release: prepare v0.5.2

CHANGELOG.md

@@ -4,6 +4,15 @@ All notable changes to this project will be documented in this file. The format
 
 ## [Unreleased]
 
+## [0.5.2] - 2026-07-29
+
+### Fixed
+
+- [#203](https://github.com/mohanagy/miftah/issues/203) Made bounded Console configuration discovery explain what happened instead of silently omitting unsafe candidates. The Console now reports aggregate found, ready, and need-attention counts with fixed repair categories while continuing to hide rejected names, paths, values, parser details, and filesystem identities. POSIX ownership/mode checks, Windows DACL verification, symlink/race/deduplication protections, and exact selected-file binding remain fail closed.
+- [#300](https://github.com/mohanagy/miftah/issues/300) Preserved still-valid Console sessions across refresh, back/forward navigation, and additional tabs through the existing authenticated loopback session boundary. Expired, reused, superseded, malformed, and wrong-process bootstrap codes now receive specific recovery guidance without exposing credential material. One-use terminal bootstrap codes, HttpOnly `SameSite=Strict` cookies, in-memory-only CSRF proofs, Host/Origin checks, credential rotation, and no-store responses are unchanged.
+- [#301](https://github.com/mohanagy/miftah/issues/301) Added names-only environment-secret readiness before CLI and Console client handoff. Setup now distinguishes not required, available, missing, and not fully checked states, keeps configured environment files unopened, treats empty inherited values as missing, and leaves generated client JSON credential-free. Console completion guidance is cleared when the active configuration changes so stale readiness cannot be attributed to another configuration.
+- [#305](https://github.com/mohanagy/miftah/issues/305) Prepared the compatible v0.5.2 corrective release for the first external evaluator blockers. Miftah remains experimental and pre-1.0; external validation remains incomplete under #25, #36, #37, #39, #78, #88, #202, #204, and #290.
+
 ## [0.5.1] - 2026-07-29
 
 ### Added

README.md

@@ -53,7 +53,7 @@ Install Miftah, then choose the terminal wizard or the browser Console. Both use
 ### 1. Install the current release
 
 ```bash
-npm install -g @lubab/miftah@0.5.1
+npm install -g @lubab/miftah@0.5.2
 miftah version
 ```
 

docs/presets-and-clients.md

@@ -3,7 +3,7 @@
 This is the compatibility source of truth for generated `miftah init` configurations and client snippets.
 
 - Catalog version: `3`
-- Miftah package version: `0.5.1`
+- Miftah package version: `0.5.2`
 - Last tested / validation boundary: the catalog builds strict Miftah configuration that `validateConfig` accepts. The docs contract test checks generated configuration only; it does **not** construct a runtime, start, authenticate to, or smoke-test external providers.
 
 Miftah itself requires Node.js `>=20`. That does not establish an upstream server's Node requirement.

docs/whats-new-in-0.5.md

@@ -1,9 +1,9 @@
 # What is in Miftah 0.5
 
-Install `@lubab/miftah@0.5.1` when you want Miftah to guide setup instead of assembling a multi-account configuration by hand:
+Install `@lubab/miftah@0.5.2` when you want Miftah to guide setup instead of assembling a multi-account configuration by hand:
 
 ```bash
-npm install -g @lubab/miftah@0.5.1
+npm install -g @lubab/miftah@0.5.2
 miftah version
 ```
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lubab/miftah",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "Wrap any MCP. Use the right account without reconnecting.",
   "keywords": [
     "mcp",

tests/release-version.test.ts

@@ -1,7 +1,7 @@
 import { readFileSync } from "node:fs";
 import { describe, expect, it } from "vitest";
 
-const releaseVersion = "0.5.1";
+const releaseVersion = "0.5.2";
 
 function readRepositoryFile(path: string): string {
   return readFileSync(new URL(`../${path}`, import.meta.url), "utf8");
@@ -21,10 +21,10 @@ function releaseNotes(changelog: string, version: string): string {
   return changelog.slice(match.index, end < 0 ? undefined : end);
 }
 
-describe("v0.5.1 release artifacts", () => {
+describe("v0.5.2 release artifacts", () => {
   it.each([
-    "## [0.5.1] - 2026-7-29\n\n### Added\n",
-    "Release candidate: ## [0.5.1] - 2026-07-29\n\n### Added\n"
+    "## [0.5.2] - 2026-7-29\n\n### Fixed\n",
+    "Release candidate: ## [0.5.2] - 2026-07-29\n\n### Fixed\n"
   ])("requires a dated release heading at the start of a line", (changelog) => {
     expect(() => releaseNotes(changelog, releaseVersion)).toThrow(
       `Unable to find the ${releaseVersion} changelog entry.`
@@ -65,22 +65,32 @@ describe("v0.5.1 release artifacts", () => {
     }
   });
 
-  it("documents the first-use corrections while retaining the experimental package status", () => {
+  it("documents the evaluator-driven recovery fixes while retaining the experimental package status", () => {
     const changelog = readRepositoryFile("CHANGELOG.md");
     const notes = releaseNotes(changelog, releaseVersion);
 
-    expect(changelog).toContain("Miftah is experimental and pre-1.0");
-    expect(notes).toContain("### Added");
-    expect(notes).toContain("### Changed");
+    expect(notes).toContain("Miftah remains experimental and pre-1.0");
     expect(notes).toContain("### Fixed");
-    expect(notes).toMatch(/owner-readable Miftah 0\.5 feature and usage guide/iu);
-    expect(notes).toMatch(/first-use product front door/iu);
-    expect(notes).toMatch(/numbered source choices/iu);
-    expect(notes).toMatch(/safe back\/cancel handling/iu);
-    expect(notes).toMatch(/external evaluator acceptance remains open/iu);
-    expect(notes).toMatch(/host-dependent file-flush latency/iu);
+    const fixedStart = notes.indexOf("### Fixed");
+    const fixedEnd = notes.indexOf("\n### ", fixedStart + "### Fixed".length);
+    const fixedNotes = notes.slice(fixedStart, fixedEnd < 0 ? undefined : fixedEnd);
+    for (const issue of [203, 300, 301, 305]) {
+      expect(fixedNotes).toContain(`[#${issue}](https://github.com/mohanagy/miftah/issues/${issue})`);
+    }
+    expect(notes).toMatch(/found, ready, and need-attention/iu);
+    expect(notes).toMatch(/still-valid Console sessions across refresh/iu);
+    expect(notes).toMatch(/names-only environment-secret readiness/iu);
+    expect(notes).toMatch(/external validation remains incomplete/iu);
+
     const readme = readRepositoryFile("README.md");
+    const featureGuide = readRepositoryFile("docs/whats-new-in-0.5.md");
+    const compatibilityGuide = readRepositoryFile("docs/presets-and-clients.md");
+
     expect(readme).toContain("Use the right account with the MCP servers you already trust");
     expect(readme).toContain("experimental and pre-1.0");
+    expect(readme).toContain(`npm install -g @lubab/miftah@${releaseVersion}`);
+    expect(featureGuide).toContain(`Install \`@lubab/miftah@${releaseVersion}\``);
+    expect(featureGuide).toContain(`npm install -g @lubab/miftah@${releaseVersion}`);
+    expect(compatibilityGuide).toContain(`Miftah package version: \`${releaseVersion}\``);
   });
 });