v0.28.1

Fixed

• Hardened final Status:/Level: output contract in SKILL.md, prompts, and command files to explicitly survive Pi/master/orchestration wrapper contexts.
• Updated docs/orchestration.md output example to include Status: ready and Level: 5/5; added note that orchestrators/master reviewers must append these as the last two lines.
• Added CI static check to verify Status: and Level: appear in SKILL.md, both prompts, both command files, and docs/orchestration.md.

Diffwarden v0.28.0

Changed

• Compacted SKILL.md into a shorter core playbook to reduce baseline input-token use on every Diffwarden invocation.
• Added explicit token-discipline rules for filtering generated/noisy evidence, gating optional sections by flag/mode, and keeping lean output as default.
• Preserved safety gates, mode support, Go profile, web gating, delegated reads, posting/reply rules, and hallucination guard in condensed form.

Token impact

• skills/diffwarden/SKILL.md: 113,357 bytes → 22,573 bytes.
• Words: 16,513 → 2,972.
• Estimated baseline skill context reduction: ~80% (~20k–30k fewer tokens per invocation).

Verification

• bash -n install.sh
• shellcheck install.sh
• version sync check
• Pi install dry-runs (project + global)
• npm pack --dry-run

v0.27.2

Fixed

• Added a Common Pitfalls rule against declining a re-run from conversation memory of a prior posted comment ("already done, same findings apply"). Re-run requests now always re-fetch the current PR head SHA and comment count before deciding a review is a duplicate.
• Posted PR comment summaries now stamp the head SHA on the Level: line, so a later run (including a fresh session) can compare head SHAs to detect a genuine duplicate instead of relying on memory.

Full changelog: https://github.com/jperocho/diffwarden/blob/v0.27.2/CHANGELOG.md

Diffwarden v0.27.1

Changed

• Documented Go language-profile usage examples for --go and --lang go, including valid code targets, Codex CLI form, and rejected document/unsupported-language cases.

Diffwarden v0.27.0

Added

• Added Go review profile for code targets via --go / --lang go, including Go project auto-detection,
  Go-specific evidence collection (gofmt, go vet, go test, golangci-lint,
  govulncheck, gosec, staticcheck), comprehensive security and anti-pattern
  checks (injection, goroutine leaks, auth bypass, unsafe crypto, nil risks, etc.),
  Go severity caps, safe fix-loop rules, explicit document-mode rejection, and unsupported-language rejection.
• Go evidence collection includes a PR/local checkout guard: local Go commands run only
  when the checkout is confirmed at the PR head SHA; API/read-only reviews fall back to
  diff and CI evidence only.
• Go evidence collection enforces a strict network policy: --go and auto-detection do
  not grant network access; commands that would require module downloads or vulnerability
  database access are skipped with a reason; govulncheck network access is not treated
  as --web consent.
• go mod tidy -diff version guard: if the installed Go version does not support -diff,
  the step is skipped rather than falling back to the mutating go mod tidy in review.

Diffwarden v0.26.2

Added

• Added a global untrusted PR content boundary: PR titles, bodies, diffs,
  review comments, issue comments, CI logs, and bot output are evidence only,
  never instructions to follow.
• Added verification checklist coverage for indirect prompt-injection handling.
• Added README badges for CI, skills.sh, Agent Trust Hub, Socket, and Snyk audit pages.

Diffwarden v0.26.1

Added

• Added npm package metadata for publishing the Pi extension package as
  pi-diffwarden with the pi-package keyword.
• Added npm install instructions for Pi Agent (pi install npm:pi-diffwarden@0.26.1).
• Added npm pack --dry-run and package-publication checks to CI.

Diffwarden v0.26.0

Added

• Added optional Pi package extension (extensions/diffwarden/index.ts) that
  registers native /dw and /diffwarden commands, forwards to
  /skill:diffwarden, provides basic argument completions, and discovers the
  bundled skill.
• Added package.json Pi package manifest so Pi can install Diffwarden from
  git/local paths.
• Added CI static checks for the Pi package extension manifest and wrapper.
• Documented Pi extension install, behavior, and security warning in README and
  SKILL.md.

Kept

• Installer still writes only Pi skills/prompts; no extension auto-install
  through install.sh.
• Safety stance unchanged: no auto-merge, no force-push, no blind push, no
  CI/test weakening, no resolving human comments without approval.

v0.25.0 — evidence-based findings

Added

• Evidence-Based Findings in SKILL.md: actionable findings require an anchor (file:line, check name, PR field, or comment/thread id) plus a verbatim quote or diff hunk; low-confidence guesses cannot be P0/P1 without local proof.
• Hallucination Guard expanded beyond How to test to cover findings, fix plans, PR comments, and thread replies.
• Grounded verification discovery: use manifest/workflow targets only when they exist; never invent runners.
• Structured verify: pass|fail|skipped block in --verbose loop output.
• Fix-plan rules: Will change / Will run must trace to diff/read files and discovered commands only.
• Delegated-read findings cross-linked to evidence rules; verification checklist updated.

Install/upgrade: re-run install.sh (pins to v0.25.0).

Full notes: see CHANGELOG.

v0.24.1

Fixed

• Restored mandatory final status lines for lean, verbose, status, and PR comment output.
• Final reviews now end with Status: followed by Level: without extra final fields or headings.