85 lines
4.5 KiB
Markdown
85 lines
4.5 KiB
Markdown
# Changelog
|
|
|
|
All notable changes to this project are documented here.
|
|
Format: [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
|
|
|
|
## [Unreleased]
|
|
|
|
### Added
|
|
- `frontend/src/utils/scenePreparation.ts` with scene-preparation utilities (`expandLabelsToNative`, `prepareElementsForScene`, `convertElementsPreservingImageProps`)
|
|
- Backend tests: `tests/backend/db-unit.test.ts`, `tests/backend/mcp-contract.test.ts`, `tests/backend/mcp-sanitization.test.ts`, `tests/backend/security-unit.test.ts`, `tests/backend/smoke-ws.test.ts`, `tests/backend/tenant-authz-behavior.test.ts`
|
|
- Frontend test: `tests/frontend/scene-preparation.test.ts`
|
|
- E2E regression suite: `tests/e2e/phase2-regressions.spec.ts`
|
|
|
|
### Changed
|
|
- `computeElementHash` is now order-stable for equivalent element sets
|
|
- `frontend/src/App.tsx` now uses centralized scene-preparation utilities for label expansion and native-vs-converted routing
|
|
- Documentation test counts updated to `443`
|
|
|
|
### Fixed
|
|
- MCP unknown tool calls now return JSON-RPC `MethodNotFound` (`-32601`)
|
|
- `import_scene` now enforces dangerous-key checks on parsed scene payloads before processing
|
|
|
|
## [1.0.1] - 2026-03-29
|
|
|
|
### Fixed
|
|
- `better-sqlite3` native module now rebuilt on install via `postinstall` script, fixing Node.js version mismatch errors (e.g. Node v22 vs v25) when installing via npx
|
|
|
|
## [1.0.0] - 2026-03-29
|
|
|
|
### Changed
|
|
- Renamed project from `@sanjibdevnath/mcp-excalidraw-local` to `excalidraw-mcp-sentinel`
|
|
- New npm package name: `excalidraw-mcp-sentinel` (unscoped)
|
|
- GitHub repo: `celstnblacc/excalidraw-mcp-sentinel`
|
|
- Docker images: `celstnblacc/excalidraw-mcp-sentinel` and `celstnblacc/excalidraw-mcp-sentinel-canvas`
|
|
- CLI binary renamed: `excalidraw-mcp-sentinel`
|
|
- Version reset to 1.0.0 for independent release track
|
|
- Added "Why this fork?" section to README with full attribution
|
|
|
|
### Removed
|
|
- Superseded planning docs (PLAN.md, PLAN_v2.md, REVIEW.md, HANDOFF.md)
|
|
|
|
## [1.6.3] - 2026-03-29
|
|
|
|
### Security
|
|
- Added `security.ts` middleware module: helmet headers, explicit CORS allowlist, API key auth
|
|
with timing-safe comparison, prototype pollution guard, Mermaid input size limits
|
|
- WebSocket authentication: challenge-response (`auth_required` → `hello + apiKey`) with 5 s
|
|
timeout and close code 4001 on failure; origin verification via `verifyClient`
|
|
- Rate limiting on all `/api/*` routes: 100 req/15 min general, 10 req/min destructive, 10 req/min
|
|
sync write burst
|
|
- `sanitizeSearchQuery` now throws typed `InvalidSearchQueryError` instead of generic `Error`
|
|
- Docker: added `deploy.resources.limits` (canvas 1 CPU/512M, mcp 0.5 CPU/256M) to
|
|
`docker-compose.yml`; extended `.dockerignore` with `tests/` and sensitive key file patterns
|
|
|
|
### Fixed
|
|
- `POST /api/elements/sync`: array validation now runs before logger access, preventing a
|
|
`TypeError` crash (500) on null/non-array input — now returns 400
|
|
- `POST /api/elements/sync/v2`: element type validated against `EXCALIDRAW_ELEMENT_TYPES`
|
|
before write; invalid types return 400 instead of being persisted silently
|
|
- Upgraded `zod` from 3.22.4 to 3.25.5 to resolve `ERR_PACKAGE_PATH_NOT_EXPORTED` crash at
|
|
MCP server startup caused by `zod-to-json-schema` peer dependency mismatch
|
|
|
|
### Changed
|
|
- `ElementSharedFieldsSchema` extracted from `CreateElementSchema`/`UpdateElementSchema` to
|
|
eliminate 25-field duplication; both schemas now use `.extend()`
|
|
- `VALID_ELEMENT_TYPES` moved to module-level constant (was allocated per-request)
|
|
- `resolveHelloTenantAndProject` parameter typed as `HelloMessage` (was `any`)
|
|
- `getAllFilesObject()` helper extracted; `sendFilesAdded()` and `GET /api/files` share it
|
|
- `sendLegacyInitialWsMessages` renamed to `sendAuthlessInitialMessages`
|
|
- `.project-hooks/pre-commit` added to run vitest on every commit
|
|
|
|
## [Unreleased] - 2026-03-30
|
|
|
|
### Fixed
|
|
- Bidirectional sync conflict: WS-applied updates no longer reverted by browser auto-sync (lastSyncedElementsRef now updated on element_updated, element_deleted, elements_batch_created)
|
|
- Labeled container updates (rectangle, ellipse, diamond, arrow) now use convertToExcalidrawElements with ID transplant for correct text layout instead of in-place text patch that caused clipping
|
|
- Standalone text element updates now write label.text into text/originalText fields so Excalidraw renders the new value
|
|
- convertTextToLabel now maps text→label for arrows and empty strings (previously skipped falsy text)
|
|
|
|
### Changed
|
|
- Default theme set to dark
|
|
|
|
### Fixed
|
|
- Labels stored as label.text (e.g. from MCP updates) now survive page refresh — expandLabelsToNative pre-converts them to bound text before Excalidraw renders
|