v4.22.0

4.22.0 (2026-06-22)

Features

• catalog: add IT Glue Printing Press spec (#2063) (48ec8d0)
• catalog: add OpenRouteService under new maps category (#1513) (43c90ba)
• catalog: add Plane project-management catalog entry (#2598) (91245f6)
• catalog: add region language metadata (#2311) (205c0ac)
• catalog: add tidycal (#2565) (683d849)
• ci: mirror supply-chain hardening from printing-press-library (#1619) (f671b7b)
• ci: surface unresolved review threads as a status check (786848e)
• ci: surface unresolved review threads as a status check (21ae8a5)
• cli: add --auth-preference flag for catalog-driven scheme selection (#865) (34ca814)
• cli: add tools-manifest emit subcommand for retroactive regen (da57a75)
• cli: add auth set-token escape hatch for cookie-auth CLIs (#1641) (275646a)
• cli: add BLE device-sniff and device-spec CLI generation (#2601) (4e0e8f8)
• cli: add cliutil.LooksLikeJWT shared validator with length floor (#1602) (b5b1dd5)
• cli: add ElevenLabs generation support (#1307) (5f43de5)
• cli: add MCP generate overrides (#2245) (d522d5f)
• cli: add OAuth device-code auth generation (#2171) (15739cc)
• cli: add oauth2_refresh auth type (#2355) (29b9f88)
• cli: add per-endpoint role gates (#2314) (a255eb1)
• cli: add Quo (formerly OpenPhone) catalog entry and OpenAPI spec (#1597) (1a24381)
• cli: add Supercut Platform catalog entry (#1731) (52c4afc)
• cli: add sync --path-context KEY=VAL runtime override for template placeholders (#1631) (766354e)
• cli: add sync freshness hints to generated CLIs (#1819) (5f6b1cf)
• cli: add sync-param-drop gate against browser-sniff capture (#1644) (c94e190)
• cli: add tools-manifest emit subcommand for retroactive regen (dd85983)
• cli: add WebSocket streaming sync scaffold (#2244) (f20cbad)
• cli: add x-path-template-env-vars spec extension (#1401) (f83bd31)
• cli: catalog auth_env_vars declares canonical credential env vars (#1508) (fe4a5ec)
• cli: creator + contributors attribution model (#2432) (d7bf1bf)
• cli: default mcp.transport=[stdio, http] for small APIs (#1629) (14bc18a)
• cli: detect Auth0 SPA in-memory auth + emit CDP extractor (#1645) (015478b)
• cli: emit .printing-press-patches.json on every generate (#1590) (c3e1b87)
• cli: emit cliutil.ParseDurationLoose for day/week duration flags (#1953) (e35c466)
• cli: emit cliutil.ParseODataDate for OData v3 /Date(ms)/ literals (#1954) (476028b)
• cli: emit fetchFull<X> companion for GET-embedded paged sub-resources (#1301) (900b335)
• cli: emit novel feature command stubs (#2302) (2bb2c4a)
• cli: expose PRINTING_PRESS_DOGFOOD env signal for long-running commands (#1493) (96fca08)
• cli: flag empty defaultSyncResources at dogfood time (#1633) (042a78d)
• cli: generator-wide self-learning CLI loop (#2085) (23b6239)
• cli: GraphQL credential probe in doctor + actionable copy (#1701) (b534884)
• cli: hook agentcookie secrets bus into the generator (#1972) (8bae9aa)
• cli: implement CDP WebSocket eval for cookie extraction (#1869) (b0a9ee4)
• cli: press-auth companion for cookie capture + generated CLI integration (#1466) (89816d4)
• cli: refuse --force when novel features detected (#1880) (3b47cbf)
• cli: rename generator binary to cli-printing-press (#1722) (7c4bedd)
• cli: surface per-endpoint evidence and confidence from browser-sniff (#1397) (f32214e)
• cli: sync-param-drop resolves helper-function key enrichment (#1881) (9beda0d)
• installer: add repo bootstrap script (#2044) (a1b96ff)
• skills: add /printing-press-amend skill � dogfood + direct-input modes (#1490) (c31632b)
• skills: add currency-version floor that hard-blocks generation on stale binaries (#2567) (ef0ec66)
• skills: add oauth grant reachability probe (#2148) (1fa5614)
• skills: add raw docs fetch helper (#2295) (f67ad83)
• skills: capture reachability 4xx body hints (#2150) (9d72564)
• skills: check public library for existing CLI before generating (#1650) (81f07e5)
• skills: contain session-state.json outside DISCOVERY_DIR (#1425) (55b0f16)
