v4.0.0

Plugin System (NEW)

• Late-stage plugin system with JSON wire protocol, crash isolation, and circuit breaker
• Sandbox plugin with Exec method for bakelens-sandbox integration
• Concurrent plugin evaluation with unified type system
• Pipeline hot path optimization for plugin evaluation
• Hardened plugin concurrency: validate action values, fix close/evaluate race, nil-slice JSON, distinguish
  parent-cancel from timeout

Security Hardening

• Self-protection: binary modification guards, process kill guards, exfiltration detection
• Privacy layer, self-protection hardening, e2e security tests, SSH fix
• Build-time integrity checks, fix crust:// scheme bypass
• Fuzz-found fixes: SSE buffer incomplete tool calls, selfprotect regex tilde bypass
• Eliminate all semgrep XSS and SAST findings at code level

DLP & Secret Detection

• Integrate gitleaks as in-process Go library (performance: no subprocess overhead)
• In-process DLP scan benchmark and panic recovery test

Rules Engine

• JSON Schema for YAML rule validation with build-time checks
• Split engine.go into compiler.go, unexport internal types
• Split extractor.go, add ruleSource validation
• Eliminate ambiguity in YAML rules and plugin protocol
• Replace last panic with graceful exit in DLP init

TUI & Observability

• Stats aggregation API + TUI stats tab

CI/CD

• Add semgrep SAST, rule-lint, benchmark job
• Add gitleaks secret scanning to security job
• Move govulncheck from pre-push to pre-commit stage
• Use install.sh for all Linux/macOS CI jobs
• Fix: install git in FreeBSD VM prepare step

Refactoring

• Extract schemacheck library, replace panics, harden CI
• Unify schema tests, embed schemas, add validation tests
• Extract sys_install() for cross-platform package management
• Cleanup inconsistencies, fix bugs, improve lifecycle management

Dependencies

• Bump github.com/nwaples/rardecode/v2 2.1.0 → 2.2.0
• Upgrade ulikunitz/xz v0.5.12 → v0.5.15 (GO-2025-3922)