v0.4.0 — DX Overhaul + Response Scrubbing

What's New

Security

• Proxy response scrubbing — prevents secret leakage in API responses by scanning outbound data
• Streaming overlap window — catches secrets split across SSE chunks so nothing slips through streaming responses
• Misnamed public key detection — warns when keys named *_PUBLIC_* actually contain secret values

New Commands

• phantom wrap / unwrap — start and stop the proxy without the exec prefix; cleaner DX for long-running dev sessions
• phantom copy — copy secrets across projects without manual export/import
• phantom why — explain why a variable was classified as secret (or not)
• phantom watch — auto-detect new secrets added to .env and protect them in real time

Enhanced Commands

• doctor --fix — auto-remediation for common misconfigurations
• check --staged / --runtime — targeted checks for CI and local dev
• status --oneline — compact output suitable for shell prompts

DX Improvements

• Public key awareness — automatically skips NEXT_PUBLIC_*, VITE_*, EXPO_PUBLIC_*, and similar framework-prefixed variables
• Auto-generate .env.example on phantom init with placeholder values
• README onboarding on phantom init — adds a Phantom usage section to your project README
• Pre-commit hook auto-install — phantom init sets up a git hook to block real secrets from commits
• CI/CD platform detection — detects GitHub Actions, Vercel, Railway, and Netlify environments

MCP

• New phantom_copy_secret tool — 10 tools total for AI-native secrets management

Infrastructure

• 69 tests, zero clippy warnings
• 27 CLI commands
• 5-crate workspace: core, vault, proxy, cli, mcp

Install

npx phantom-secrets init

Binaries

Local macOS ARM64 binaries are attached. Cross-platform binaries (x86 macOS, Linux x86/ARM64, Windows) will be built automatically by CI and attached shortly.

---

Full Changelog: v0.3.0...v0.4.0

Full Changelog: v0.3.3...v0.4.0