aditzel · aditzel · Jun 12, 2026 · Mar 11, 2026 · Mar 12, 2026 · Mar 12, 2026
diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
@@ -1,6 +1,6 @@
 # Contributing to MCP²
 
-Thank you for your interest in contributing to MCP²! The project is in **alpha (v0.1.x)** with core functionality implemented and active development underway.
+Thank you for your interest in contributing to MCP²! The project is in **alpha (v0.8.x)** with core functionality implemented and active development underway; CLI, auth integrations, and configuration details may still evolve between releases.
 
 ## Getting Started
 

diff --git a/.junie/memory/errors.md b/.junie/memory/errors.md
diff --git a/.junie/memory/feedback.md b/.junie/memory/feedback.md
@@ -0,0 +1,24 @@
+[2026-03-11 13:18] - Updated by Junie
+{
+    "TYPE": "preference",
+    "CATEGORY": "Next-step specificity",
+    "EXPECTATION": "User wants detailed, specific next-step recommendations with concrete tasks and progress signals.",
+    "NEW INSTRUCTION": "WHEN recommending next steps THEN provide detailed, specific steps, deliverables, and success checks"
+}
+
+[2026-03-11 16:26] - Updated by Junie
+{
+    "TYPE": "correction",
+    "CATEGORY": "Endpoint URL correction",
+    "EXPECTATION": "User wants the full MCP SSE endpoint specified with the /sse suffix.",
+    "NEW INSTRUCTION": "WHEN providing or configuring the MCP endpoint THEN use https://mcp.woxpas.ai/mcp/sse"
+}
+
+[2026-03-11 22:39] - Updated by Junie
+{
+    "TYPE": "negative",
+    "CATEGORY": "Iteration fatigue",
+    "EXPECTATION": "User wants a concise wrap-up of remaining work and a clear finish line.",
+    "NEW INSTRUCTION": "WHEN user asks what's left or shows iteration fatigue THEN provide concise remaining tasks, definition of done, and stop criteria"
+}
+
diff --git a/.junie/memory/language.json b/.junie/memory/language.json
@@ -0,0 +1 @@
+[{"lang":"en","usageCount":48}]
diff --git a/.junie/memory/memory.version b/.junie/memory/memory.version
@@ -0,0 +1 @@
+1.0
diff --git a/.junie/memory/tasks.md b/.junie/memory/tasks.md
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,46 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+- Documented the short-term accepted OpenTUI transitive `file-type` advisory in `docs/DEPENDENCY_EXCEPTIONS.md` and tightened the dependency-maintenance/release process so temporary audit exceptions are only allowed when reviewed reachability remains low and local-only.
+
+## [0.8.1] - 2026-03-11
+
+### Changed
+- Refreshed the top-level README status text to match the current `0.8.x` alpha line and clarify that auth integrations and CLI/config details may still evolve.
+- Refreshed contributor and agent-facing docs (`.github/CONTRIBUTING.md`, `WARP.md`, and `docs/PROJECT-INCEPTION-REQUIREMENTS.md`) so current-status messaging consistently reflects the active `0.8.x` alpha line while preserving the inception doc as a historical `v0.1.x` baseline.
+- Extracted capability-surface assembly from `src/server/index.ts` into `src/server/capability-surface.ts`, isolating capability-router instructions, metadata summaries, and router construction behind focused tests to make further server architecture refactors safer.
+- Extracted capability tool registration and request-dispatch composition from `src/server/index.ts` into `src/server/capability-tool-surface.ts`, with additional handler regression tests covering `__describe_actions`, missing/unknown actions, and ambiguous capability-route disambiguation.
+- Extracted capability tool execution from `src/server/index.ts` into `src/server/capability-tool-executor.ts`, isolating policy gating, response-resource offload handling, and selection-tracking behavior behind focused executor tests.
+- Extracted session-surface registration from `src/server/index.ts` into `src/server/session-surface.ts`, isolating capability tool exposure and optional response-resource registration behind focused helper tests.
+- Extracted runtime lifecycle orchestration from `src/server/index.ts` into `src/server/runtime-lifecycle.ts`, isolating background refresh hooks plus core startup/shutdown sequencing for upstream connections, hybrid classification, embeddings, and monitor lifecycle.
+- Extracted remaining stdio/session bootstrap composition from `src/server/index.ts` into `src/server/server-shell.ts`, isolating session creation plus primary start/stop connection wiring behind focused shell tests.
+- Extracted shared CLI startup/shutdown helpers plus daemon/proxy orchestration from `src/index.ts` into dedicated runtime-bootstrap and runner modules, with focused dispatch and lifecycle regression tests for the interactive daemon and stdio proxy flows.
+- Extracted the remaining auth and monitor orchestration from `src/index.ts` into dedicated CLI runner modules plus a shared TUI-runtime helper, with focused regression tests covering auth/monitor dispatch and lifecycle behavior.
+- Extracted the remaining CLI test/install/import/migrate orchestration from `src/index.ts` into dedicated runner modules, with focused regression tests covering command delegation plus runtime dispatch for those flows.
+- Refactored the remaining CLI entrypoint composition out of `src/index.ts` into dedicated `main-runtime`, `run-stdio-server`, and runtime-profile modules, with focused tests covering `main()` help/version dispatch and stdio startup/shutdown lifecycle wiring.
+- Expanded shared-daemon lifecycle regression coverage to lock down three-client owner-reconnect sequencing on the server side and three-bridge replacement-daemon recovery on the proxy side during restart flapping.
+- Expanded daemon lifecycle monitor coverage to verify monitor-visible owner promotion/restoration ordering and stale-session cleanup during three-client reconnect flapping.
+- Expanded daemon lifecycle monitor recovery coverage to verify a monitor client can reconnect across full daemon replacement while three clients rejoin cleanly and stale session IDs do not survive the old/new daemon boundary.
+- Expanded full shared-daemon replacement coverage to verify a reattached monitor client still sees exactly three recovered proxy sessions, the logical prior owner restored, and no stale session IDs after three proxy bridges reconnect to the replacement daemon.
+- Expanded shared-daemon config-identity recovery coverage to verify three recovering proxy bridges ignore a live mismatched daemon identity, rebind only to the matching replacement daemon, and never surface mixed session state through monitor clients.
+- Expanded shared-daemon stale-registry recovery coverage to verify recovering proxy bridges prune a dead matching-config registry entry, ignore a live mismatched daemon identity, and converge on exactly one fresh matching replacement daemon without leaking mixed monitor-visible session state.
+- Expanded shared-daemon convergence coverage to verify overlapping stale matching-config recovery triggers still produce exactly one fresh matching replacement daemon, keep registry state stable after convergence, and avoid mixed monitor-visible session sets.
+
+### Fixed
+- Fixed `mcp-squared test` for interactive OAuth SSE upstreams to recreate the HTTP transport after browser auth completes, avoiding `StreamableHTTPClientTransport already started!` failures during reconnect.
+- Fixed SSE config validation to give OAuth-specific guidance when an `auth = true` upstream also includes a literal bearer `Authorization` header, instead of suggesting env-placeholder bearer-token setup for OAuth-only services.
+- Fixed a proxy shutdown race where overlapping daemon disconnect and manual bridge stop paths could call `stdioTransport.close()` twice before the first close completed, improving lifecycle idempotency for daemon/proxy teardown.
+- Fixed daemon owner reassignment ordering so authenticated peers become the active owner immediately after a disconnect, even if the departing session's cleanup is still awaiting server/transport shutdown.
+- Fixed fast same-client daemon reconnects to replace stale authenticated sessions immediately, so ownership recovers without waiting for heartbeat timeout when a proxy reconnects after transport loss.
+- Fixed owner preservation during delayed same-client reconnect cleanup, so a reconnecting logical owner keeps ownership instead of incorrectly handing it to an older observer session.
+- Fixed shared-daemon proxy recovery after daemon restarts by forcing reconnects to refresh endpoint discovery instead of reusing the dead daemon endpoint, so active stdio clients stay connected when a replacement daemon comes up.
+- Fixed proxy reconnect handling after transient daemon restart failures by retrying recovery instead of closing stdio immediately, so active clients survive reconnect flapping while the replacement daemon comes online.
+- Fixed concurrent shared-daemon recovery so multiple active proxy bridges reuse one replacement-daemon startup wait instead of racing duplicate rediscovery/spawn attempts after an outage.
+- Fixed rapid shared-daemon owner reconnect flapping so a recently disconnected logical owner can promptly reclaim ownership from observers after reconnecting, instead of losing owner status based only on disconnect timing.
+- Fixed reconnect-time daemon owner restoration to send `helloAck` before `ownerChanged`, so a reconnecting logical owner sees a stable handshake before the broadcast ownership update reaches all clients.
+- Fixed reconnect-time daemon owner restoration to avoid sending a redundant `ownerChanged` self-notification to the authenticating session when its `helloAck` already reflects final ownership, while still broadcasting the restored owner to other active clients.
+
 ## [0.8.0] - 2026-03-08
 
