v0.10.0

Changes in this Release

• release: prepare v0.10.0 (#510) (b36ec83)
• fix: guard write_file_atomic against symlinks and reexport skill hint constants (#508) (6aad494)
• fix(cli): close skill.rs temp-file and segment-directory symlink races (#509) (6f2b4b2)
• fix(cli): recurse setup's executable-bit walk and fix mid-iteration error handling (#502) (1329fb5)
• fix(core): close symlink and create_dir races in resolve_confined_path (#500) (221f317)
• fix(cli): reject --header when combined with --from-config (#499) (e5df73c)
• build: bump regex, rmcp, tokio, and uuid minimum versions (#498) (4788bc7)
• feat!: add generation provenance to _meta.json (#468) (#497) (9bb3a33)
• fix(cli): distinguish config-load errors and reject symlinked entries in setup (#488) (a156361)
• fix(server): exclude index.ts from list_generated_servers tool_count (#487) (288550b)
• fix(codegen,core): close DoS and charset gaps in generated bridge validator (#485) (9931e92)
• fix(cli,skill): render --hint as a deterministic Use Cases section (#481) (afb241c)
• docs(server,cli): add rustdoc Examples to output_dir and generate::run (#478) (2fa5e87)
• refactor: migrate remaining #[allow(...)] sites to #[expect(...)] (#469) (1930b0d)
• docs(server): clarify categorized_tools name-length check order (#466) (7889c8d)
• Close test-coverage gap in codegen error wrapper; adopt #[expect] for new lint suppressions (#464) (a3be383)
• fix(core,server,skill): sanitize rejected segments before embedding in error text (#461) (cc5a569)
• fix(server): sanitize categorized-tools error messages and split ambiguous-vs-not-found cause (#463) (1e807e3)
• fix(core): sanitize disallowed characters before they reach error text (#454) (23cd277)
• refactor(codegen): split generate_with_categories, narrow too_many_lines allow (#457) (1dea858)
• refactor(server): simplify display_forms into single display_tool_name lookup (#455) (c8c5975)
• fix(core,codegen,skill): close invisible-payload and variation-selector smuggling gaps (#448) (1f830e8)
• refactor(skill): split output-path semantics from generate_skill's display hint (#453) (7f4b4c6)
• fix(core): reject env var names outside POSIX/Windows identifier charset (#449) (067a55b)
• core: adopt Unicode identifier allowlist for ServerId/ToolName, remove dead Error predicates (#444) (f50c417)
• chore(workspace): restore rationale comments for clippy lint-allow entries (#442) (98ca679)
• fix(skill): thread custom skill_name into prompt and reject tilde paths (#441) (7b330d1)
• fix(core,codegen): make forbidden env-var name check case-insensitive (#437) (b554714)
• fix(core): neutralize invisible ASCII-smuggling and zero-width Unicode in sanitize_untrusted_text (#430) (268fc1e)
• adopt serde-saphyr as the YAML frontmatter parser (#426) (9b13090)
• fix(core): neutralize Unicode normalization and bidi-override sanitization gaps (#424) (45b15fd)
• fix: bound skill_name length and cap rmcp debug logging (#423) (5bd172e)
• fix(mcp-server,mcp-cli): sanitize codec-error log reason and drop unused clap features (#420) (8b7e288)
• fix(mcp-skill): sanitize and bound skill_name across the SKILL.md pipeline (#418) (3a3cd0f)
• fix(core): redact non-ASCII usernames that differ from $HOME only by case (#417) (52a9ccb)
• fix(mcp-skill): delegate SKILL.md frontmatter escaping to serde_norway (#409) (62957be)
• feat(cli,server): add --log-format/MCP_EXECUTION_LOG_FORMAT JSON logging switch (#412) (f609d8e)
• refactor(core): consolidate server_id slug validation into mcp-core (#408) (968bacb)
• refactor(core): consolidate path-confinement algorithm from server and skill (#407) (31acfaa)
• refactor(mcp-server): wire cancellation into remaining tool handlers, add missing tracing span (#404) (dbad36f)
• fix(introspector): narrow HTTP/SSE response-size doc claim and pin SSE bound explicitly (#403) (a8e8785)
• refactor(files,skill): sort Cargo.toml dependencies alphabetically (#400) (2540b51)
• add regression coverage for take_if concurrency and restore-near-expiry (#394) (72bfc79)
• fix(mcp-server): retain session across post-consume save_categorized_tools failures (#386) (c033a7d)
• characterize SEP-2575 discover advertisement; remove unused regex dependency (#385) (9dd4b81)
• add ADR-369 protocol version gate test; convert skill.rs to shared emit helper (#384) (67febb7)
• ci: split cargo build into a parallel job (#383) (28e93bf)
• docs(decisions): add ADR-369 evaluating rmcp SEP-2575 and SEP-2549 adoption (#380) (3182d9a)
• refactor(cli): extract shared emit-and-exit helper for output formatting (#375) (4850bac)
• fix(mcp-server): stop save_categorized_tools from consuming session on validation failure (#376) (3f0d817)
• fix(skill): enable handlebars strict_mode and drop unused dependencies (#374) (64a299a)
• ci: bump taiki-e/install-action from 2.85.5 to 2.85.10 (#367) (c092fe3)
• chore(deps): bump the minor-and-patch group with 3 updates (#366) (5cd20e4)
• chore(deps): bump rmcp from 2.2.0 to 3.0.1 (#364) (86ca581)
• ci: bump taiki-e/install-action from 2 to 2.85.5 (#365) (3d728cd)
• chore(deps): bump the minor-and-patch group with 6 updates (#363) (4e6b41d)

