMANDS to shared constants
- Remove false positives (chmod 644/755 now allowed, rm -rf /tmp allowed)
- Add dangerous command detection: mkfs, dd to block devices, redirect to /dev/sd*
- LICENSE: add trailing newline
- fix: apply biome lint suggestions
- Use optional chain for target?.text
- Remove unused biome-ignore comments
- feat: make pwd mandatory in start tool (#1)
pwd 파라미터를 필수로 하여 작업 디렉토리 문제를 해결. 명령어가 올바른 디렉토리에서 실행되도록 보장.
-
feat: add automated NPM release workflow (#5)
-
feat: add automated NPM release workflow on main merge
-
docs: enforce English for all documentation and technical writing
-
fix: use fast-forward merge for linear history in release workflow
-
build: enable bundling for workspace dependencies
-
build: remove TypeScript sources from NPM package (CLI-only)
-
docs: add library type definitions to future plans
-
fix: make PtyOptions.cwd optional with process.cwd() fallback
-
fix: add cwd to all PtyOptions objects in tests and utils
-
ci: remove macOS matrix to reduce CI time (Linux sufficient)
-
fix: use global .npmrc to avoid workspace config conflict
-
Implement proper dry-run mode for release workflow (#10) (
da64bf4)* feat: add GitHub Actions CI workflow (#4)- feat: add GitHub Actions CI workflow
- Test & lint on push/PR to main
- Multi-OS matrix (ubuntu/macos)
- Type check, biome, bun test coverage
- Separate build job after tests pass
-
fix: update CI triggers to include develop branch
-
feat: implement security hardening with command validation and input filtering (#3)
-
feat(security): add command validation for dangerous patterns and privilege escalation
명령어 검증 기능을 추가하여 위험한 패턴과 권한 상승 명령어 실행을 방지합니다. MCP_PTY_USER_CONSENT_FOR_DANGEROUS_ACTIONS 환경 변수를 통해 사용자 동의를 요구합니다.
- feat(security): add command validation for dangerous patterns and privilege escalation
명령어 검증 기능을 추가하여 위험한 패턴과 권한 상승 명령어 실행을 방지합니다. MCP_PTY_USER_CONSENT_FOR_DANGEROUS_ACTIONS 환경 변수를 통해 사용자 동의를 요구합니다.
- feat: enhance security with command validation and input filtering
- Add dangerous pattern detection in normalize-commands (rm -rf /, fork bombs, etc.)
- Expand privilege escalation detection (15+ commands including doas, su, run0, etc.)
- Implement input validation for PTY write operations (block dangerous ANSI sequences)
- Add MIT LICENSE file
- Update biome config to allow control characters in security regex patterns
- Fix linting issues and ensure all checks pass
Security improvements prevent:
- Command injection attacks via shell wrapping
- Privilege escalation bypasses
- Terminal manipulation via malicious ANSI sequences
- Unauthorized system modifications
- refactor: improve security validation with AST-based analysis
- Replace regex-based validation with bash-parser AST analysis
- Add comprehensive security test suites (59 new tests)
- Fix ANSI escape sequence validation to allow safe color codes
- Extract PRIVILEGE_ESCALATION_COMMANDS to shared constants
- Remove false positives (chmod 644/755 now allowed, rm -rf /tmp allowed)
- Add dangerous command detection: mkfs, dd to block devices, redirect to /dev/sd*
- LICENSE: add trailing newline
- fix: apply biome lint suggestions
- Use optional chain for target?.text
- Remove unused biome-ignore comments
- feat: make pwd mandatory in start tool (#1)
pwd 파라미터를 필수로 하여 작업 디렉토리 문제를 해결. 명령어가 올바른 디렉토리에서 실행되도록 보장.
