# Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [v3.0.0] - 2026-05-15

### Added

- **Security: MCP response hardening** — new `taint.Untrusted` typesystem provides compile-time safety boundary between trusted and untrusted data; all MCP responses pass through `SanitizeForMCP` chokepoint; new `EmbedAsData()` helper wraps untrusted content in safe `<data>` tags; all 12 prompt injection points migrated to `EmbedAsData` (#38, #40)
- **Security: typed vault accessors** — `FieldUntrusted()`, `TagsUntrusted()`, `UsageHintUntrusted()` return `taint.Untrusted` values with provenance tracking; `SecretHandle` type with `ParseSecretHandle()` for `op://` path resolution; `HandleResolver` interface (#39)
- **Security: `CanReadValues` profile option** — gates `get_entry_value` behind explicit agent permission; `requireApproval()` helper with `Intent` struct, `ApprovalMode` (none/auto/deny/prompt), and audit-logged approval/rejection events (#40)
- **Security: custom Go vet analyzer (`passlint`)** — detects `fmt.Print*/Sprintf/Fprint*` with `taint.Untrusted` args; integrated into CI via `make vet` (#42)
- **Terminal output hardening** — all TUI, Doctor, and CLI output sanitized through `render.ForTerminal()` and `ForTerminalLine()` (#41)
- OAuth refresh token grant (RFC 6749 §6) with configurable TTLs (`ScopedToken` gains `RefreshTokenHash`/`RefreshExpiresAt`; `CreateWithRefresh()`/`RotateViaRefreshToken()`; single-use rotation) (#46)
- Persistent OAuth client registry — client registrations survive server restarts via JSON persistence (`oauthClientStore.Load()`/`Save()`); optional TTL with background expired-client cleanup (#45)
- Config options `mcp.oauth.access_token_ttl` (default 24h) and `mcp.oauth.refresh_token_ttl` (default 720h/30d) with file config + merge support (#46)
- Nix flake for NixOS/Nix support — `nix run github:danieljustus/OpenPass` with `buildGoModule` package, default app, and dev shell (#36)
- New `internal/ui/render` package with `ForTerminal()`, `QuoteForTerminal()`, `ForTerminalLine()` sanitizers
- New `internal/mcp/render.go` with `RenderChokepoint` and `SanitizeForMCP()`

### Changed

- **Breaking: MCP `get_entry` response format** — `fields` now `[]map[string]{name, handle, kind}` instead of `[]string`; each field includes type-inferred `kind` (string, number, boolean, totp, object, null) (#40)
- **Breaking: `include_value` removed** — `handleGet` returns metadata only; `handleSanitizeOutput` delegates to `SanitizeForMCP` chokepoint (#42)
- **Breaking: prompt format migrated** — all user-supplied values in MCP prompts are now wrapped in `<data label=..>` tags with `(data)` annotation, removing `%s`/`%q` injection risk (#40)
- OAuth docs updated to reflect live OAuth implementation (removed "501 Not Implemented" claims) (#47)
- Agent integration docs: added OAuth DCR section with opencode configuration example (#47)
- `get_entry_metadata`: `UsageHint` sanitized through `SanitizeForMCP`
- `list_entries`/`find_entries`: `Path` and `UsageHint` sanitized through `SanitizeForMCP`
- `set_entry_field`/`delete_entry`: use `requireApproval()` instead of `requiresApproval`
- Bumped `github.com/mattn/go-runewidth` from v0.0.19 to v0.0.23 (#44)
- Bumped `actions/upload-artifact` from 4 to 7 (#43)
- `gocyclo` complexity threshold adjusted to 30 for existing codebase

