v3.4.0

3.4.0 (2026-10-28)

Features

• response: add stripUrlishKeys, a fail-closed filter for URL/secret-shaped key names (#406) (e6e04f3)

Documentation

• fleet-builder: a scrubbed value must never be a test fixture (#401) (6001eb1)
• skill: add gated-write and live-send lessons from the insync write build (#404) (f2bb48c)
• skill: add legacy-portal recon and fpx lessons from the insync build (#402) (2e72db9)
• skill: point cookie-session repos at CookieJar/same-origin and record the insync audit lessons (#405) (5da5b51)

v3.3.2

3.3.2 (2026-10-26)

Bug Fixes

• fetchproxy: give the bridge healthcheck a hint for an approval wait or a refused hello (#398) (84c42fd)

v3.3.1

3.3.1 (2026-10-21)

Bug Fixes

• http: guard redirect targets, cancel retry sleeps and redact api_token JSON keys (#397) (92435cb)
• http: report a 5xx after a sent write as outcome-unknown, not a failure (#394) (48ab2bb)
• server: stop batch planning on cancel and bound export memory and resume to the server's own folders (#396) (cc03f6b)

v3.3.0

3.3.0 (2026-10-20)

Features

• export: shared bulk-export sink (local disk paths or hosted blob URLs) (#390) (50f0ba1)

Bug Fixes

• export: resume only into export folders this sink created (#393) (cd4cd82), closes #391

v3.2.0

3.2.0 (2026-10-19)

Features

• server: no op cap on registerBatchTool by default; set one with maxOps or MCP_BATCH_MAX_OPS (#387) (6351a3b)
• server: token-only confirmation (registerConfirmTool) and batched writes (registerBatchTool) (#386) (7ba76a1)

Documentation

• skill: scaffold allowScripts as a name-only deny, not a pinned approval (#384) (5a3c9e1)

v3.1.0

3.1.0 (2026-10-17)

Features

• compose view responses and redact known secret values (#377) (78e31d7)
• fetchproxy: add captureBearerHeader, createLazyTransport and a captured-token manager (#379) (adaff9c)
• graphql: add a document inspector and retry/edge-block hooks for direct transports (#380) (bbfe8bf)
• http: add an error-response hook, idempotency keys, writeOrUnknown and transport-failure descriptions (#378) (0716520)

Documentation

• session: put the captured-token manager docs back in their own section (#383) (9aa1617)

v3.0.3

3.0.3 (2026-10-16)

Bug Fixes

• bound hostile-page scans, keep GraphQL hook errors intact, and harden redirects, writes and redaction (#374) (242500f)

v3.0.2

3.0.2 (2026-10-09)

Bug Fixes

• lint: only require CLAUDE_PLUGIN_ROOT in the config the plugin actually uses (#370) (318821e)
• lint: warn on every plugin.json mcp key, not just non-default paths (#372) (2233bf9)

v3.0.1

3.0.1 (2026-10-09)

Bug Fixes

• lint: stop counting bundled dependencies' env reads as server config (#369) (3491e12)
• ship the migration and confirm-token docs in the npm package (#367) (bad97ec)

v3.0.0

3.0.0 (2026-10-09)

⚠ BREAKING CHANGES

• confirmationFromEnv requires the account (string | undefined) and args keys; see docs/MIGRATION-3.md.
• resolveOutputDir no longer returns process.cwd() when no directory or env var is set. It uses ~/Downloads/ when { name } is passed and throws a config error otherwise. createApiClient now throws WriteOutcomeUnknownError (an McpToolError) instead of RequestTimeoutError for a timed-out or failed non-safe request, unless the request is marked

Features

• harden HTTP, URL and error defaults and add audit lint checks (#361) (ca98371)
• require account and args bindings in confirmationFromEnv (#366) (eec6f4e)
• shared response-cache single-flight, body size caps, SSRF-safe fetch and Set-Cookie merging (#365) (94166ba)
• stop resolveOutputDir falling back to cwd and report unknown write outcomes (#364) (b0bfc8d), closes #362