v0.6.28 — Provider diagnostics, metadata hardening, keychain fix

v0.6.28

Provider diagnostics, metadata hardening, and the keychain readGenericPassword signature fix.

New Features

• Provider diagnostics backend, UI, and metadata validation (PR #14) — safe host counters, last-error redaction, parser/runtime health derivation, likely-cause classification, diagnostics panel on provider detail pages.
• Provider metric classifications with evidence-backed docs and CI-enforced metadata validation (default mode).

Bug Fixes

• Keychain readGenericPassword signature fix — Copilot, Cursor, Claude, Codex, and Factory plugins were broken on every launch with TypeError: Error calling function with 1 argument(s) while 2 where expected. Host binding now uses Opt<String> for the optional account parameter. Live-verified: Copilot and Cursor now reach the keychain and succeed with HTTP 200.
• Detect parser failure when any Error line exists (not just single-line outputs).
• Use token-boundary matching for auth keyword detection in diagnostics.
• Gate ManifestMismatch on required-metric misses only (not optional/planDependent).
• Derive providerLoaded from runtime data instead of hardcoding true.
• URL/path redaction regexes no longer require trailing quote (prevents leaks).
• Hardened keychain auth-read diagnostics to only count credential-bearing reads.
• Early return in validateRelativeFile after unsafe path error (no duplicate error).

Chores

• Bump version to 0.6.28.
• Add provider health documentation.
• Add v0.6.28 release readiness report.
• Split validate-provider-metadata.mjs into rules + validator (under 400 LOC each).
• Add contract test for readGenericPassword 1-arg calling pattern (regression guard).
• Document keychain API signatures in docs/plugins/schema.md.

Known Limitations

• Perplexity Agentic Research metric remains intentionally unclassified (no evidence); strict-mode validator fails by design until evidence is gathered. v0.7 follow-up.
• writeGenericPassword service-only writes fail on macOS 27 where security add-generic-password now requires -a account. Pre-existing issue unmasked by the keychain read fix; Copilot probe succeeds via gh CLI fallback. macOS 27 compatibility follow-up.

Install

Download PulseUsage_0.6.28_aarch64.dmg (Apple Silicon / arm64). Open the DMG and drag PulseUsage to Applications. The app is unsigned — right-click → Open on first launch to bypass Gatekeeper.

Verification

• 1,226 tests pass (1,099 JS + 120 Rust + 7 validator)
• CI green on merge commit and version bump
• DMG SHA256: 326da0423b25578236fd35abd5ed8f33ee0d3d22851039856e9c2184ed97e0ec