### Fixed

- OAuth error response: `unauthorized_client` → `invalid_client` with `WWW-Authenticate` header (#45)
- Nix `vendorHash` resolved for reproducible builds (#36)
- `err` shadowing in `handlerForAgent` goroutine closure
- `gofmt` formatting across `config.go`, `taint_test.go`, `schema.go`, `token.go`, `oauth.go`, and test files
- `errcheck`: handle `fmt.Fprintf` return values in `taint.go`
- `goconst`: use `SecretTypePassword` constant in `types.go`
- `govet shadow`: rename `err` variables in `tools_delete.go` and `tools_get.go`
- `prealloc`: preallocate slice with capacity in `approval_helper.go`
- `unconvert`: remove unnecessary `string()` conversion
- `unused`: remove dead `buildVaultResolver` function
- Skip file permission assertion on Windows (`chmod` is no-op on Windows)
- `goimports`: formatting on `passlint_test.go`

## [v2.9.0] - 2026-05-13

### Added

- Weak password support: `AssessPasswordStrength` (non-blocking) alongside `ValidatePasswordStrength`, weak passwords accepted with confirmation in TTY mode, `--force` for scripted use, automatic `weak-password` tag on entries, and new doctor checks `password.strength` and `password.reuse` (#35)
- Centralized TUI theme system with visual polish and Esc-to-confirm (#33)
- Doctor enhancements: tag-based check filtering (`--quick`), 9 new checks (auto-type backend, clipboard, daemon, MCP server, dynamic secrets, agents, secure UI, pre-commit hooks, session keyring), `--fix-dry-run` flag, schema_version output (#31)
- Agent auto-install support for Codex and OpenCode alongside existing Claude Code config (#32)
- Theme symbols and styletheme packages for consistent UI styling

### Changed

- Wizard UX improvements: summary highlight, MultiDevice default to No, Enter-to-save on empty textarea, progress spinner with step counter, resume prompt with file age, passphrase autofocus, vault path validation, resume file moved to UserCacheDir with 0600 perms (#30)
- TOML config reader/writer (`FormatTOML` constant) for agent config generation

### Fixed

- Security: OAuth flow now requires client registration, TTY consent, and returns scoped tokens (#21)
- Security: `list_shares` scoped to calling agent instead of showing all grants (#22)
- Security: authorization gates (CanRunCommands, allowlist, approval) on `generate_dynamic_secret` (#23)
- Security: passphrase heap copy eliminated via `unsafe.String` aliasing before Wipe (#26)
- Security: Origin header warning + `approve_share` self-approval check (#27, #29)
- Security: global cooldown replacing per-guess failed-attempts map (#25)
- Removed `generate_dynamic_secret` tool (dead code — engines never registered) (#24)
- Removed duplicate `logAuditWithToken` helper (#28)
- Resolved 13 golangci-lint issues (errcheck, goconst, gocritic, govet, unused)
- Added timeout to `checkSessionKeyring` to prevent hang on headless macOS CI
- Lowered coverage threshold to 68.0% to match current baseline
- Added #nosec annotations for gosec G103/G304 false positives (10 alerts)
- gofmt formatting fixes across test files

## [v2.8.2] - 2026-05-12

### Fixed

- Resolve gosec code scanning alerts (G115, G302, G304):
  - Add overflow bounds check for int32 conversion in `SetTestScryptWorkFactor`
  - Fix nosec annotation format for directory permissions check
  - Fix nosec annotation format for controlled file read

## [v2.8.1] - 2026-05-12

### Fixed

- Accept `application/json; charset=utf-8` Content-Type in OAuth dynamic client registration
- Security hardening, concurrency locking, and audit error handling
- Resolve golangci-lint errors (prealloc, errorlint, errcheck)
- Fix test helper vars and Windows LockFileEx test skipping