• skills: offer reprint spec enrichment before handoff (#2154) (163e4bc)
• skills: TASK-12 - add local-source go install step so import implies installed (tool-catalog 5.1) (07c21c8)

Bug Fixes

• catalog: require catalog PR justification (#2093) (bc3c5ee)
• ci: add generated output compile gate (#2319) (fc04a3e)
• ci: address Greptile review on conversation-resolution check (f55f57a)
• ci: allow queue drafts to skip Greptile (96bc822)
• ci: bump Go to 1.26.4 to clear GO-2026-5037 / GO-2026-5039 stdlib advisories (#2612) (a4fcff7)
• ci: cancel-in-progress=false so cancelled check_runs don't pile up (906928d)
• ci: cancel-in-progress=false so cancelled check_runs don't pile up (80ba507)
• ci: clarify review feedback gates (#2146) (eb4decb)
• ci: close jq if-then-else with end so >10-thread path doesn't crash (f7365c2)
• ci: collapse Mergify two-step CI to enable in-place mode (#1336) (5ac1de7)
• ci: conversation-resolution check race + duplicate check_run (264617a)
• ci: conversation-resolution check race + duplicate check_run (162d9a3)
• ci: let code-owner authors satisfy review gate (#1968) (de2654f)
• ci: move conversation resolution signal to commit status (#1882) (838d409)
• ci: require all review threads resolved before queue + merge (a8fa80a)
• ci: scope settle delay to synchronize, strip head_sha from PATCH (5b8a814)
• ci: switch queue update_method to merge so fork PRs can queue (#1492) (2d0ad5a)
• ci: trust queued Greptile gate (9a47433)
• ci: use job exit-code instead of POST/PATCH for check_run state (9433241)
• cli: accept accounted phase5 skips in gate (#2232) (1771a27)
• cli: accept LAN-only phase5 skips (#2264) (d55da88)
• cli: accept nested internal body schemas (#2161) (08eaf12)
• cli: accept root mcp in OpenAPI parser (#1777) (4cea5a1)
• cli: accept Windows staged live-check binaries (#2250) (9783acd)
• cli: add data-source strategy contract (#2174) (552e5e8)
• cli: add editable store migration extras hook (#2172) (79c0c6f)
• cli: add OAuth scope coverage dogfood check (#1809) (ceafd83)
• cli: add verifier happy args annotations (#1841) (340d5a0)
• cli: advance has-more numeric pagination (#2107) (c640b50)
• cli: align MCP remote transport scoring threshold (#1979) (d0cb79a)
• cli: align MCP tool design scoring threshold (#1927) (438ecaf)
• cli: align publish-skill contract tests with api-slug staged path (#1459) (c57345a)
• cli: allow dogfood error path opt-outs (#1839) (c3a3313)
• cli: allow first force generation without go.mod snapshot (#1723) (aa12f66)
• cli: allow reserved PII placeholders (#2159) (deeeb71)
• cli: allowlist reserved synthetic values and GitHub IDs in PII scanner (#2165) (77b5a16), closes #1589 #1343 #1477
• cli: always emit boolean body fields, no zero-guard (#1494) (9d3050b)
• cli: always emit RequestBaseURL() so novel commands keep BasePath (#2520) (6db6972)
• cli: annotate help-only parent-grouper commands mcp:read-only (#2158) (e594d2c)
• cli: apply Bearer prefix in composed and cookie AuthHeader paths (#1500) (ca4898a)
• cli: apply research canonical auth env vars (#2298) (6ee70c9)
• cli: apply store SQLite pragmas via modernc _pragma= DSN syntax (#2399) (d8b6b5f)
• cli: archive merged spec for multi-spec generate runs (#1432) (44f1ff7)
• cli: ASCII-fold in CamelIdentifier so non-ASCII names don't corrupt identifiers (#2555) (0c18120)
• cli: auto-apply large MCP orchestration default (#2365) (0c7a263)
• cli: backfill publish printer attribution (#2233) (dc19c7c)
• cli: bound remote spec fetch with a timeout and size cap (#2558) (443d9ae)
• cli: broaden scoreTerminalUX TTY detection beyond isatty literal (#1786) (aa5a0af), closes #1561
• cli: broaden write-through cache envelope keys to match sync (#1919) (98f47a5)
• cli: bump emitted go directive to 1.26.4 (#2627) (a21d796)
• cli: bump golang.org/x/net template pin past GO-2026-5026 (#1868) (9724312), closes #1865
• cli: bypass response cache when polling async jobs (#1429) (acbb3df)
• cli: cap body-flag recursion depth to prevent compiler OOM (#1522) (82ad787)
