Release 0.2.1 with public API safety fixes

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.2.1 - 2026-10-27
+
+- Filter reflected credentials and unknown diagnostic fields on read-only tools and terminal-job errors.
+- Preserve validated request/job identifiers and existing recovery behavior.
+- Restrict published files and verify clean directory-publish metadata before release.
+
 ## 0.2.0
 
 - Breaking: require a caller-known request_id on both generation tools and the client generate method.

README.md

@@ -1,10 +1,10 @@
 # FlowSpeech MCP Server
 
-## Unreleased Security Follow-up
+## 0.2.1 Security Update
 
 Read-only tools and returned job errors reject the configured API key in diagnostic codes. Returned job errors contain only the validated code, not remote messages or extra fields. Recovery IDs and successful result links remain available.
 
-Use [FlowSpeech](https://flowspeech.io) speech generation from an MCP client. Version 0.2.0 uses the public API v1: create a job, wait for completion, download the WAV, and save it locally.
+Use [FlowSpeech](https://flowspeech.io) speech generation from an MCP client. Version 0.2.1 uses the public API v1: create a job, wait for completion, download the WAV, and save it locally.
 
 ## Requirements
 
@@ -23,7 +23,7 @@ Set `FLOWSPEECH_API_KEY` in the environment used to launch your MCP client. A st
   "mcpServers": {
     "flowspeech": {
       "command": "npx",
-      "args": ["-y", "mcp-flowspeech-server@0.2.0"]
+      "args": ["-y", "mcp-flowspeech-server@0.2.1"]
     }
   }
 }

SKILL.md

@@ -21,7 +21,7 @@ FlowSpeech is a context-aware text-to-speech tool for human-like audio with emot
 Install or run the FlowSpeech MCP server:
 
 ```bash
-npx -y mcp-flowspeech-server@0.2.0
+npx -y mcp-flowspeech-server@0.2.1
 ```
 
 For MCP clients, configure the server with stdio transport:
@@ -31,7 +31,7 @@ For MCP clients, configure the server with stdio transport:
   "mcpServers": {
     "flowspeech": {
       "command": "npx",
-      "args": ["-y", "mcp-flowspeech-server@0.2.0"],
+      "args": ["-y", "mcp-flowspeech-server@0.2.1"],
       "env": {
         "FLOWSPEECH_OUTPUT_DIR": "~/flowspeech-audio"
       }

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "mcp-flowspeech-server",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "mcp-flowspeech-server",
-      "version": "0.2.0",
+      "version": "0.2.1",
       "license": "MIT",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.12.0"

package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-flowspeech-server",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "MCP server for the FlowSpeech public API with asynchronous speech jobs, voice discovery and quota checks",
   "keywords": [
     "mcp",

scripts/test-packed.mjs

@@ -13,7 +13,7 @@ const destination = path.resolve(process.env.FLOWSPEECH_PACK_DESTINATION ?? root
 await mkdir(destination, { recursive: true });
 const packed = JSON.parse(execFileSync(process.execPath, [npmCli, 'pack', '--ignore-scripts', '--json', '--pack-destination', destination], { cwd: root, env, encoding: 'utf8' }));
 assert.equal(packed.length, 1);
-assert.equal(packed[0].version, '0.2.0');
+assert.equal(packed[0].version, '0.2.1');
 const archive = path.join(destination, packed[0].filename);
 const expected = [
   'LICENSE', 'dist/client.js', 'dist/index.js', 'package.json', 'CHANGELOG.md',
@@ -37,7 +37,7 @@ try {
   const target = path.join(directory, 'package');
   const manifest = JSON.parse(await readFile(path.join(target, 'package.json'), 'utf8'));
   assert.equal(manifest.bin['mcp-flowspeech-server'], 'dist/index.js');
-  assert.equal(manifest.version, '0.2.0');
+  assert.equal(manifest.version, '0.2.1');
   assert.ok((await readFile(path.join(target, manifest.bin['mcp-flowspeech-server']), 'utf8')).startsWith('#!/usr/bin/env node'));
   // Dependencies resolve from the existing workspace install; implementation imports
   // and the child stdio process both use only the extracted package's dist files.

src/index.ts

@@ -9,7 +9,7 @@ import path from 'node:path';
 import os from 'node:os';
 import { FlowSpeechClient, dialogueInput, validateId } from './client.js';
 
-const VERSION = '0.2.0';
+const VERSION = '0.2.1';
 function expandHome(value: string): string {
   return value === '~' ? os.homedir() : value.startsWith('~/') ? path.join(os.homedir(), value.slice(2)) : path.resolve(value);
 }