[sapientorius]

Prepare nodePass 0.1.7 with clearer setup diagnostics and MFA sign-in. Setup HTTP exchanges have a 60-second response limit, correlated progress logs and an explicit restart requirement if another app process initializes the database. MFA sign-in explains the selected method and moves recovery codes to a smaller emergency action below the primary controls. The XML import hint now has spacing before Preview.

The release starts from current main (0.1.6), preserving the existing backup protections, XML interoperability corrections and cumulative security catalogue. Root/workspace versions, internal dependencies, lockfile, shared API version and status documentation are synchronized to 0.1.7. No database schema change is introduced; deployment keys, secrets and persistent volumes must be preserved.

Validation: build, types, ESLint, formatting, local assets, release identity/security metadata, publication paths/documentation links and Git whitespace checks pass locally. The ordinary test run passed 490 tests in 30 files; 216 database-dependent cases were intentionally skipped locally and require CI integration results. Dependency audit passed the existing High/Critical gate; it reported 13 Moderate development-tool dependency findings. Existing regressions cover setup concurrency, external initialization, timeout cleanup and MFA recovery sign-in. The complete Required release checks workflow must pass before merge; the merged commit and annotated release tag receive their own verification before artifact publication.

Additional CodeQL review: alert #7 points to unchanged SHA-256 preprocessing of long legacy sysPass passwords immediately before bcrypt.compare; this intermediate value is never stored or returned. New hashes use Argon2id and successful legacy sign-in upgrades them. Independent PHP compatibility vectors verify the required legacy behavior. The owner explicitly approved classifying exactly alert #7 as a false positive, and that classification is recorded in GitHub. No scanner rules, authentication implementation or severity thresholds were changed.

The full PR gate passed in workflow 41455570046: all 50 integration-enabled test files and 49 browser cases passed, along with coverage, database compatibility, security, container and authenticated application scans. The PR merged as 4b95f481862d2f5046815b7d5c3c41db38dce2d6. Exact main-commit and subsequent tag-run verification are required before publication.