v0.0.3 — pnpm-aware SBOM, CHANGELOG populated

Patch release. No runtime behaviour changes vs v0.0.2 — same 13 tools, same Zod schemas, same upstream calls. Publishes a fresh tarball pair only so the release workflow run is fully green end-to-end.

What changed

• release.yml SBOM step switched to @cyclonedx/cdxgen --type pnpm. The previous tool (@cyclonedx/cyclonedx-npm) shells out to npm ls, which doesn't understand pnpm workspace symlinks and exited 254 on the v0.0.2 run. cdxgen has native pnpm support. SBOM artifact is now attached to this run as expected. FETCH_LICENSE=true so license metadata is included.
• .gitignore: .playwright-mcp/ added so browser-automation scratch never lands in commits.
• CHANGELOG.md populated with full v0.0.1 / v0.0.2 / v0.0.3 entries.

Install

npx -y @hhc-mcp/stdio@0.0.3

Same Claude Desktop config snippet as v0.0.2 — just bump the version pin.

Supply chain

• Sigstore provenance via npm OIDC:
  • https://www.npmjs.com/package/@hhc-mcp/core/v/0.0.3
  • https://www.npmjs.com/package/@hhc-mcp/stdio/v/0.0.3
• SBOM (CycloneDX, pnpm-aware) attached as sbom artifact on the release.yml run.

PR: #81 · Merge commit: 1470f5d