v0.2.0-beta.11

What's Changed

• docs: accuracy sweep across public + internal documentation by @kungfuk3nnyyy in #839
• docs: improve GitHub + Marketplace/OpenVSX README listings by @kungfuk3nnyyy in #840
• docs: fix Marketplace image 404s + polish plugin/screenshots READMEs by @kungfuk3nnyyy in #841
• feat(recipes): surface recipe diagnosis in CLI, bridge + dashboard by @kungfuk3nnyyy in #843
• fix(recipes): don't echo error message in /recipes/doctor 404 (js/stack-trace-exposure) by @kungfuk3nnyyy in #844
• feat(connectors): Wave 4 — 13 new connectors + dashboard surface by @kungfuk3nnyyy in #845
• feat(dashboard): surface recipe Doctor from list + failed-run views by @kungfuk3nnyyy in #846
• chore(release): sync main to v0.2.0-beta.10 by @kungfuk3nnyyy in #847
• fix: critical + high-severity findings from codebase audit by @kungfuk3nnyyy in #848
• fix: medium-severity findings from codebase audit (stacked on #848) by @kungfuk3nnyyy in #849
• feat: DX quick-wins batch (CLI dispatch, connector parity, doctor, OTel, searchTools) by @kungfuk3nnyyy in #851
• feat(cli): add 'patchwork connect' connector auth front-door by @kungfuk3nnyyy in #852
• feat(recipes): Tier-1 connector-step backfill (twilio/sendgrid/resend/vercel/airtable) by @kungfuk3nnyyy in #853
• feat(recipes): Tier-2 connector-step backfill (todoist/shopify/circleci/posthog/grafana/pipedrive) — stacked on #853 by @kungfuk3nnyyy in #854
• feat(recipes): Tier-3 connector-step backfill (caldiy/cloudflare/figma/obsidian/paystack/supabase/webflow/woocommerce) — stacked on #854 by @kungfuk3nnyyy in #855
• feat(recipes): Tier-4 connector-step backfill (postgres/redis/elasticsearch/snowflake DB query-runners) by @kungfuk3nnyyy in #856
• ci: fix recurring Docker-smoke flake (drop dockerfile syntax frontend + retry) by @kungfuk3nnyyy in #857
• feat(recipes): Tier-5 connector-step backfill (salesforce/monday/google-docs) — campaign at 45/46 by @kungfuk3nnyyy in #858
• feat(recipes): judge→refine loop — opt-in self-correction (the AI-native moat) by @kungfuk3nnyyy in #859
• feat(recipes): flagship incident-to-pr recipe (judge→refine + approval gate) by @kungfuk3nnyyy in #860
• feat(recipes): cost-routing Phase 0 — fix the budget's dropped + mis-attributed data by @kungfuk3nnyyy in #861
• feat(recipes): cost-routing Phase 0 pt2 — surface budget warnings + dedupe agent-step schema by @kungfuk3nnyyy in #862
• feat(recipes): cost-routing Phase 1 — API drivers report tokens by @kungfuk3nnyyy in #863
• feat(recipes): cost-routing Phase 2 — static model price table (dormant) by @kungfuk3nnyyy in #864
• feat(recipes): cost-routing Phase 3 — budget.usdMax enforcement by @kungfuk3nnyyy in #865
• feat(recipes): cost-routing Phase 4 — opt-in per-step downshift routing by @kungfuk3nnyyy in #866
• feat(recipes): cost-routing — opt-in estimateUnmeasured (≈$ for subscription drivers) by @kungfuk3nnyyy in #867
• fix(security): patch 6 HIGH-severity findings from 2026-06-03 audit by @kungfuk3nnyyy in #868
• fix(recipes,automation): patch 5 HIGH-severity logic findings from 2026-06-03 audit by @kungfuk3nnyyy in #871
• test(connectors): registry ⇄ dashboard CATALOG parity ratchet (#850) by @kungfuk3nnyyy in #872
• fix(connectors,oauth): connector security hardening — 2 MEDIUM audit findings by @kungfuk3nnyyy in #873
• fix(recipes): recipe parse/validation hardening — 2 MEDIUM audit findings by @kungfuk3nnyyy in #874
• fix(recipes): judge→refine — a failed re-judge must not corrupt the verdict (#17) by @kungfuk3nnyyy in #875
• fix(approvals): audit-log approvals too, not just rejections (MEDIUM #27) by @kungfuk3nnyyy in #876
• fix(approvals): SSRF guard resolves ALL DNS addresses, not just the first (MEDIUM #26) by @kungfuk3nnyyy in #877
• fix(connectors): native token backend is keychain-only, not a silent auto (MEDIUM #21) by @kungfuk3nnyyy in #878
• fix(deps): vitest 3→4 — patch 2 critical CVEs (GHSA-5xrq-8626-4rwp) by @kungfuk3nnyyy in #879
• fix(drivers): cap output by UTF-8 bytes, not UTF-16 units (MEDIUM #30 / #57) by @kungfuk3nnyyy in #880
• docs(dashboard): grounded facelift plan v2 from live UI inspection by @kungfuk3nnyyy in #881
• style(dashboard): facelift PR 1 — color-token grammar + orange reservation by @kungfuk3nnyyy in #882
• fix(dashboard): facelift PR 2 — runs-page render fixes + attention-band severity by @kungfuk3nnyyy in #883