## [v2.8.0] - 2026-05-12

### Added

- MCP **Prompts** capability with four slash commands surfaced in Claude Code, OpenCode, Hermes and other MCP clients: `add-credential`, `rotate-credential`, `find-and-use`, `share-credential`. Each prompt renders a guided workflow that the agent follows step-by-step (e.g. `/mcp__openpass__add-credential` walks the agent through collecting a new secret without ever exposing the value)
- `request_credential` MCP tool — the agent calls this when it discovers a credential is missing from the vault during a task; the user gets a native input dialog, types the value, and it lands in the vault without ever transiting the chat
- New `internal/secureui` package providing cross-platform secure input: native macOS dialogs via `osascript`, Linux dialogs via `zenity` or `kdialog`, Windows credential prompts via PowerShell `Get-Credential`, with the existing TTY backend as a fallback. Backend selection honors a new `OPENPASS_SECUREUI=tty|gui|none` environment override
- `auth_rotate` CLI command for credential rotation
- `verify` CLI command for vault integrity checks
- `internal/audit/keystore` with OS-level and fallback backends
- `internal/crypto/diceware` passphrase generator with EFF large wordlist
- Multi-device QR pairing in wizard
- Wizard state persistence
- Vault manifest for metadata tracking
- OAuth well-known endpoints for MCP server discovery

### Changed

- `secure_input` MCP tool is now available in HTTP mode as well, provided the host has a native dialog backend (previously stdio + TTY only)
- Server initialize response now advertises the `prompts` capability so clients enable the slash-command surface
- Doctor checks expanded for crypto KDF modern status and keystore health
- Vault entry, lock, reencrypt, and search improvements

## [v1.0.0] - 2026-04-22

Initial stable OpenPass release.

### Added

- Age-based encrypted vault storage with passphrase-protected identity files
- CLI commands for initializing vaults, adding, setting, getting, listing, finding, editing, deleting, and generating entries
- TOTP support for storing seeds and generating one-time codes
- Clipboard copy support with automatic clearing
- Session caching through the operating system keyring
- Git integration for vault history and synchronization
- Multi-recipient vault support for shared access
- MCP server support over stdio and local HTTP transports
- Agent profiles, path restrictions, write controls, metadata-only reads, and TOTP-safe redaction
- HTTP MCP bearer token authentication, request validation, health checks, and Prometheus metrics
- JSON output for automation-friendly CLI use
- Shell completions and generated manual pages
- Linux package, archive, and checksum release automation
- CI coverage checks, race tests, smoke tests, vulnerability scanning, and linting

### Security

- Entry files are encrypted independently with age X25519 and ChaCha20-Poly1305
- Passphrases are read through terminal password prompts and are not stored in plain text
- HTTP MCP binds to `127.0.0.1` by default and requires bearer token authentication
- Release checksums are published for artifact verification

## [v1.1.0] - 2026-04-23

Major update with vault improvements, self-update mechanism, and enhanced MCP transport.

### Added

- Update check command (`openpass update check`) for detecting newer releases
- Self-update mechanism for managing OpenPass installations
- MCP server stdio transport support for local agent integration
- Session management commands (`openpass unlock`, `openpass lock`) with configurable TTL
- Release smoke tests for validating published artifacts
- Installer scripts for cross-platform installation (`install.sh`, `install.ps1`)

### Changed

- Vault structure refactored to use `entries/` subdirectory for organized storage
- Entry format updated to structured YAML with individual file encryption
- Removed index cache in favor of direct filesystem operations
- Improved handler concurrency for better performance
- Enhanced context propagation throughout the codebase

### Fixed

- Audit error logging improved for better diagnostics

## [v1.1.1] - 2026-04-24

Documentation updates.

### Changed

- Updated documentation images and README content

## [v1.1.2] - 2026-04-24

Documentation fixes.

### Changed

- Additional documentation images and README updates (same commit as v1.1.1)

## [v1.1.3] - 2026-04-24

CI configuration fix.

### Fixed

- Skipped Homebrew tap publishing workflow until GitHub PAT is properly configured

## [v1.1.4] - 2026-04-24

CI fix for release validation.

### Fixed

- Fixed release smoke tests to properly validate published artifacts

## [v1.2.0] - 2026-04-24

Audit, backup, and security hardening release.

### Added

- Backup and restore commands with automated test coverage
- Audit log support and broader integration test coverage for vault operations

### Changed

- Enabled Homebrew tap publishing through the release workflow
- Raised package test coverage across vault, session, update, git, and audit paths

### Fixed

- Resolved CI lint failures and a serve race condition
- Fixed generated coverage artifact handling in Git ignores

### Security

- Hardened file handling against path traversal, symlink TOCTOU, and unsafe permissions
- Addressed gosec findings for integer conversion and weak crypto hash usage

## [v1.3.0] - 2026-04-26

MCP, vault search, and backup hardening release.

