v3.4.0

3.4.0 (2026-08-20)

Features

• cli: add global --allow-symlinks option for shared symlinked folders/files (78d7104)
• commands: surface security warnings for skipped files and enforce strict deletion boundaries (f2d835d)
• implement PKCE support in OAuth flows (#1142) (1a1665e)

Bug Fixes

• auth: remove hardcoded OAuth client secret from published npm package (CWE-798) (#1139) (a678e92)
• auth: restore OAuth client secret for desktop public client compatibility (be27aaf)
• auth: secure credential file writing with symlink protection and permissions (378c1a6)
• core: secure file system crawling, atomic writes, and structured security reporting (aa4cfeb)
• create-script: accept --type webapp and --type api as standalone aliases (#1155) (34a468e), refs #1154
• deps: update google-auth-library and googleapis to resolve Node 22+/25+ compatibility issues (87a3759)
• mcp: validate projectDir against permitted base paths (CWE-22 path traversal) (#1141) (1e8132c)
• prevent OAuth CSRF via missing state parameter in authorization flow (#1135) (8dac6c2)
• Print help instead of throwing error on unknown commands (#1157) (39a9c12)
• security: clean up CSRF demo script and harden path boundary & test mocks (0a28a48)
• security: prevent path traversal via srcDir in .clasp.json (#1140) (408448e)
• security: validate sourceDir MCP parameter and use realpath in WriteFiles (#1144) (4eb9dca)