What changed
- Harden public-release privacy validation for credential-like URL query parameters.
- Detect covered parameters in raw, HTML-escaped, and percent-encoded forms.
- Cover common token, secret, password, signature, and provider-signed URL parameter names without echoing their values.
- Preserve ordinary query parameters, similar non-credential names, and empty values.
Verification
- 47 automated tests passed.
- The executable synthetic demo passed.
- Public-release validation passed on the merged release commit.
- Clean consumer installation and CLI invocation passed.
- The npm dry run contained 33 intended files.
- The official Codex plugin validator and all six bundled Skill validators passed.
- GitHub Actions passed on Ubuntu/Node 18, Ubuntu/Node 22, Windows/Node 20, and macOS/Node 20.
This release adds no runtime dependencies, hosted services, telemetry, or automatic permission grants.
Full Changelog: v0.3.3...v0.3.4