### Added

- Concurrent vault search with scoped `FindWithOptions` support
- Trusted proxy support for MCP HTTP deployments
- TOTP secret validation before storing credentials

### Changed

- Metrics endpoint authentication now respects loopback vs non-loopback bind security

### Fixed

- Password generation stores entries through the vault entry path helper

### Security

- Hardened backup restore against symlink and permission vulnerabilities
- Fixed additional integer overflow findings in backup restore handling

## [v2.0.0] - 2026-04-28

Platform expansion, transport hardening, and developer experience release.

### Added

- FreeBSD support with in-memory encrypted session cache fallback (AES-256-GCM)
- Scoop distribution channel for Windows
- TLS configuration support for update checker and HTTP MCP
- Batch MCP operations for efficient multi-entry workflows
- Quiet mode flag (`-q` / `--quiet`) for script-friendly output
- Sentinel errors and restructured exit codes for reliable automation
- Password normalization and enhanced TOTP metadata support
- Improved in-memory session cache with configurable expiration
- Graceful OS keyring fallback to memory cache when keyring is unavailable

### Changed

- Go version bumped to 1.26.3
- Comprehensive CI documentation with lint gates and FreeBSD guidance

### Fixed

- FreeBSD cross-compilation by isolating go-keyring imports
- golangci-lint findings across bodyclose, errorlint, shadow, and staticcheck
- Session prompt logic now checks active session before requesting passphrase

## [v2.2.0] - 2026-05-05

Autotype, secure secret execution, MCP token management, and session hardening release.

### Added

- Cross-platform autotype package for automatic password entry (macOS, Linux, Windows)
- MCP tools for autotype and clipboard operations
- Secure wrap key and encrypted identity storage in vault sessions
- Vault legacy mode detection for migration optimization
- Extended secure memory wipe to decrypted entries and additional paths
- `openpass run` command for executing commands with vault secrets as environment variables
- MCP tools for command execution with secret injection
- `CanRunCommands` permission for agent profiles
- MCP scoped token management with fine-grained access control
- Token registry with SHA-256 hashed storage
- `openpass mcp token` CLI commands (create, list, revoke)
- Tool registry for introspecting available MCP tools
- Scoped token authentication integrated into HTTP server authorization
- Fuzz test coverage for importer path normalization
- Windows arm64 to distribution platform matrix
- Installation problem issue template

### Changed

- Updated config schema with `PrintByDefault` and `LegacyMode` fields
- Moved OpenTelemetry dependencies to direct in go.mod
- Enhanced MCP tool registration across all tools
- Refactored touchid session handling
- Improved metrics infrastructure

### Fixed

- Resolved golangci-lint v2 compatibility failures across the codebase
- Fixed pre-existing lint issues: shadowed variables, copylocks, errorlint, exhaustive switches
- Fixed gofmt formatting and Windows path test failures in CI
- Added gosec nosec annotation for intentional subprocess execution
- Fixed macOS keychain hang in CI by stubbing session save identity
- Updated ADR-0003 with completed memory wipe phases

## [v2.2.1] - 2026-05-05

Documentation and bug fix release.

### Added

- Extended comparison table with 1Password, Bitwarden, and pass including accurate pricing, features, and legal disclaimers
- AI chat anti-pattern documentation highlighting the risks of pasting secrets into chat interfaces

### Changed

- Updated README comparison section with a comprehensive five-column feature matrix
- Revised MCP documentation to reflect v2.2.0 features

### Fixed

- Improved argument validation for auth set command with custom validation replacing cobra.ExactArgs, showing help on invalid input

## [v2.3.0] - 2026-05-06

Interactive form, secure memory handling, and MCP token migration release.