 ### Added

diff --git a/README.md b/README.md
@@ -3,7 +3,7 @@
 MCP² (Mercury Control Plane) is a local-first meta-server and proxy for the Model Context Protocol (MCP). It addresses tool context bloat by enabling dynamic, progressive disclosure of tools to LLMs. Instead of flooding the model context with every available tool schema, MCP² exposes a stable, minimal surface area for tool discovery and execution.
 
 ## Status
-**Alpha (v0.6.x)** - Core functionality is implemented and tested; CLI and config details may evolve.
+**Alpha (v0.8.x)** - Core functionality is implemented and tested; CLI, auth integrations, and config details may still evolve between releases.
 
 ## Install & Run
 
@@ -161,6 +161,8 @@ url = "https://example.com/mcp"
 auth = true
 ```
 
+For OAuth-only SSE upstreams, set `auth = true` and omit any manual `Authorization` header. MCP² handles browser auth, stores the OAuth token under `~/.config/mcp-squared/tokens/<upstream>.json`, and reuses it on future connections.
+
 Security policies (allow/block/confirm) live under `security.tools` and are matched against `capability:action` patterns. Confirmation flows return a short-lived token that must be provided to the same capability/action call to proceed. OAuth tokens for SSE upstreams are stored under `~/.config/mcp-squared/tokens/<upstream>.json`.
 
 `mcp-squared init` seeds code-search routing preferences so internal retrieval/routing heuristics prioritize common code indexers by default:

diff --git a/WARP.md b/WARP.md
@@ -5,7 +5,7 @@ This file provides guidance to WARP (warp.dev) when working with code in this re
 ## Project Overview
 MCP² (Mercury Control Plane) is a local-first meta-server and proxy for the Model Context Protocol (MCP). It acts as middleware to manage tool context bloat by progressively disclosing tools to LLMs via a stable interface (`find_tools`, `describe_tools`, `execute`, plus supporting meta-tools).
 
-**Status**: Alpha (v0.1.x)
+**Status**: Alpha (v0.8.x) — core functionality is implemented and tested; CLI, auth integrations, and configuration details may still evolve between releases.
 
 ## Package Manager Policy