Release 2.1.2

[heskew]

Release 2.1.2

Patch — hardening batch from the post-2.1.1 sweep. All fixes, no features.

• Validate mcp.issuer is a full http(s) origin at config load (Validate mcp.issuer is a full origin (with scheme) at config load #139 / fix: validate mcp.issuer is a full origin at config load (#139) #152). Fail-fast on schemeless or path/query/fragment/credential-bearing values that previously produced malformed endpoint URLs downstream. Format validation only runs when mcp.enabled is true.
  • ⚠️ Startup-behavior note: a deployment with mcp.enabled: true and a malformed mcp.issuer that previously started (with broken discovery/endpoint URLs) now refuses to start with a clear error naming the bad value.
• Secret redaction hardening (Harden SENSITIVE_KEY_PATTERN log redaction for snake_case secret keys #140 / fix: redact snake_case secret keys in option logging (#140) #153). SENSITIVE_KEY_PATTERN now catches snake_case/kebab secret keys (signing_key_pem, initial_access_token, private_key, …); redaction extracted to a shared lib/redact.ts; the pluginDefaults debug log is now redacted too; non-plain objects (Date/Map/class instances) pass through unmangled.
• Non-Error catch safety (Harden HookManager catch blocks against non-Error throws ((error as Error).message) #142, Harden (error as Error).message catches across remaining src/lib/mcp/ files #147 / fix: harden catch blocks against non-Error throws (#142, #147) #154). All 16 remaining (error as Error).message catch sites now use error instanceof Error ? error.message : String(error), so a thrown string/null can no longer crash the catch itself; the wrapped ID-token verification error now chains the original via cause.

Release mechanics

Merging this bumps package.json to 2.1.2. Publishing a GitHub Release tagged v2.1.2 triggers release.yml, which publishes to npm latest via OIDC trusted publishing.

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request increments the version of the @harperfast/oauth package from 2.1.1 to 2.1.2 in both package.json and package-lock.json. There are no review comments, and I have no feedback to provide.

[claude]

Reviewed; no blockers found.

[github-actions]

Reviewed; no blockers found.