• cli: cap wide generated store tables (#2086) (dd388bb)
• cli: catch zero-row mock syncs (#2135) (b498612)
• cli: chomp trailing newline from auth setup instructions (#1947) (f878265)
• cli: choose freshest live-check binary (#1759) (0251e59)
• cli: clarify live dogfood output truncation (#1937) (5c9e246)
• cli: classify captcha prechecks as auth context (#1747) (11e9843)
• cli: clear every emitted credential field in ClearTokens (#1433) (2bf7d1e)
• cli: close ResolveByName json_extract injection + dedupe cacheKey AuthHeader call (#1278) (e21feae)
• cli: coerce number-typed --limit param to int (#1370) (80f5bc6), closes #1082
• cli: consume x-tenant-env-var so per-tenant sync paths ship populated (#1368) (51b758c)
• cli: correct live-check and helper emission (#1637) (8c95570)
• cli: count helper-backed workflow client calls (#2076) (861be98)
• cli: count parent-grouper scorecard commands (#2176) (4c42770)
• cli: count store helper workflows (#2010) (d78535a)
• cli: create llm prompt temp files privately (#1674) (c5d8682)
• cli: credit cookie auth in scorecard (#1787) (b7481c0)
• cli: credit positional type fidelity (#2178) (2e4aded)
• cli: default generated sync max-pages to unlimited (#2151) (9b30c01)
• cli: default sync concurrency by rate class (#1938) (6d1ef4a)
• cli: denylist reserved global flag names in generated CLIs (#15) (261de8c)
• cli: derive BaseURL from spec source URL for relative-only servers (#2175) (c0e5b4a), closes #1383
• cli: derive doctor auth.verify_path from me-shaped endpoint (#1431) (95f0350), closes #1161
• cli: derive doctor probe path from auth.verify_path or me-shaped endpoint (#1406) (d022660), closes #1118
• cli: derive header sibling auth env vars (#2254) (5488950)
• cli: derive MCPBinary from api_name slug not spec title (#2149) (140b418), closes #1473
• cli: derive multispec resource names from titles (#1792) (428c720)
• cli: derive version-command binary name from cmd.Root().Name() (#1913) (729027c), closes #1585
• cli: descend --select into list-envelope responses (#1379) (3bcb9d9), closes #1143
• cli: detect cross-cutting novel features in dogfood scorer (#1364) (a601038)
• cli: detect integer page paginator and advance numerically in sync (#1519) (0c3c8bc)
• cli: detect Mailchimp/Linear/Anthropic key shapes in secret scanner (#2162) (6e6fc29), closes #1593
• cli: detect partial-failure response shape in :mutate handlers, add --allow-partial-failure flag (#1360) (875d64e)
• cli: detect path params in browser-sniff URL grouper (#1657) (2c3271f)
• cli: detect plural wrapper list envelopes (#2078) (2998977)
• cli: detect turnstile reachability interstitials (#2341) (0f8083f)
• cli: detect unsafe chrome impersonation (#2253) (91cd511)
• cli: distinguish verify-skill prose invocations (#1906) (d328375)
• cli: doctor preserves configured User-Agent when API uses UA as auth credential (#1361) (3bb6d37)
• cli: dogfood prefers bundled <dir>/spec.yaml over caller --spec (#1625) (17cd277)
• cli: drive browser-sniff http_transport from HAR HTTP-version distribution (#1540) (833213f)
• cli: drop // PATCH marker instruction from generated AGENTS.md (caa6880)
• cli: drop dead invocation path from promoted-command Long (#1912) (f434e2b), closes #1697
• cli: drop journal_mode from read-only store DSN (#2407) (4bf1659)
• cli: drop MCP code-orch handler pre-marshal that base64-encoded mutating bodies (#1521) (ff56237)
• cli: drop MCP handler pre-marshal that base64-encoded mutating bodies (#1357) (1fc5f62)
• cli: drop shell line comments + skip happy_path on missing file fixtures (#1378) (295fd03)
• cli: drop unused client import from param-less endpoint command files (#911) (72adfef)
• cli: emit cache stale-after as a direct duration expression (#1951) (501964c)
• cli: emit CSV parse helpers for response specs (#2358) (0ba4bf5)
• cli: emit extractResponseData helper only for envelope-shaped responses (#2257) (591d9e7), closes #1345
• cli: emit GraphQL-aware import for GraphQL specs, not REST POST (#2618) (7ba6fb0)