What's Changed

• chore(deps): bump the minor-and-patch group with 6 updates by @dependabot[bot] in #363
• ci: bump taiki-e/install-action from 2 to 2.85.5 by @dependabot[bot] in #365
• chore(deps): bump rmcp from 2.2.0 to 3.0.1 by @dependabot[bot] in #364
• chore(deps): bump the minor-and-patch group with 3 updates by @dependabot[bot] in #366
• ci: bump taiki-e/install-action from 2.85.5 to 2.85.10 by @dependabot[bot] in #367
• fix(skill): enable handlebars strict_mode and drop unused dependencies by @bug-ops in #374
• fix(mcp-server): stop save_categorized_tools from consuming session on validation failure by @bug-ops in #376
• refactor(cli): extract shared emit-and-exit helper for output formatting by @bug-ops in #375
• docs(decisions): add ADR-369 evaluating rmcp SEP-2575 and SEP-2549 adoption by @bug-ops in #380
• ci: split cargo build into a parallel job by @bug-ops in #383
• add ADR-369 protocol version gate test; convert skill.rs to shared emit helper by @bug-ops in #384
• characterize SEP-2575 discover advertisement; remove unused regex dependency by @bug-ops in #385
• fix(mcp-server): retain session across post-consume save_categorized_tools failures by @bug-ops in #386
• add regression coverage for take_if concurrency and restore-near-expiry by @bug-ops in #394
• refactor(files,skill): sort Cargo.toml dependencies alphabetically by @bug-ops in #400
• fix(introspector): narrow HTTP/SSE response-size doc claim and pin SSE bound explicitly by @bug-ops in #403
• refactor(mcp-server): wire cancellation into remaining tool handlers, add missing tracing span by @bug-ops in #404
• refactor(core): consolidate path-confinement algorithm from server and skill by @bug-ops in #407
• refactor(core): consolidate server_id slug validation into mcp-core by @bug-ops in #408
• Add --log-format/MCP_EXECUTION_LOG_FORMAT JSON logging switch by @bug-ops in #412
• fix(mcp-skill): delegate SKILL.md frontmatter escaping to serde_norway by @bug-ops in #409
• fix(core): redact non-ASCII usernames that differ from $HOME only by case by @bug-ops in #417
• fix(mcp-skill): sanitize and bound skill_name across the SKILL.md pipeline by @bug-ops in #418
• fix(mcp-server,mcp-cli): sanitize codec-error log reason and drop unused clap features by @bug-ops in #420
• fix: bound skill_name length and cap rmcp debug logging by @bug-ops in #423
• fix(core): neutralize Unicode normalization and bidi-override sanitization gaps by @bug-ops in #424
• adopt serde-saphyr as the YAML frontmatter parser by @bug-ops in #426
• fix(core): neutralize invisible ASCII-smuggling and zero-width Unicode in sanitize_untrusted_text by @bug-ops in #430
• fix(core,codegen): make forbidden env-var name check case-insensitive by @bug-ops in #437
• fix(skill): thread custom skill_name into prompt and reject tilde paths by @bug-ops in #441
• chore(workspace): restore rationale comments for clippy lint-allow entries by @bug-ops in #442
• core: adopt Unicode identifier allowlist for ServerId/ToolName, remove dead Error predicates by @bug-ops in #444
• fix(core): reject env var names outside POSIX/Windows identifier charset by @bug-ops in #449
• refactor(skill): split output-path semantics from generate_skill's display hint by @bug-ops in #453
• fix(core,codegen,skill): close invisible-payload and variation-selector smuggling gaps by @bug-ops in #448
• refactor(server): simplify display_forms into single display_tool_name lookup by @bug-ops in #455
• refactor(codegen): split generate_with_categories, narrow too_many_lines allow by @bug-ops in #457
• fix(core): sanitize disallowed characters before they reach error text by @bug-ops in #454
• fix(server): sanitize categorized-tools error messages and split not-found/ambiguous cause by @bug-ops in #463
• fix(server,skill): sanitize rejected segments before embedding in error text by @bug-ops in #461
• Close test-coverage gap in codegen error wrapper; adopt #[expect] for new lint suppressions by @bug-ops in #464
• docs(server): clarify categorized_tools name-length check order by @bug-ops in #466
• Migrate remaining #[allow(...)] sites to #[expect(...)] by @bug-ops in #469
• docs(server,cli): add rustdoc Examples to output_dir and generate::run by @bug-ops in #478
• fix(cli,skill): render --hint as a deterministic Use Cases section by @bug-ops in #481
• fix(codegen,core): close DoS and charset gaps in generated bridge validator by @bug-ops in #485
• fix(server): exclude index.ts from list_generated_servers tool_count by @bug-ops in #487
• fix(cli): distinguish config-load errors and reject symlinked entries in setup by @bug-ops in #488
• feat!: add generation provenance to _meta.json by @bug-ops in #497
• build: bump regex, rmcp, tokio, and uuid minimum versions by @bug-ops in #498
• fix(cli): reject --header when combined with --from-config by @bug-ops in #499
• fix(core): close symlink and create_dir races in resolve_confined_path by @bug-ops in #500
• fix(cli): recurse setup's executable-bit walk and fix mid-iteration error handling by @bug-ops in #502
• fix(cli): close skill.rs temp-file and segment-directory symlink races by @bug-ops in #509
• fix: guard write_file_atomic against symlinks and reexport skill hint constants by @bug-ops in #508
• release: v0.10.0 by @bug-ops in #510

Full Changelog: v0.9.0...v0.10.0