Release Aiden Agent 0.38.0 - #92
Conversation
Figma's DCR endpoint allowlists catalog client names and returns a plaintext 403 for "Aiden Agent", which the SDK surfaces as invalid JSON. Register the Figma preset as Codex, mark OAuth clients as native PKCE apps, and connect GitHub over a Bearer PAT. Clarify remaining DCR 403s in Settings. Co-authored-by: Sambit Biswas <sambitcreate@users.noreply.github.com>
# Conflicts: # package.json
![pullfrog[bot]](https://avatars.githubusercontent.com/in/1768019?s=60&v=4){kind=small}
There was a problem hiding this comment.
Important
npm run test:coverage silently stops collecting coverage after this PR's test-registration edit — one small fix on package.json:113 before merge. Everything else checks out: the 0.38.0 declaration is complete and consistent (tag v0.38.0 absent, so the release will publish), and the #83 MCP auth work carried in this branch is sound and well-tested.
Reviewed changes
- Version 0.38.0 declared in both
package.jsonandpackage-lock.json(root +packages[""]— the only three spots that need syncing), with no stragglers referencing 0.37.2. - Android APK plan wording corrected in
docs/plans/aiden-on-the-go-plan.mdto "main pushes assemble and publish the APK, PRs do not", matching the merged #84 policy. - Electron-free MCP OAuth metadata module (
mcp-oauth-client-metadata.ts) consolidates the fixed loopback redirect URI, the native PKCE DCR client shape (application_type: native,token_endpoint_auth_method: none), API-key header prefix handling, and the Figma plaintext-403 explanation — each with focused unit tests. - Figma DCR client-name override: the catalog records
clientName: "Codex", andmcpOAuthClientNameForServerapplies it only to that preset while every other server keeps registering asAiden Agent, so previously cached DCR registrations remain stable. - GitHub hosted MCP is now connectable as a Bearer-PAT API-key preset bound to
https://api.githubcopilot.com/mcp/(origin enforced byserverFromPreset);mcpApiKeyHeaderValuetolerates pasting the PAT with or without theBearerprefix, and the header shape matches GitHub's documented PAT configuration. - Catalog polish: docs URLs refreshed for eight entries; connectable/unsupported counts updated (21 / 6) with matching test assertions.
- New metadata suite registered into
test,test:coverage, andtest:config-recovery— that registration is where the one issue lives (inline).
CI on the head commit is green (verify + Deterministic Electron E2E; the Android job is skipped for this desktop/docs-only change, which is the intended fail-open behavior).
DeepSeek Flash ｜ 𝕏
There was a problem hiding this comment.
✅ No new issues found. The single
test:coveragefinding from the prior review is fixed, with a regression test added to keep it fixed.
Reviewed changes
- Coverage flag restored ahead of positionals in
package.jsontest:coverage(package.json:113):--experimental-test-coveragenow precedes every positional test file again. Verified empirically — the script emits its coverage report, where the previous ordering silently produced none. - Regression test added in
scripts/check-ci-policy.test.mjs: asserts the coverage flag sits before the first positional test path in thetest:coveragescript. The assertion fails under the exact buggy ordering the prior review flagged (first positional at index 2, flag at index 3), and the file is CI-covered viatest:branding(ci.yml:85) andtest:model-catalog(ci.yml:88). New test passes locally (3/3).
CI on the head commit is green for verify (which exercises the new policy test via test:branding) and Detect changed areas; the Android job is skipped as expected for this tooling-only change. The release-ready state established in the prior review — 0.38.0 declared consistently, tag absent, #83 MCP-auth content sound — is unchanged.
DeepSeek Flash ｜ 𝕏
2 participants
Declare Aiden Agent 0.38.0 in both package manifests for the approved release containing #82 (independent Quick View/Environment), #90 (colored borderless UI and accessibility polish), #84 (main-only Android APK artifacts), and #83 (MCP authentication fixes). All four feature PRs are merged. Correct the active mobile plan to describe the merged APK policy.
Validation: exact release candidate 5c0000d passed full CI verification, Electron E2E, release-consumer contracts and Pullfrog. Local full npm test, TypeScript, lint, physical-Mac launch-constraint tests, and release-policy/consumer checks also passed. Pullfrog's coverage-flag ordering finding was fixed with a registered policy test and verified real coverage output; no release-review findings remain.
Merge invokes the existing release workflow to sign, notarize, verify packaged acceptance, and publish the exact 0.38.0 DMG/ZIP, updater metadata, checksums, and stable download alias.