### Added

- Interactive Bubble Tea form for guided password entry creation
- Auto-migration of legacy MCP tokens to scoped tokens for enhanced security
- cliout package for consistent colored output with --quiet and NO_COLOR support
- Service interface abstraction in vault service layer

### Changed

- Refactored vault service errors into consolidated error types
- Extracted SafeWriteFile utility to break import cycles across packages
- Upgraded charmbracelet/bubbles to v1.0.0, bubbletea to v1.3.10, and lipgloss to v1.1.0
- Bumped prometheus/common dependency to v0.67.5

### Fixed

- Secret keys and passphrases are now wiped from heap after use
- Atomic file writes via SafeWriteFile pattern for crash-safe vault and config operations
- Touch ID now checks keychain item existence before prompting, preventing double authentication
- Resolved Windows test flakiness and data races in crypto Wipe operations
- Fixed gosec linting violations across the codebase

## [v2.4.0] - 2026-05-07

Daemon mode, device pairing, and multi-device synchronization release.

### Added

- Background daemon mode for persistent MCP server operation
- Device pairing workflow for linking multiple devices to the same vault
- New CLI commands: device, remote, sync, migrate, and serve-install
- Device support in vault and config layers with entry re-encryption for device-specific identities
- Enhanced search functionality for improved entry discovery
- Server handler improvements in MCP layer with bootstrap logic and refined service layer
- macOS notarization documentation and service management scripts

### Changed

- Updated README with multi-device workflow documentation
- Improved server bootstrap sequence for reliable daemon startup
- Refactored input handling across CLI commands for consistency

## [v2.5.0] - 2026-05-08

Dynamic secrets, secret sharing, template engine, and audit integrity release.

### Added

- AWS and PostgreSQL dynamic secret support with automatic lease management and rotation
- Agent-to-agent secret sharing with human approval workflow including ShareStore, approve, revoke, and list tools with full audit integration
- Template engine for secret generation with variable substitution support
- HMAC chain for audit log integrity with chained HMAC per entry and VerifyLogIntegrity function
- Output sanitization for MCP tools to redact secrets before LLM chat interactions
- New sanitize_output MCP tool for secret-safe agent communication
- Editor plugin build targets for IDE integration

### Changed

- Upgraded Go to 1.26.3, fixing eight CVEs (CVE-2026-39820, CVE-2026-39823, CVE-2026-33811, CVE-2026-39826, CVE-2026-42499, CVE-2026-39825, CVE-2026-39836, CVE-2026-33814)
- Refactored autotype string escaping into shared utilities for macOS and Windows

### Fixed

- Hardened crypto with explicit scrypt work factor configuration
- Added ZIP bomb protection in the importer for safe data migration
- Enforced secure deletion of temporary files
- Protected mcp-tokens.json as a runtime path in Git operations
- Resolved Windows CI failures and lint warnings across gosec and gofmt

## [v2.7.0] - 2026-05-11

KDF configuration, vault file locking, MCP security hardening, and platform diagnostics release. Supersedes all v2.6.0 changes (tagged but unreleased).

### Added

- Doctor command for vault health diagnostics including init check, config parsing, identity encryption, permissions, auth, session cache, Git, recipients, MCP tokens, audit log, update check, and vault size, with --no-network option and JSON and text output
- Interactive setup wizard with guided TUI for vault initialization covering passphrase, authentication, agents, backup, multi-device, recipients, profile, sync, and passphrase strength meter
- Scrypt KDF configuration parameter for age passphrase encryption
- Vault file locking using Unix flock and Windows LockFileEx with automatic cleanup on process exit
- OAuth well-known endpoints for MCP server discovery and integration
- Build tag infrastructure for platform-specific feature compilation
- Dynamic shell completion for entry names in openpass get, openpass delete, and related commands
- Hermes and OpenClaw safe adoption guidance documentation
- Expanded test coverage across multiple packages to reach the 70% threshold

### Changed

- Consolidated --json flag onto a persistent --output flag, with --json still functional but deprecated with a warning
- Go toolchain pinning for reproducible MCP agent builds
- Improved MCP agent integration test isolation and port allocation