• cli: emit happy args annotations (#2359) (7074a42)
• cli: emit recipe-backed MCP intent tools (#1916) (3d050f9)
• cli: emit structured cache_warning JSON on auto-refresh failure (#1632) (187b699)
• cli: emit structured JSON error from parents invoked without a subcommand in --agent mode (#1373) (fb9125e)
• cli: emit valid JSON for sync_warning events (#2643) (dec1fc9)
• cli: emit WithNumber/WithBoolean for OpenAPI-parsed numeric MCP params (#1372) (1f1b0bd)
• cli: exclude hidden MCP endpoint mirrors from description gates (#1826) (c60982d)
• cli: exclude scalar-array and sampler endpoints from sync selection (#2549) (54ecd9e)
• cli: exempt sentinel parent groupers from tools audit (#1935) (2308b1a)
• cli: exempt vendor OpenAPI/Swagger source under .manuscripts from PII scan (#1496) (dc0651a)
• cli: expand pm_stale timestamp-field list for non-updated_at APIs (#1461) (55f5b26)
• cli: extend verify-skill recipe scan to README.md (#1430) (73fe567)
• cli: fall back synthetic anchors to local lists (#2079) (d057ef0)
• cli: filter auth login --chrome cookies by spec auth.cookies allowlist (#1518) (9541740)
• cli: filter raw HARs from publishable manuscripts (#2525) (a5f6e70)
• cli: filter telemetry hosts from browser sniff (#1766) (3a7636b)
• cli: flatten nested allOf body schemas (#1761) (7bf0698)
• cli: follow one-hop client helpers in reimplementation check (#2048) (bb830d0)
• cli: force sync concurrency=1 under PRINTING_PRESS_VERIFY to avoid SQLITE_BUSY (#1441) (b8b1b6a)
• cli: format CSV float64 cells without scientific notation (#1905) (dd1ee72)
• cli: gate ship plans on agent readiness (#1638) (ed17d30)
• cli: gofmt Go source after publish-time module-path rewrite (#2405) (6183f1b)
• cli: guard client flag in MCP shellouts (#2003) (60d7916)
• cli: guard empty PROXY_ARGS expansion under bash 3.2 (#2439) (ad28280), closes #2438
• cli: guard template prose interpolation (#2351) (1419384)
• cli: handle binary-only response endpoints (Accept + base64 envelope) (#1574) (d817807)
• cli: handle reserved search resources (#2360) (ef0cd96)
• cli: handle setlist retro generator gaps (#1744) (da72283)
• cli: handle single-quoted args in validate-narrative shell tokenizer (#1424) (33a6668), closes #1159
• cli: harden browser-sniff PII placeholders (#1639) (7eee7df)
• cli: harden manifest-gen remote spec loader against hangs and silent truncation (#1699) (aecf495)
• cli: harden sniffed auth inference (#2096) (6f20d3d)
• cli: hold rate-limiter lock through lastRequest reservation (#1907) (617c894), closes #1669
• cli: honor absolute endpoint paths (#2117) (99f6625)
• cli: honor docs batch filter flags client-side (#2352) (6182abf)
• cli: honor explicit "mcp:read-only": "false" in tools-audit (#1485) (ede5c35), closes #891
• cli: honor HTML extraction in sync (#1793) (475a641)
• cli: ignore scalar siblings in sync envelope fallback (#2532) (2f9fb81)
• cli: ignore shell operators in verify-skill positionals (#2095) (5acaa2a)
• cli: improve generated parent command shorts (#1805) (231b957)
• cli: improve generated parent grouper shorts (#1794) (f0f928c)
• cli: include auth flow env vars in mcpb manifests (#2106) (64c1b1a)
• cli: include manuscript narratives in PII polish scan (#2025) (8f94f89)
• cli: infer path-param resource id fields (#2134) (1a8d9c6)
• cli: infer sniffed response type stubs (#2164) (bebc256)
• cli: infer template vars from base URLs (#2002) (e72ae7a)
• cli: inject field selectors during sync (#1763) (93ef629)
• cli: isolate typed-table upsert failures with per-item SAVEPOINT (#1402) (89f38c4)
• cli: kebab-case resource names in README/SKILL command examples (#1948) (11bb0b5)
• cli: kebab-case SKILL.md and README endpoint examples (#1445) (bd4dc64), closes #1270
• cli: keep integer-typed time params numeric in examples (#1918) (97e5ec4)
• cli: keep sole query input param from global-param filter (#2241) (518b3eb), closes #982
• cli: let force regen preserve hand-authored files (#2077) (3ec8516)
• cli: live dogfood happy-path honors pp:happy-args (#2642) (d2ca5a2)
