v0.4.0

Changelog

• 73a38b80bda7c42ebb81e3b9d3d692e5e189844f: feat(dashboard): surface demo mode on the scan payload (@alexverify)
• 75cfa37a2f6fb9fbe97716ae5360f72a032fb12a: feat(dashboard): in-memory demo dataset behind the Deps seam (@alexverify)
• 5593f8a6482458bf4eaeb011c82b5df3f4baa9e9: feat(cli): EYEBROW_DEMO serves the dashboard demo dataset (@alexverify)
• 6e969717b12735750b5814168ac95633e5ce440f: feat(dashboard): demo-data badge when EYEBROW_DEMO is active (@alexverify)
• eb333a1ed4f6e9928688795cccf31813ec8da898: fix(dashboard): demo fleet coherence, clone-on-write mutations, demo-mode chip (@alexverify)
• bec3efa9b22e4d6298a412fef2336177a1458102: feat(toolsurface): canonical digest of an MCP server's advertised tools (@alexverify)
• 0faa30149538767793beebd85120f1a808e819e2: feat(toolsurface): tool_surface audit kind and per-server change detection (@alexverify)
• 2e9296e138ce68eadef19fc4b24d36b084d8f917: feat(jsonrpc): track tools/list completions with their result bytes (@alexverify)
• b57e67d3fbbfdad48e0a8db47dcf84694b827d58: feat(shim): audit the advertised tool surface from tools/list (@alexverify)
• baf7781dc7093baf9be511958c5747bc40cb7b38: feat(cli): surface tool_surface events and changes in eyebrow audit (@alexverify)
• d18313d8813c5c34cc43b38b17227e557265d82e: feat(dashboard): join the runtime tool surface into the scan view (@alexverify)
• 159d57c95ba8ad9f7551b366bb58a8c71cbaec34: feat(dashboard): advertised-tools drawer section with change banner (@alexverify)
• e315198124df4d4e57c3b27c292aa436bb181c01: feat(fleet): carry and aggregate the per-machine sleeper verdict (@alexverify)
• 65c301293d18be975cb205e1567946427544afc4: feat(alert): critical fleet alert when an artifact wakes as a sleeper (@alexverify)
• 44b26bf684feefa27a4e4273e7a3b65211e82654: feat(fleet): compute the sleeper verdict from the local audit log at snapshot time (@alexverify)
• 5a086ad25eaf4ec13a633e4eafddc0a9970e67bc: small improvements on the dashboard (@alexverify)
• 64474534ad7c9834907baeb9f4294021c0c66ecf: feat(fleet): mark woken sleepers in the fleet report (@alexverify)
• 1db89a3d94fcba2d86aa7219ee68d4f4a04647f0: add links to X/Website (@alexverify)
• e1a2801822fa9c2b7430debc3547a6feb9ec8e97: feat(fleet): name the sleeper in a blast-radius gate failure (@alexverify)
• f5096e2c5095ca06dad38babd0dcfb9625b0fa07: feat(fleet): mark the machines a sleeper woke on in the heatmap (@alexverify)
• bd39502f8db1e2ebc90bb09c6cc7de8b9f5724bf: refactor(discover): split MCP artifact assembly from config parsing (@alexverify)
• e22d781dd6d32712f2d77306ce401d7a9abcd2bc: feat(discover): discover VS Code MCP servers (@alexverify)
• 6a2719f893bc1fad4e965aeaa852c4fe1a1bf7e3: feat(discover): discover Zed context servers (@alexverify)
• 9a204bbfe7543384bafa7cb3e02636eca1f1ef17: feat(discover): discover Kiro MCP servers and steering files (@alexverify)
• 5022be13eabf5e3834877b1828ebf2dc8d9201d0: fix(dashboard): display names for VS Code, Zed, Kiro, and Claude Desktop (@alexverify)
• cf3cc97e4719bc4a1b00f3eddbdfc210a7153489: ci: install shellcheck on the macOS runner (@alexverify)
• c9352d62bf65984e41a338e36e55f8460e9e8dd6: fix(dashboard): clear npm audit vulnerabilities via lockfile updates and overrides (@alexverify)