v3.0.0

3.0.0 (2026-10-09)

⚠ BREAKING CHANGES

• confirmationFromEnv requires the account (string | undefined) and args keys; see docs/MIGRATION-3.md.
• resolveOutputDir no longer returns process.cwd() when no directory or env var is set. It uses ~/Downloads/ when { name } is passed and throws a config error otherwise. createApiClient now throws WriteOutcomeUnknownError (an McpToolError) instead of RequestTimeoutError for a timed-out or failed non-safe request, unless the request is marked

Features

• harden HTTP, URL and error defaults and add audit lint checks (#361) (ca98371)
• require account and args bindings in confirmationFromEnv (#366) (eec6f4e)
• shared response-cache single-flight, body size caps, SSRF-safe fetch and Set-Cookie merging (#365) (94166ba)
• stop resolveOutputDir falling back to cwd and report unknown write outcomes (#364) (b0bfc8d), closes #362