v0.7.1

No behaviour change. dist/ is byte-identical to 0.7.0, since src/ and prompts/ are untouched. This release exists to correct the package README.

What's new

Changed

• Bridge family table no longer advertises a retired project - the README listed gemini-mcp-bridge, retired in May 2026 after Google discontinued the Gemini CLI, so the npm package page was pointing readers at a dead repo. The comparison is now the two-way one it should be: claude-mcp-bridge and codex-mcp-bridge.
• CodeGuilds badge added to the README.
• npm audit reports a clean tree - an overrides block raises seven flagged transitive packages to a patched floor, each inside the range its immediate dependent already declares. SECURITY.md gains a "Dependency Audit Posture" section explaining which of them can load in a stdio-only server (only fast-uri, via the ajv validator McpServer builds at construction) and which cannot. Note that npm overrides govern this repo's own tree only and do not reach consumers of the published package.

Added

• Integration tests against the real CLI, guarding the 0.7.0 security fixes by behaviour rather than by argv shape. The existing unit tests mock spawn, so they stay green if an upstream CLI release renames a flag or changes how it binds values. The new tests assert that a flag-shaped --settings= prompt carrying a SessionStart hook does not execute the hook, that a dash-prefixed session id is consumed by --resume rather than parsed as a flag, and that a subprocess granted Read Glob Grep cannot run a shell command. All three were confirmed to fail when the corresponding fix is reverted. Excluded from npm test; run with npm run test:integration. Tests are outside the published files list, so this does not affect the package.

Full Changelog: v0.7.0...v0.7.1