• cli: make agentcookie soft + stop publishing plans (#2333) (d0b7578)
• cli: make cookie-auth login --chrome work on Windows (#1404) (fdca9f7)
• cli: make live-dogfood runner enum-aware and resilient to empty outcomes (#1656) (cda9b43)
• cli: make scoreVision 10/10 reachable (#2163) (8208ab8), closes #1721
• cli: mask credentials in generated URL output (#1909) (964bda6)
• cli: match both singular and plural required-flag cobra outputs (#1413) (f5ea270)
• cli: merge compatible auth metadata across specs (#1811) (f183bd1)
• cli: merge spec date-time fields into stale timestamp allowlist (#1920) (1979823)
• cli: move extra_commands SKILL.md block to its own top-level section (#1524) (c10d0b5)
• cli: narrow pii-audit fixture scope (#2246) (b94ec3b)
• cli: normalize FastAPI operation ids (#1788) (a85a397)
• cli: normalize GraphQL sync since timestamps (#2136) (eeed86c)
• cli: normalize publish package metadata (#2523) (79c7c82)
• cli: normalize verify directories (#1994) (b6e7bcc)
• cli: only emit partial-failure helpers when spec has mutation endpoints (#1991) (b607511)
• cli: parse comment-led helper call files (#2524) (0cfc64b)
• cli: parse multiline GraphQL fields for promoted resources (#2367) (26edea9)
• cli: parse OpenAPI x-cache extension (#1995) (8ff3242)
• cli: pass context to async job no-cache polling (#2456) (1872817)
• cli: percent-encode path param values in replacePathParam (#1366) (77fce43)
• cli: pick gid/sid/uid before name in PK heuristic (#1465) (01c816d), closes #1394
• cli: pin golang.org/x/net to a patched version after generation (#2410) (470bd19)
• cli: polish press-auth output and make spec warnings testable (#1710) (61f919a)
• cli: populate dependent typed parent fks (#1760) (93fd8e6)
• cli: populate printer + run_id in generated .printing-press.json (#1442) (a1098f1)
• cli: preflight framework narrative flags (#1780) (0d03604)
• cli: preserve all-apiKey composed auth headers (#1828) (fa8e109)
• cli: preserve body/content payload on single-object compact path (#1509) (c7e1b82)
• cli: preserve colliding body params in MCP (#2127) (5474578)
• cli: preserve creator attribution on reprint (#2634) (4e261dc)
• cli: preserve dispatch param defaults in examples (#2346) (623200b)
• cli: preserve docs-derived request paths (#2124) (d3f7af5)
• cli: preserve force-regen provenance (#2118) (9adbf4d)
• cli: preserve generated auth source provenance (#2115) (062a3b3)
• cli: preserve generated catalog descriptions (#1730) (482192f)
• cli: preserve generated catalog display names (#1855) (a6d956e)
• cli: preserve live dogfood refresh credentials (#2638) (29aba15)
• cli: preserve module imports on force regen (#2531) (e3801c7)
• cli: preserve numeric sync resource ids (#2350) (8095b32)
• cli: preserve OpenAPI multi-query auth credentials (#2062) (212faad)
• cli: preserve OpenAPI param casing in detected pagination (#1460) (272d8e8), closes #1353
• cli: preserve required global query params (#1756) (99596b1)
• cli: preserve sync cursor on max-pages cap (#2543) (f7037d8)
• cli: preserve templated server URL schemes (#2114) (267d4f7)
• cli: preserve typed api error exit codes (#1894) (d25a8e3)
• cli: preserve typed tables for paginated union resources (#2540) (5b0efb8)
• cli: preserve windows exe names in mcpb bundles (#2097) (7d8e8ca)
• cli: print help on empty invocation of required-input commands (#2243) (0a469f3), closes #1289
• cli: probe nested path-param leaves so verify catches args[] index bugs (#1434) (5460c32)
• cli: promote global path template vars (#2366) (3824012)
• cli: promote global scope query params (#2356) (1ee18ed)
• cli: propagate --timeout to surf transport ResponseHeaderTimeout (#1212) (69cefbe)
• cli: propagate PRINTING_PRESS_VERIFY=1 to browser-session-proof probe (#1458) (dbfc611), closes #1389
• cli: query generic resources_fts from search empty-type branch (#1462) (35e515c), closes #1390
• cli: raise generated CLI default request timeout to 60s (#2157) (dba4b9e), closes #1626
