chore(release): merge v2/main into main for v2.12.0

.github/workflows/codeql.yml

@@ -0,0 +1,77 @@
+# CodeQL code scanning, as an advanced-setup workflow (#2545).
+#
+# Replaces CodeQL DEFAULT setup, which analyzes only the default branch
+# (`main`) and PRs into it. We develop on `v2/main` and reach `main` only by
+# milestone merge, so under default setup no v2 work was scanned until the
+# release PR: the v2.9.0 ReDoS (#2540) surfaced on the milestone-merge PR and
+# held the release, when it should have landed on the PR that introduced it.
+#
+# Same languages (`actions`, `javascript-typescript`) and the same default
+# query suite as default setup had; what changes is only which refs run.
+#
+#   - `push` to `main` and `v2/main` — the baseline each branch's alerts are
+#     tracked against.
+#   - `pull_request` into `main` and `v2/main` — a finding lands on the PR
+#     that introduced it. Runs from the PR's own ref, so this file is live the
+#     moment it is on `v2/main`, as `dco.yml` is.
+#   - the weekly `schedule`, which GitHub runs from the DEFAULT branch only —
+#     so it starts once a milestone merge carries this file to `main`.
+#
+# ⚠️ Default setup must be OFF (a repository setting — Settings → Code
+# security → CodeQL analysis — not a file). GitHub refuses an advanced-setup
+# upload while it is on, and with both on the two would double-report.
+#
+# `security-events: write` is the scope that uploads results — and therefore
+# the scope that could suppress them — so `verify:action-pins` counts this job
+# as credentialed and every action it runs is SHA-pinned (#2484). Pins are
+# resolved with `npm run action:resolve-pin`.
+name: CodeQL
+
+on:
+  push:
+    branches: [main, v2/main]
+  pull_request:
+    branches: [main, v2/main]
+  schedule:
+    - cron: "23 16 * * 6" # 16:23 UTC Saturday, default setup's old slot
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    # A newer push to the same PR or branch supersedes the analysis.
+    concurrency:
+      group: codeql-${{ github.ref }}-${{ matrix.language }}
+      cancel-in-progress: true
+    # Observed under default setup over 30 runs (2026-09-02 – 2026-10-17):
+    # `actions` ~40s, `javascript-typescript` 1.5–4.7 min. Twice the slowest,
+    # rounded up to the next five minutes (#2333).
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [actions, javascript-typescript]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        with:
+          languages: ${{ matrix.language }}
+          # Neither language needs a build; this is what default setup used.
+          build-mode: none
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/dependency-refresh.yml

@@ -50,6 +50,13 @@ jobs:
           node-version: '22.x'
           cache: 'npm'
 
+      - name: Install the pinned npm CLI (allowScripts needs >= 11.19)
+        # Node 22's bundled npm 10.x ignores each install's `allowScripts`, so
+        # the install below would still run the denied esbuild/fsevents
+        # scripts (#2715). Keep this version equal to CI_NPM_VERSION in
+        # main.yml, which states the full reasoning.
+        run: npm install -g --ignore-scripts [email protected]
+
       - name: Install dependencies (root + all clients)
         run: npm install
 

.github/workflows/main.yml

@@ -36,6 +36,23 @@ concurrency:
   group: ${{ github.event_name == 'release' && 'release-npm' || format('run-{0}', github.run_id) }}
   cancel-in-progress: false
 
+# The npm the jobs below install before running npm, pinned EXACTLY and
+# stated once (#2715). Node 22's bundled npm is 10.x, and two things here
+# need 11.x: `publish`'s OIDC
+# trusted publishing (>= 11.5.1, #2483) and the `allowScripts` denials in each
+# install's package.json (>= 11.19, #2712) — npm 10 ignores that field, so on
+# the bundled npm CI would still run the `esbuild` and `fsevents` install
+# scripts the review decided against. (`verify:install-scripts` reads the
+# lockfiles, so it enforces the DECISION on any npm; only npm >= 11.19 does
+# the BLOCKING.) Exact rather than a range for the reason `publish` gives: a
+# range would let whatever 11.x is current into `package`, which builds what
+# the credentialed job ships (#2484). Every job that installs dependencies
+# installs this npm first, with `--ignore-scripts` so even npm's own lifecycle
+# scripts stay out. Bump deliberately, here and in dependency-refresh.yml
+# together; stay on 11.x until 12's Node floor is checked against Node 22.
+env:
+  CI_NPM_VERSION: '11.20.0'
+
 # The `package`, `publish` and `publish-github-container-registry` jobs pin
 # every action to a commit SHA with a `# vX.Y.Z` comment; `build` and
 # `coverage` stay on moving major tags (#2235). A job holding a credential — or
@@ -70,6 +87,10 @@ jobs:
           node-version: '22.x'
           cache: 'npm'
 
