v2.4.0

What's Changed

• chore(deps): bump github/codeql-action from 4.38.2 to 4.38.3 by @dependabot[bot] in #303
• fix(upgrade): make capa upgrade work on Windows by @Minitour in #304
• fix(lockfile): stamp the current capa version when pins change by @Minitour in #313
• fix(registries): resolve GitLab marketplace plugins by @Minitour in #314
• fix(variables): only config fields can make a variable required by @Minitour in #322
• fix(mcp): clearer search-mode errors and exact-name search by @Minitour in #323
• docs(skills): correct the PLUGIN_DATA path and lifetime by @Minitour in #318
• fix(cache): validate git version/ref values before rev-parse by @Minitour in #317
• fix(hooks): remove the old entry when a hook event or matcher changes by @Minitour in #316
• fix(secrets): never re-encrypt secrets that fail to decrypt by @Minitour in #315
• fix(clean): never delete project skill sources under skills/ by @Minitour in #327
• fix(hooks): set CLAUDE_PLUGIN_ROOT for plugin hooks that read it by @Minitour in #329
• fix(hooks): keep the args of exec-form plugin hooks by @Minitour in #328
• Add X links for @InfragateAI and @AntonioZaitoun to README by @Minitour in #340
• fix(plugins): install a clashing plugin skill under a prefix, with a warning by @Minitour in #331
• feat(status): report the current project's state by @Minitour in #344
• feat(capabilities): publish a JSON Schema for the capabilities file by @Minitour in #346
• fix: show MCP env placeholders and plain literals in the project API by @Minitour in #350
• Redaction: keep the 40-character key rule, test value rules directly by @Minitour in #355
• Redaction: letter-only URL tokens and unpadded base64 secrets by @Minitour in #354
• fix: second round of v2.4.0 release review follow-ups by @Minitour in #353
• fix: follow-ups from the v2.4.0 release review by @Minitour in #352
• Search mode: explain tools hidden by expose: except on a running server by @Minitour in #356
• UI: show the number of tools, not servers, in the Tools header by @Minitour in #359
• Install: show invalid ref and pin errors instead of Unknown error by @Minitour in #357
• Plugin resolve failures: structured list instead of text match by @Minitour in #360
• Status: count plugins that fail to resolve as install failures by @Minitour in #358
• Release v2.4.0 by @Minitour in #351

Full Changelog: v2.3.0...v2.4.0