### Fixed

- Suppressed ANSI color codes when stderr is not a TTY for scripted and piped usage
- Editor resolution now uses LookPath with a fallback chain of EDITOR, sensible-editor, vi, nano, and notepad
- Entry display truncation now operates on rune width instead of byte count for correct multi-byte character rendering
- WriteEntry is now atomic via temporary file write, fsync, and rename
- Command output redaction in MCP agent tests
- Resolved golangci-lint findings across copyloopvar, errcheck, gocyclo, goconst, revive, staticcheck, and unparam

### Performance

- Cached parsed vault configuration by modification time to avoid repeated file reads
- Skipped legacy top-level directory walk when LegacyMode is disabled

### Security

- Autotype now passes passwords via stdin instead of command-line arguments to prevent exposure in process listings
- MCP server now requires TLS or explicit opt-in for non-loopback bind addresses
- Capped RateLimiter map size with LRU eviction to prevent memory exhaustion attacks
- Added loud warning on legacy token migration with wildcard scope

## [v2.1.0] - 2026-04-29

Interactive TUI, vault management, and observability release.

### Added

- Interactive TUI using bubbletea for intuitive vault browsing and management
- Import command for migrating from 1Password, Bitwarden, pass, and CSV
- Config command with JSON schema validation for structured settings
- Profile command for multi-vault management and switching
- Auth command for passphrase and biometric (Touch ID) authentication setup
- Vault service layer for cleaner separation of concerns
- OpenTelemetry tracing support for operation observability
- Structured logging package with configurable verbosity
- Diag command for runtime metrics and environment inspection
- Windows path sanitization in importer to strip invalid characters

### Changed

- Refactored MCP server into focused files for maintainability
- Moved clipboard package to `internal/clipboard` for better organization
- Updated project documentation and generated man pages

### Fixed

- Resolved golangci-lint v2 compatibility issues
- Fixed Ubuntu CI session caching test flakiness
- Corrected release workflow environment variable duplication

[v1.0.0]: https://github.com/danieljustus/OpenPass/releases/tag/v1.0.0
[v1.1.0]: https://github.com/danieljustus/OpenPass/releases/tag/v1.1.0
[v1.1.1]: https://github.com/danieljustus/OpenPass/releases/tag/v1.1.1
[v1.1.2]: https://github.com/danieljustus/OpenPass/releases/tag/v1.1.2
[v1.1.3]: https://github.com/danieljustus/OpenPass/releases/tag/v1.1.3
[v1.1.4]: https://github.com/danieljustus/OpenPass/releases/tag/v1.1.4
[v1.2.0]: https://github.com/danieljustus/OpenPass/releases/tag/v1.2.0
[v1.3.0]: https://github.com/danieljustus/OpenPass/releases/tag/v1.3.0
[v2.0.0]: https://github.com/danieljustus/OpenPass/releases/tag/v2.0.0
[v2.1.0]: https://github.com/danieljustus/OpenPass/releases/tag/v2.1.0
[v2.2.0]: https://github.com/danieljustus/OpenPass/releases/tag/v2.2.0
[v2.2.1]: https://github.com/danieljustus/OpenPass/releases/tag/v2.2.1
[v2.3.0]: https://github.com/danieljustus/OpenPass/releases/tag/v2.3.0
[v2.4.0]: https://github.com/danieljustus/OpenPass/releases/tag/v2.4.0
[v2.5.0]: https://github.com/danieljustus/OpenPass/releases/tag/v2.5.0
[v2.7.0]: https://github.com/danieljustus/OpenPass/releases/tag/v2.7.0
[v3.0.0]: https://github.com/danieljustus/OpenPass/releases/tag/v3.0.0
[v2.9.0]: https://github.com/danieljustus/OpenPass/releases/tag/v2.9.0
[v2.8.2]: https://github.com/danieljustus/OpenPass/releases/tag/v2.8.2
[v2.8.1]: https://github.com/danieljustus/OpenPass/releases/tag/v2.8.1
[v2.8.0]: https://github.com/danieljustus/OpenPass/releases/tag/v2.8.0