• cli: re-inject lost registrations into their source function (#2559) (288b4a5)
• cli: rebuild FTS after rowid migration (#2542) (79c8acf)
• cli: recognize equivalent scorer capability shapes (#1896) (7d15e0e)
• cli: recognize literal-format composed auth in dogfood auth_check (#1993) (196dba3)
• cli: recognize local-datastore scorer shape (#2137) (2034e9c)
• cli: recognize slice/map/typed pflag variants in verify-skill flag scanner (#2222) (bf6a610), closes #1255
• cli: redact live-check output samples (#1997) (0dab481)
• cli: redact PII audit ledger cli dir (#1866) (56e8a37)
• cli: redact shipcheck api key in json (#1673) (4093ef3)
• cli: refresh auth on redirects via CheckRedirect (#1497) (f3f7043)
• cli: refresh stale staged binary before live-check (#1910) (6c681d0)
• cli: refuse publish package --dest overlay when mirror diverges from source (#1371) (1ff6853)
• cli: reject invalid enum flag values with the valid set (#2255) (4f8a53c), closes #1139
• cli: reject path traversal in replacePathParam (INC-2026-147) (691743f)
• cli: reject placeholder auth credentials (#1767) (93b2e1d)
• cli: reject placeholder URLs when inferring auth key URL (#2169) (e0edc96), closes #2011
• cli: render README narrative recipes (#1928) (67ba616)
• cli: render skill anti-triggers from research (#2306) (72ffcd7)
• cli: report malformed research json during publish (#2008) (9cd0c2b)
• cli: require documented flags in verify-skill (#1707) (595ed9e)
• cli: require explicit global scope flags (#2530) (6f5518f)
• cli: require quoted shell variables in skill bash blocks (#2004) (01afec0)
• cli: research-dir state.json api_name overrides info.title-derived name (#1476) (a9ffa08), closes #1375
• cli: resolve GraphQL custom root operation types (#2556) (b0b4147)
• cli: resolve shipcheck CLI binary name from .printing-press.json (#1700) (9eff1e2)
• cli: respect cobratree framework command depth (#1806) (c0e45d1)
• cli: respect live dogfood auth tiers (#2364) (d9d0157)
• cli: restore canonical prediction-goat learn loop (engine + schema + package + CLI) (#2200) (cc7e69c)
• cli: retry busy dogfood command execs (#1785) (fa6d2bb)
• cli: retry live dogfood auth 401s (#1996) (13f5d99)
• cli: return failure exit from verify json (#1693) (5261ae7)
• cli: reword UpsertBatch cache-index warning to not imply data loss (#2221) (b5267a8), closes #1224
• cli: route analytics output through cobra writer (#2113) (8e4e0ec)
• cli: route GraphQL reads around verify gate (#2105) (0ce8645)
• cli: route promoted-command file stem through safeResourceFileStem (#1489) (#1506) (bf7f346)
• cli: route Swagger 2.0 specs through openapi2conv to avoid OOM on circular refs (#1630) (e798f67)
• cli: route wrapper sync events off json stdout (#1981) (58a3c8d)
• cli: run publish govulncheck with module toolchain (#2238) (ee5e1be)
• cli: scope framework collision renames (#1778) (16a01ca)
• cli: scope HOME/XDG_CONFIG_HOME for verify/dogfood subprocesses (#1416) (c5a51ea)
• cli: scope traffic-analysis protection evidence (#2047) (e6292dd)
• cli: scope-aware sync --param dispatch with --global-param fallback (#1529) (4e304df)
• cli: score reachable scorer surfaces (#1764) (0c13b00)
• cli: seed narrative template env placeholders (#1758) (a18591a)
• cli: select OpenAPI auth by operation usage (#1816) (21dadbd)
• cli: send in:cookie security credential as cookie not header (#2239) (b0b19ce), closes #981
• cli: serialize DELETE request bodies (#1842) (25c503b)
• cli: set generation category for non-catalog runs (#1817) (730cd53)
• cli: shape-aware auth-status env var placeholders (#2242) (993a409), closes #1329
• cli: short-circuit oauth2 auth login under verify env (#2223) (0b6279a), closes #1059
• cli: short-circuit sync on dry-run sentinel response (#1471) (f8d3ba8)
• cli: skip auth-flow inputs as bearer tokens (#2247) (bfd4428)
• cli: skip auth-tagged resources in sync defaults (#1939) (f7e5424)
• cli: skip framework-auto-generated operationIds when deriving command names (#1367) (d697eb5)
• cli: skip JSON cache for binary responses (#1930) (d9a58fb)
