Product changelog

What changed in Axtary

One coordinated history for the nine public packages that make up the Axtary runtime. Each chapter names the user-facing outcome and its verification boundary.

View v0.6.1 on npm

Latest · v0.6.1 · 9 packages published in lockstep

v0.6.1Latest

Recover from a retired dashboard endpoint

A focused CLI hotfix makes stale dashboard connections recoverable without pretending a remote session was revoked.

Fixed

  • Ordinary logout now keeps the local credential when its dashboard endpoint cannot be reached.
  • The CLI reports an actionable dashboard-unreachable state instead of a generic fetch failure.
  • An explicit --local-only path removes local credentials while reporting that remote revocation did not occur.

Verified

  • The published npm CLI reproduced both stale-origin recovery paths from a clean install on supported Node 22.13.0.
v0.6.0

Connect the CLI to your dashboard

The CLI can now open a browser sign-in, bind a scoped session to an existing dashboard account, and show the active tenant and role.

Added

  • axtary login opens a short-lived confirmation page and lets an authenticated member choose an allowed tenant.
  • axtary account and axtary whoami expose the connected email, tenant, role, endpoint, scopes, and expiry state.
  • Hosted approval requests can use the linked CLI session instead of a manually exported dashboard token.

Security

  • Sessions are origin- and tenant-bound, limited to creating and reading their own approval requests, and refreshed with rotation and membership checks.

Verified

  • The browser-to-CLI flow and all nine coordinated packages were exercised from the production site and npm registry.
v0.5.0

Adoption polish and package hygiene

This release made the public package line easier to understand, install, and audit before the dashboard connection work began.

Changed

  • Package READMEs and CLI help were reorganized around the normal quickstart and the role of each runtime package.
  • Build and dependency hygiene were refreshed across the workspace.
  • ActionPass transport naming was clarified and direct runtime network access was removed from the reviewed path.
v0.4.0

Trusted publishing and deeper hardening

Axtary moved its coordinated npm releases to GitHub OIDC trusted publishing and tightened indirect network boundaries.

Security

  • Remote JWKS resolution and adapter transport paths gained stricter fail-closed handling.
  • Registry publishing moved to short-lived GitHub Actions OIDC identity instead of a long-lived npm write token.

Added

  • axtary --version reports the installed CLI release.
  • A resilient registry verifier checks the coordinated public package line after publishing.
v0.3.0

Reproducible approvals and safer transports

Approval demonstrations became reproducible while the first wave of network-facing transports moved behind injected, fail-closed boundaries.

Added

  • axtary demo --approve-step-up reproduces the approval path and verifies payload equivalence.
  • Walkthrough scripts make the allow, deny, step-up, approval, and ledger sequence repeatable.

Security

  • Ledger, approvals, MCP, and initial adapter network operations moved behind injectable transports that fail closed.
v0.2.0

The authorization and verification spine

Axtary deepened the first runtime into a payload-bound authorization and independently verifiable evidence path.

Added

  • ActionPass v1 added proof-of-possession, delegation, budgets, revocation, and status checks.
  • The ledger added attestation, Merkle evidence, forensic search, and export paths.
  • Runtime hooks, connector templates, OpenTelemetry signals, and status-first CLI diagnostics broadened the integration surface.

Verified

  • A clean registry install reproduced init, demo, connector diagnosis, and a VALID attestation result.
v0.1.0

First runnable Axtary

The first usable, Apache-2.0 package line shipped the local ten-minute path from configuration to governed actions and ledger evidence.

Added

  • axtary init and axtary demo scaffold a local configuration and run safe, denied, and step-up actions through policy.
  • The first ActionPass, policy, proxy, approvals, MCP, adapters, config, and JSONL ledger packages formed a complete local path.

Verified

  • The published CLI completed init and demo from a clean registry install.
v0.0.1Historical

Namespace reserved

The initial package publications reserved the @axtary namespace. They were placeholders, not a supported runtime or quickstart.

History

  • Package names were established across npm before the first runnable coordinated release.
  • Use 0.1.0 or later when reconstructing the beginning of the supported public package line.