+      - name: Install the pinned npm CLI (allowScripts needs >= 11.19)
+        # See CI_NPM_VERSION at the top of this file (#2715).
+        run: npm install -g --ignore-scripts "npm@$CI_NPM_VERSION"
+
       - name: Install dependencies (root + all clients)
         # The root postinstall (scripts/install-clients.mjs) cascades
         # `npm install` into clients/web, clients/cli, clients/tui, and
@@ -203,6 +224,10 @@ jobs:
           node-version: '22.x'
           cache: 'npm'
 
+      - name: Install the pinned npm CLI (allowScripts needs >= 11.19)
+        # See CI_NPM_VERSION at the top of this file (#2715).
+        run: npm install -g --ignore-scripts "npm@$CI_NPM_VERSION"
+
       - name: Install dependencies (root + all clients)
         run: npm install
 
@@ -260,6 +285,10 @@ jobs:
           node-version: '22.x'
           cache: 'npm'
 
+      - name: Install the pinned npm CLI (allowScripts needs >= 11.19)
+        # See CI_NPM_VERSION at the top of this file (#2715).
+        run: npm install -g --ignore-scripts "npm@$CI_NPM_VERSION"
+
       - name: Assert release tag matches package version
         # `npm publish` ships whatever `version` is in the root package.json,
         # regardless of the release's tag. Fail fast (before the heavy install /
@@ -355,9 +384,10 @@ jobs:
       # holds `id-token: write`, so it is the one package this job trusts, and
       # a range would let whatever 11.x is current at release time into it.
       # `--ignore-scripts` keeps even that package's lifecycle scripts out.
-      # Bump deliberately; stay on 11.x until 12's Node floor is checked.
+      # The version is CI_NPM_VERSION at the top of this file, shared with
+      # every job that installs dependencies (#2715) — bump it there.
       - name: Install the pinned npm CLI (OIDC trusted publishing)
-        run: npm install -g --ignore-scripts npm@11.20.0
+        run: npm install -g --ignore-scripts "npm@$CI_NPM_VERSION"
 
       - name: Download the tarball built by the package job
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1

README.md

@@ -87,13 +87,15 @@ Each client has its own README with client-specific detail:
 | [Writing a skill](./docs/skill-authoring.md) | How to write a skill description that actually fires, and eval cases that measure it — the case shapes that work, and the tuning loop |
 | [Test servers](./docs/test-servers.md) | The composable test servers and the showcase config for every feature — what to run, what to click, and what the broken build did |
 | [Publishing](./docs/publishing.md) | What ships in the tarball, the packaging invariants, and `pack:verify` |
+| [Serving the web UI over HTTPS](./docs/tls.md) | `INSPECTOR_TLS_KEY_PATH` / `INSPECTOR_TLS_CERT_PATH`, a trusted local mkcert setup, custom hostnames and `ALLOWED_ORIGINS`, and `NODE_EXTRA_CA_CERTS` for outbound private-CA servers |
 | [Docker](./docs/docker.md) | Running the container image — ports, volumes, and making secrets durable in a container |
 | [Where secrets are stored](./docs/secret-storage.md) | How the secret store is chosen on every runtime — OS keychain, `secrets.json` or memory — plus file encryption, locking, and moving back to a keychain |
 | [Migrating from v1 to v2](./docs/v1-to-v2-migration.md) | CLI flag mapping, `--config` vs. `--catalog`, the Node engine bump, env-var renames |
 | [Environment variables](./docs/environment-variables.md) | Every variable that changes runtime behavior — auth, ports, storage, the secret store, logging, proxies — plus the Node TLS variables for a self-signed server |
 | [MCP server configuration](./docs/mcp-server-configuration.md) | Which server(s) the Inspector connects to, and the config file format |
 | [Reviewing an MCP App](./docs/mcp-app-review.md) | The CLI-first → one-shot-web recipe for automated App-tool review |
 | [Smoke-testing an MCP server](./docs/cli-smoke-testing.md) | The connect → list → call → assert workflow for a shell or CI job: `--format json` + `jq`, the exit-code map, and keeping OAuth non-interactive |
+| [Retroactive DCO signoffs](./docs/dco-retroactive-signoffs.md) | The ten commits that merged without a `Signed-off-by:` while no DCO check ran, and each author's signed-off certification of them |
 | [Launcher and config consolidation](./docs/launcher-config-consolidation-plan.md) | Why the launcher runs a client in-process rather than spawning it |
 | [Roadmap, Aug 2026 → Feb 2027](./docs/inspector-roadmap-2026-h2.md) | The six-month plan: spec-following work aligned to the published MCP roadmap, official extension support, and the experience work we choose |
 | [MCP Inspector: Our AI Software Factory](./docs/ai-software-factory.md) | How contributions actually happen since v2.0.0 — issue-driven work end to end, the rules/skills split, the sweeps that replaced Dependabot, the quality gate, and where it's headed |