• cli: skip live dogfood required-param fixture gaps (#2098) (31b5d2d)
• cli: skip promotion when body exceeds the flag-depth cap (#2258) (061aab8), closes #1520
• cli: skip unfixturable mutating dogfood examples (#2357) (e49f5f1)
• cli: skip unsynced local live-check samples (#2533) (50c4504)
• cli: stop gating promote on ASIN examples (#2522) (6bfd1be)
• cli: stop generated main.go from printing every error twice (#1411) (46ad86b)
• cli: store only basename for local spec_path in manifest (#2156) (4a92662), closes #1587
• cli: store synced_at as RFC3339 UTC so SQLite strftime works (#2173) (b01b62e), closes #1588
• cli: streamline oauth login setup (#2177) (7709698)
• cli: strip =value suffix from --flag=value tokens in verify-skill recipe parser (#2256) (72137f9), closes #1316
• cli: strip custom auth header on cross-host redirects (#1915) (2d339ba), closes #1672
• cli: strip embedded .git/ and .gitmodules in pipeline.CopyDir (#1358) (0f8dc98), closes #1304
• cli: strip root-level binaries from staged publish tree (#1449) (096411c)
• cli: stub missing local schema refs in lenient mode (#1827) (2f96ee9)
• cli: stub sync for HTML page-mode CLIs (#1911) (c8ff02c)
• cli: substitute server-URL variables from env vars at runtime (#1448) (e36050f), closes #1295
• cli: support $-prefixed pagination params for Socrata-style APIs (#1204) (3819b67)
• cli: support body wire-name overrides (#2075) (280b272)
• cli: support csv array body fields (#2160) (1f8d390)
• cli: support Entra client credentials generation (#2088) (076bf6a)
• cli: support GeoJSON FeatureCollection in sync extraction (#1831) (4d42e3f)
• cli: support id-walk sync for capped POST queries (#1847) (95d28c1)
• cli: support POST list sync and auth scoring (#1729) (b29d90a)
• cli: support query wire-name overrides (#2073) (73dc29b)
• cli: suppress phantom [] MCP/CLI parameters (#1952) (2922c86)
• cli: surface row errors in generated MCP sql tool (#2650) (2af370c)
• cli: surface unsafe paginated all truncation (#1727) (0c43075)
• cli: sync chained dependent resources (#2051) (abe5f8a)
• cli: sync narrative docs after dogfood (#1934) (db0017b)
• cli: sync narrative value props during dogfood (#2292) (1149c6c)
• cli: sync pagination, auth aliases, narrative timing, and codex prompt (#1341) (ac3e15b)
• cli: sync-param-drop gate detects named-map call argument (#1874) (e0ffa42)
• cli: synthesize Google Discovery API key auth (#2301) (0104716)
• cli: synthesize resource-aware MCP descriptions for summary-less operations (#2267) (474dbf4), closes #1315
• cli: synthesize undeclared path placeholders in OpenAPI parser (#1510) (bf9014d)
• cli: thread generated client context (#1769) (1119cda)
• cli: tighten phone-us PII regex to NANP-valid first digits (#1405) (1596497)
• cli: tighten scoreTypeFidelity flag-decl regex and drop MarkFlagRequired reward (#1795) (ef00173)
• cli: treat side-effect narrative skips as warnings (#2087) (16fc4ed)
• cli: treat stateless REST CLIs as a first-class shape in verify + scorecard (#13) (284ccad)
• cli: trim client credential env vars for auth login (#2537) (2742ef7)
• cli: unify digit-leading command identifiers (#2128) (8faa180)
• cli: unwrap nested data list envelopes (#2126) (1a9aec8)
• cli: use Chrome User-Agent for synthetic/cookie/composed/session_handshake CLIs (#1479) (d7ccd85), closes #1293
• cli: use FNV-1a hash for FTS rowid to avoid collisions (#1908) (258346b)
• cli: use narrative commands for generated examples (#1897) (2c7cbba)
• cli: use Windows executable names for MCPB companions (#1895) (09a8df5)
• cli: validate &&-chained narrative recipes segment-by-segment (#1447) (bb5e2de), closes #1271
• cli: validate-narrative splits piped recipes and strips redirects (#1517) (62838d0)
• cli: verify-mode HTTP-verb short-circuit + N1 envelope + doctor + read-only POST bypass (#1398) (75e4d1b)
• cli: warn on novel feature command depth drift (#2009) (8bcf5ae)
• cli: wire composed apiKey + bearer sibling headers through parser, templates, and MCP manifest (#1359) (2437cab), closes #1303