• feat(dashboard): facelift PR 3 — overview sparkline labels + recipe-aside fallbacks by @kungfuk3nnyyy in #884
• feat(dashboard): label the Traces waterfall bars + type-color legend by @kungfuk3nnyyy in #885
• feat(dashboard): theme redesign PR 1 — token foundation + AA bg-under-text fixes by @kungfuk3nnyyy in #886
• feat(dashboard): theme redesign — standalone-text + tag-chip AA sweep (AP-01) by @kungfuk3nnyyy in #888
• feat(dashboard): theme redesign — decoration quieting (AP-03 / AP-04) by @kungfuk3nnyyy in #887
• feat(dashboard): theme redesign — dark structural parity + focus rings (AP-08 / AP-09) by @kungfuk3nnyyy in #889
• docs(contributing): add AI-agent contribution policy by @kungfuk3nnyyy in #892
• feat(dashboard): remove card hover-glow + hero quilt more visible + dark toggle/featured fixes by @kungfuk3nnyyy in #893
• feat(dashboard): theme redesign — prose labels in sans, not mono (AP-07) by @kungfuk3nnyyy in #894
• test: stop the recurring Windows bridge-suite CI flake by @kungfuk3nnyyy in #895
• feat(grok): Grok Build (Grok CLI) onboarding + shim footgun fixes by @kungfuk3nnyyy in #896
• feat(init): detect Grok Build (Grok CLI) + surface MCP-client onboarding by @kungfuk3nnyyy in #897
• feat(approval): signal pending-approval to agentic MCP clients (progress notification) by @kungfuk3nnyyy in #898
• fix(marketplace): default-deny install-confirm gate + browse diagnostics by @kungfuk3nnyyy in #899
• fix(security): enforce repo allowlist on CLI recipe install path by @kungfuk3nnyyy in #900
• fix(bridge): add AbortController timeout to /templates registry fetch by @kungfuk3nnyyy in #901
• fix(dashboard): install-path robustness — content-type mirror, empty-token guard, bundle probe timeout by @kungfuk3nnyyy in #902
• fix(recipes): http.post SSRF hardening — canonical guard + allowPrivate kill-flag by @kungfuk3nnyyy in #903
• fix(marketplace): submit-time trust integrity — no-bypass syntax gate + trust-consistency warnings by @kungfuk3nnyyy in #904
• fix(marketplace): warn when registry trust metadata diverges from recipe YAML risk (S3) by @kungfuk3nnyyy in #905
• fix(recipes): registry/install hardening — entry sanitization + post-redirect SSRF re-check (B3-A) by @kungfuk3nnyyy in #906
• fix(dashboard): registry resilience — sanitize trust fields + GITHUB_TOKEN auth by @kungfuk3nnyyy in #907
• fix(dashboard): per-session rate limit on the recipe-install proxy (B3-C) by @kungfuk3nnyyy in #908
• fix(recipes): Gemini API spend no longer fails open against usdMax by @kungfuk3nnyyy in #909
• fix(recipes): recipe-validation parity — root-vars, reserved-case, driver-key, dup-id, schema vars by @kungfuk3nnyyy in #910
• fix(recipes): connector preflight coverage + CI ratchet by @kungfuk3nnyyy in #911
• fix(recipes): harden judge→refine loop + Anthropic API caller (R4) by @kungfuk3nnyyy in #912
• fix(recipes): unify chained runner with flat runner on budget + cost (S1) by @kungfuk3nnyyy in #913
• fix(recipes): never send type:env secrets to the LLM verbatim by @kungfuk3nnyyy in #914
• fix(recipes): standardize connector-tool error normalization by @kungfuk3nnyyy in #915
• feat(recipes): What-If Preview — static recipe simulation (recipe simulate) by @kungfuk3nnyyy in #916
• feat(recipes): persist per-step agent token usage + run cost totals (P1) by @kungfuk3nnyyy in #917
• feat(recipes): What-If Preview HTTP route + JSON schema (GET /recipes/:name/simulate) by @kungfuk3nnyyy in #918
• feat(dashboard): What-If Preview panel + Run-Now pre-run risk gate by @kungfuk3nnyyy in #919
• feat(recipes): What-If Preview P2 — trace-seeded mocked sandbox (chained, zero-IO) by @kungfuk3nnyyy in #920
• feat(recipes): What-If Preview P3 — history-backed cost projection by @kungfuk3nnyyy in #921
• fix(dashboard): no-store on the What-If Preview fetch by @kungfuk3nnyyy in #922
• feat(dashboard): surface mocked fidelity + cost band + per-branch outcomes in What-If Preview by @kungfuk3nnyyy in #923
• test(shim): fix leaked-mock-server EADDRINUSE flake (shim-reconnect + shim-backoff) by @kungfuk3nnyyy in #924
• chore: add audit-followup issue form (closes #869) by @kungfuk3nnyyy in #926
• fix(security): clear open CodeQL alerts (stack-trace exposure + ReDoS FP) by @kungfuk3nnyyy in #925
• chore(release): v0.2.0-beta.11 by @kungfuk3nnyyy in #927

Full Changelog: v0.2.0-beta.9...v0.2.0-beta.11