v0.68.1

What's Changed

• chore(ci): bump semgrep pydantic-settings pin by @dvmrry in #205

Full Changelog: v0.68.0...v0.68.1

v0.68.0

What's Changed

• secretref: reject unknown keys under cmd: (strict-keys) by @dvmrry in #204

Full Changelog: v0.67.0...v0.68.0

v0.67.0

What's Changed

• security: six adversarial-review fixes (profile error, Windows DACL execute, keyring stub, secret test) by @dvmrry in #203

Full Changelog: v0.66.1...v0.67.0

v0.66.1

What's Changed

• Phase 4: config schema + profiles/providers docs + surfacing by @dvmrry in #202

Full Changelog: v0.66.0...v0.66.1

v0.66.0

What's Changed

• config init + %LOCALAPPDATA% Windows default (DAV-38 distribution) by @dvmrry in #201

Full Changelog: v0.65.0...v0.66.0

v0.65.0

What's Changed

• Windows distribution hardening: redaction, friendly errors, local-volume rule (DAV-38) by @dvmrry in #200

Full Changelog: v0.64.0...v0.65.0

v0.64.0

What's Changed

• Finalize phase-3 keyring plan (zero-dep hand-roll, Windows-host gate) by @dvmrry in #195
• Fold Codex+Kimi review into phase-3 keyring plan by @dvmrry in #196
• Fold round-2 review into phase-3 keyring plan by @dvmrry in #198
• Add cgo-free keyring secret provider by @dvmrry in #199

Full Changelog: v0.63.0...v0.64.0

v0.63.0

What's Changed

• Add cmd profile secret provider by @dvmrry in #194

Full Changelog: v0.62.1...v0.63.0

v0.62.1

What's Changed

• Tighten config-profiles phase-2 implementation plan by @dvmrry in #193

Full Changelog: v0.62.0...v0.62.1

v0.62.0

What's Changed

• Add config profile loading foundation by @dvmrry in #192

Full Changelog: v0.61.3...v0.62.0