v0.34.0

[0.34.0] - 2026-07-31

Added

• Now investigator cockpit — focused default dashboard ranking next leads, gaps, and blockers (closes #375).
• Canonical forensic event schema — versioned structured event identities/provenance across importers (closes #374).
• Indexed SQLite case storage — worker-backed, cursor-paged database replaces flat JSON case state (closes #373).
• One-click Jira / ServiceNow push — push findings from the panel individually or in bulk (#297).
• Chain of custody — automatic per-artifact custody chain with a signed manifest (#231).
• Collection plan — incident-type evidence checklist as a self-updating dashboard panel (#347).
• Incident-type auto-playbooks — picking an incident type seeds key questions and next steps (#236).
• Attack-sequence / playbook matching — checks technique order against known ransomware chains (#230).
• Clock-skew detection & timeline alignment — flags host clock drift, can align timelines (#228).
• Attacker session / story reconstruction — timeline re-threaded into per-host session chapters (#229).
• Compliance Impact mapping — findings mapped to NIST/PCI/HIPAA/GDPR/SEC/ISO obligations (#234, #336).
• DFIR_ALLOWED_HOSTS / DFIR_ALLOWED_HOST_SUFFIXES — name hostnames a hosted deployment answers to.
• Command palette (Ctrl+K / ⌘K) — fuzzy-search every dashboard action (closes #238).
• Three new local PII detectors — credit cards, phone numbers, Israeli Teudat Zehut IDs.
• Optional Presidio layer — DFIR_PRESIDIO_URL adds NLP name detection on top of the built-in patterns.
• Essential / All view in Settings — opens on a curated 43-control view instead of all ~257 fields.
• Signed custody manifest in the redacted package — a redacted export gets its own signed manifest (#362).
• Firefox build for the capture extension — npm run build:firefox, zipped into every release (#270, #366).

Fixed

• The "port already in use" message now tells Linux/macOS users how to stop the other companion.
• A Jira ticket link no longer opens raw JSON — now links to the browse page instead (#297).
• MCP analysis reports survive import — previews, verdicts, and totals no longer lost on re-import (part of #296).
• Correlation no longer merges one artifact across hosts — hash/path/duplicate steps now stay host-scoped (#345).

Changed

• Public IP addresses are now tokenized on the AI wire, not just internal ones (ANON_EXTIP_n).
• Actionable oversized legacy-state recovery — startup explains how to recover when a JSON case exceeds V8's decode ceiling.

Security

• Closed a DNS-rebinding hole — the API now refuses requests to any hostname it doesn't recognise (#280).