• cli: wire GraphQL query list variable (#2152) (c9e39d7)
• cli: wire http.CookieJar into composed-auth client template (#1992) (2342203)
• cli: write feedback.jsonl to XDG data dir (#1914) (709fe74), closes #1640
• cli: write mutation responses to local store (#1818) (8de833d)
• cli: writeThroughCache caches single-object responses keyed by non-id PKs (#1531) (c96ac5d)
• generator: preserve required bool flag presence (#1940) (5157252)
• generator: support JSON-LD script selectors (#1877) (58380bb)
• generator: support single-env basic auth credentials (#1381) (ac83f0f)
• import-rewrite: make go.mod module rewrite CRLF-safe (#6) (4cc56d2)
• mcp: correct code-orchestration write-body shapes (double-marshal, query/body split, bare-array) (#1662) (2bbccd6)
• patches: emit per-patch directory layout (generator + skills) (#2581) (a826d31)
• scorer: resolve binary at build/stage/bin/ before cliDir (#1150) (#1412) (2abbfec)
• skills: add gosec gate to polish diagnostics (#2300) (cc645eb)
• skills: add LAN reachability carve-out (#2290) (778192b)
• skills: add NULL-safe SQL scan guidance to Phase 3 store-query starter (bca9866)
• skills: add NULL-safe SQL scan guidance to Phase 3 store-query starter (7396d66)
• skills: canonicalize auth env var when slug-derived differs (#1428) (2988814), closes #1157
• skills: capture Request object browser-sniff bodies (#1745) (b0176d2)
• skills: clarify bearer-token auth enrichment (#2251) (81c8a29)
• skills: Clarify publish skill's PR review loop and terminal state (#1713) (6870329)
• skills: correct install-internal-skills.sh path to repo skills/ (#1342) (5a04aca), closes #869
• skills: detect truncated Go stdlib in preflight (#2294) (8c26a9e)
• skills: distinguish RunE missing input from help (#2046) (fce8cff)
• skills: document multi-positional RunE shape so partial args fail with exit 2 (#2272) (0d21ad3), closes #965
• skills: document patches index publish contract (#1980) (c0f33c6)
• skills: drive reprint via regen-merge to preserve hand-authored novels (#1872) (eb4ce29)
• skills: drop cli-skills mirror regen from publish flow (#1502) (f64e991)
• skills: emit PRINTING_PRESS_BIN marker so later phases survive PATH non-inheritance (#1399) (2698690)
• skills: escalate 200 challenge shells (#2340) (f2eaf74)
• skills: gate large MCP endpoint surfaces (#2231) (b395352)
• skills: hold sub-60 reprints on missing transcendence rows (#2236) (d0acb24)
• skills: honor PRINTING_PRESS_HOME in setup paths (#2023) (23cc0ce)
• skills: initialize transcendence collector slices with make([]T, 0) (#2268) (3132ea4), closes #1344
• skills: reprint discovers and carries prior patches (#1649) (f9bb82c)
• skills: require agent-browser post-install setup (#2022) (bef08f5)
• skills: require codex completion marker before treating delegation as success (#1523) (9963794)
• skills: require fresh publish turn after polish (#2104) (c1b03ed)
• skills: require verify-safe quickstart first step (#2021) (0f30aa5)
• skills: rerun live dogfood during publish (#2155) (d8f806e)
• skills: retro skill scrubs secrets and PII before posting issue bodies (#1595) (fef027f)
• skills: route polish data inserts through typed helpers (#2230) (a2f4659)
• skills: route polish instrumentation through client (#2168) (5929945)
• skills: route rebuilt-novel reprints through swap (#2527) (c7ff7f8)
• skills: split SQL example out of go-fenced block in NULL-safe scans guidance (63f745b)
• skills: stop phase 4.95 code review from being skipped (#1655) (5cb39a6)
• skills: surface novel-feature hand-code scope at Phase Gate 1.5 (#1501) (793d5b2)
• skills: update polish gosec fallback pin (#2529) (9548233)
• skills: use api-slug in publish Step 6 staged path (#1444) (ce3aeb4), closes #1233
• skills: warn on multi-spec directories (#2167) (93d43b5)
• tools-manifest: broaden spec resolution + lenient parser + docs guard (47e0b66)

Code Refactoring

• cli: collapse Recall *entities.Config into Opts.EntityConfig (#2189) (0c3f032)