-
feat: add automated NPM release workflow (#5)
-
feat: add automated NPM release workflow on main merge
-
docs: enforce English for all documentation and technical writing
-
fix: use fast-forward merge for linear history in release workflow
-
build: enable bundling for workspace dependencies
-
build: remove TypeScript sources from NPM package (CLI-only)
-
docs: add library type definitions to future plans
-
fix: make PtyOptions.cwd optional with process.cwd() fallback
-
fix: add cwd to all PtyOptions objects in tests and utils
-
ci: remove macOS matrix to reduce CI time (Linux sufficient)
-
fix: use global .npmrc to avoid workspace config conflict
-
feat: use PR for version bump to comply with branch protection
-
feat: add dry-run mode for release workflow testing
-
fix: remove non-existent label from PR creation
-
fix: properly implement dry-run mode with event type checks
-
Remove non-existent label from PR creation (
47c3209) -
Properly implement dry-run mode with event type checks (
16aedcb) -
Resolve merge conflict with proper dry-run implementation (
f27ec8c) -
Handle empty input gracefully with warning (#15) (#16) (
746b6b8)- Add empty input validation in PtyProcess.write() method- Return warning message instead of throwing ArrayBufferView error
- Update MCP tool schemas to support optional warning field
- Add comprehensive test coverage for edge cases
- Add CHANGELOG.md for tracking notable changes
-
Remove unused variable and correct test assertion (
86eeabf)PtyProcess 코드 품질을 개선하여 불필요한 변수와 잘못된 테스트 어서션을 수정합니다.- process.ts: toPromise()에서 사용하지 않는 구독 변수 제거
- pty-process.test.ts: write throws 테스트에서 불필요한 await 제거
-
Add paths condition to release workflow to prevent unnecessary NPM publish (
ab240f5)- Add paths: ['packages/mcp-pty/**'] to on.push in .github/workflows/release.yml- Only trigger workflow when packages/mcp-pty has changes
- Resolves issue #29
-
Expand release workflow trigger to all packages except website (
efdc813)- Change paths from 'packages/mcp-pty/' to 'packages/!(website)/'- Ensures internal dependency changes (logger, pty-manager, session-manager) trigger publish
- Prevents version skips when dependencies are updated
- Fixes issue #29 with broader scope for monorepo packages
-
Trigger GitHub Pages deploy only on website package changes (
7d67de5)Optimize CI/CD by adding path filter to deploy-pages workflow. Deploy now only triggers when packages/website or workflow config changes, avoiding unnecessary executions on other repo changes. -
Resolve PR #33 review comments on release workflow (
f186483)- Inline CHANGELOG generation to eliminate race condition (critical fix)- Add NPM publish rollback on failure to prevent zombie version bumps
- Change merge strategy from --ff-only to --no-ff for reliability
- Fix cliff.toml regex pattern: 'doc' → 'docs?' to match both singular/plural
- Remove separate changelog.yml workflow (consolidated into release.yml)
- Update AgentLog with rationale for design decisions
-
Optimize CI workflow paths for src changes (#36) (
7899f1c)* fix: optimize CI workflow to run only on src changes- Add paths filter to ci.yml to trigger CI only when packages/!(website)/src/** or related config files change
- Prevents unnecessary CI runs for docs changes
- Improves build efficiency
- docs: add agent info to AgentLog
-
Correct YAML indentation in release workflow (
126a4b1)- Fix inconsistent indentation causing parsing errors- Ensure workflow_dispatch trigger works properly
-
Correct YAML indentation in release workflow (
3a76c86)- Fix indentation for Configure Git step to match other steps -
Correct YAML indentation for all steps in release workflow (
b504bcc)- Ensure consistent 7-space indentation for all step items -
Remove blank line between permissions and steps in YAML (
e42cca3)- Fix YAML parsing error by removing unnecessary blank line -
Quote job name to avoid YAML parsing issues with & (
20239ed)- Wrap job name in quotes to prevent YAML anchor conflicts -
Standardize YAML indentation to 2 spaces (
9916203)- Change from inconsistent indentation to standard GitHub Actions format- Use 2-space indentation throughout the workflow
-
Quote workflow name to avoid YAML parsing issues (
810ffa8)- Wrap workflow name in quotes to prevent & character conflicts -
Ensure release workflow runs on main branch (
8cd5500)- Add ref: 'main' to checkout step- Add push to main after commits
- Maintain sync to develop branch
-
Resolve release workflow issues (
d86d78f)- Remove prepublishOnly hook to prevent duplicate test runs- Generate CHANGELOG before commit to avoid tag mismatch
- Fix workflow to run from develop branch and merge to main
- Add proper rollback handling with tag cleanup
- Consolidate version bump and CHANGELOG into single commit
-
Make now variable optional in cliff.toml template (
8ba8c4c)Handle case where --unreleased flag is used without a version/date context. Wraps now variable in conditional to prevent template render error. -
Bypass branch protection for release workflow push (
944731a)- Add pull-requests write permission- Use git push -f to force push commits to protected develop branch
- Allows workflow_dispatch to update develop without PR requirement
-
Reorder workflow steps to push tag first, merge to main, then sync back to develop (
04f0de3)- Push tag to origin- Merge develop to main and push main
- Sync main back to develop with force push
- Avoids direct develop branch protection violations
- Upgrade dependencies and remove duplicate pty package (
5f4c352)Update @biomejs/biome to 2.2.6 and @zenyr/bun-pty-darwin-arm64 to 0.4.3. Remove duplicate optionalDependencies entry for @zenyr/bun-pty-darwin-arm64 (already in @zenyr/bun-pty). Add React/ReactDOM for website package.
