Changelog

All notable changes to Graft are documented here. The format follows Keep a Changelog and Graft uses Semantic Versioning: while the major version is 0, minor releases may change the API; the wire protocol and database schema have their own version numbers (see DEPLOY.md → Versioning).

Unreleased

0.2.0 - 2026-11-12

Security

• Fixed cross-site request forgery against servers without a token (S1).
• Server is loopback-only by default; non-loopback requires a token of at least 16 characters; DNS-rebinding protection via a Host allowlist (S2).
• CLI refuses server paths that escape the workspace, follow symlinks out of it or touch .git; the server rejects .git paths (S3).
• Fixed directory traversal in the swarm dashboard (S4).
• Raw content served as inert downloads; strict CSP and frame protection for the web viewer (S5).
• Upgraded zod to 4.6.7 (GHSA-mrhx-c7xc-m3w5) (S6).
• Hardened Docker image and compose file (S7); generic 500 errors (S8); constant-time token checks (S9); request size and time limits (S10); warning for tokens over plain HTTP (S11).

Added

• Versioning: GET /api/version, x-graft-version response header, wire-protocol negotiation (x-graft-protocol, HTTP 426 on mismatch), graft --version, graft version, graft-server --version.
• Database schema versioning with automatic, transactional migrations (PRAGMA user_version).
• npm run release to bump, changelog, build, test and tag a release.
• Swarm experiment: scripted swarm runner, live dashboard, real-agent setup/verification, results export and report.
• GRAFT_TRACE per-command timing log for the CLI.
• Landing page and static results site, deployable to Cloudflare Pages.
• DEPLOY.md with server, client, site and release instructions.

Fixed

• 16 correctness bugs from the repository-wide scan (diff memory blowup, racily clean files, sparse overwrite, input validation, commit base on non-main branches, atomic repo creation, and more — see the report).

Changed

• CLI commits send small changes inline and fetch only changed paths after a rebase.
• MCP bundle is minified.

0.1.0 - 2026-11-11

Added

• Graft server: changesets, compare-and-swap refs, derived manifests/blame/history, content-addressed blobs, server-side commit + land with automatic rebase and 3-way merge.
• MCP plugin with 13 tools and a skill; graft CLI with sparse workspaces and a node-wide object cache; web viewer; Dockerfile.