-
Restructure CI workflow for efficient validation (#39) (
6b56e46)* refactor: decompose CI workflow into reusable test and build jobs- ci.yml: lightweight orchestrator that calls test.yml and build.yml
- test.yml: extracted as reusable workflow_call for test & lint tasks
- build.yml: extracted as reusable workflow_call for build tasks
- simplifies maintenance and allows future flexible trigger configurations
- refactor: restructure CI workflow for efficient validation
- ci.yml: always runs, uses paths-filter to detect code changes
- test.yml: parallel lint/test/build jobs (only runs on code changes)
- docs-only PRs skip heavy CI, pass immediately with success job
- eliminates computing waste while ensuring all PRs get status check
-
Consolidate plan.md with concise formatting (
ccdfdf3)Streamline plan.md by reducing verbosity while maintaining clarity. Simplify task descriptions, status indicators, and roadmap sections for improved readability. -
Translate README.md to English (#17) (
c267f27) -
Update howto and summary guides (
0eae86d)AgentLog 작성 가이드와 요약 문서를 개선하여 가독성과 일관성을 높입니다.- howto.md: 구조 개선, 영어 우선 원칙 추가, 간결성 강조
- summary.md: 영어 번역, 012 로그까지 업데이트
- 012-readme-update-completed.md: README 업데이트 로그 추가
-
Enhance README with features section and API details (
4a5657d)README를 최신 기능과 상세한 API 문서로 개선하여 사용자 온보딩을 강화합니다.- Features 섹션 추가: 주요 기능 9가지 요약
- API 문서 개선: 리소스와 툴 설명 상세화, 파라미터 명시
- 오류 코드 및 구성 옵션 유지
-
Add PR guidelines section (
94f22e2)AGENTS.md에 PR 가이드라인 섹션을 추가하여 PR 생성 프로세스를 표준화합니다.- AgentLogs 작성 요구사항 추가
- 커밋 세분화 및 PR 설명 가이드 추가
-
Add mandatory @git subagent guidelines for commit operations (
896254d)- Require all git commits/pushes to use Task(@git) subagent- Add clear delegation rules and example prompts
- Prevent direct bash git commands in main agent
- Improves consistency and audit trail
-
Clarify git agent delegation in AGENTS.md (
7a18640)Add explicit guidance to use @git agent for all git commit operations via Task tool. Improves consistency and prevents developers from making manual commits. -
Compress AGENTS.md for conciseness without information loss (
61893ec)Improve developer experience by reducing document scanning time while maintaining all critical constraints, requirements, and rationales:- Language Policy: Condensed multi-line into single line
- TypeScript Expert: Compressed categories, preserved all technical details
- Workspace: Merged into single line with all constraints (no any/!, type guards, path aliases, SDK)
- Bun Developer: Split into 3 focused subsections, maintained all tech stack requirements
- Prohibitions: Compressed while retaining all rules
- Git & Commits: Already documented in prior commit
-
Comprehensive developer documentation for Issue #19 (#35) (
39fb84d)- Add architecture deep-dive with system overview and package details- Add package interaction diagrams with Mermaid visualizations
- Add contribution guidelines with development workflow and standards
- Add development setup guide with environment configuration
- Add normalize-commands integration documentation
- Create AgentLog documenting implementation process
-
Fix inaccuracies and remove unnecessary details from developer documentation (#37) (
bd52743)- Fix monitoring interval documentation (1-minute, not configurable)- Remove incorrect 'bun link' setup instructions
- Fix TypeScript import preference to 'non-relative' (aligns with @pkgs/*)
- Simplify normalize-commands doc (remove benchmarks, future specs, troubleshooting)
- Reduce documentation from 1,930 to 1,782 lines for clarity
Related to PR #35 review findings. Removes 166 lines of non-essential detail while preserving actionable integration guidance.
-
Add agent identity and communication guidelines to PR section (#40) (
773d391) -
Add agent identity and communication guidelines to PR section (
58aba97) -
Add agentlog for branch protection setup (
cc8e3b9)- Enabled PR requirement and CI checks for develop branch- Prevents direct pushes to enforce code review process
-
Clean up agentlogs numbering to remove duplicates (
de07f33)- Resolved duplicate numbers 014 and 017 by shifting subsequent files- Maintained chronological order and file integrity
- No content changes, only filename renumbering
-
Fix agentlogs numbering duplicates (#47) (
a6bb45e)- Renamed duplicate 014 and 017 files to sequential numbers- All agentlogs now have unique numbering from 001 to 022
-
Add agentlogs for branch protection and release process (
7f4455e)- Add 023-fix-branch-protection-require-checks.md- Add 024-release-process-initiated.md
-
Bump version to 0.0.2 (
4373f25) -
Bump version to 0.0.3 (
2655993) -
Sync version from main (v0.0.2) (
b33a184) -
Sync with main (
05964d1) -
Update biome config to 2.2.6 and fix lint warnings (
ef6528d)Migrate biome schema from 2.2.5 to 2.2.6. Add radix parameter to parseInt call in dev-server.ts to fix lint warning. -
Add GitHub Pages deployment workflow (
9a9c429)Automate static site deployment on push to main/develop branches. Build website package with Bun and deploy to GitHub Pages using official deploy-pages action. -
Bump all package versions to 0.0.4 (
05b843c)Synchronize version numbers across all workspace packages before release workflow testing -
Set version to 0.1.1 for next release (
cef0542) -
Set version to 0.1.3 for next release (
cf7c201)