v1.0.4

Changes

• fix(monitor): one delivery channel, sharper excerpts, and per-run CI batching @justanotherspy (#213)

v1.0.3

Changes

• fix(monitor): follow the session, not the directory it opened in @justanotherspy (#211)

v1.0.2

Changes

• feat(monitor): make the plugin monitor the only channel, scoped per session @justanotherspy (#209)
• chore(deps): update cgr.dev/chainguard/go:latest docker digest to 95f6114 @renovate[bot] (#207)
• chore(deps): update cgr.dev/chainguard/static:latest docker digest to 399c8cb @renovate[bot] (#208)

v1.0.1

Changes

• chore(deps): update all non-major dependencies @renovate[bot] (#198)
• feat(plugin): deliver monitor events through a Claude Code plugin monitor @justanotherspy (#205)

v1.0.0

shuck is one portable binary again — and it now tells you when your PR breaks, instead of waiting to be asked.

The headline

shuck monitor is a local background daemon. Point it at a working tree and it follows that tree: reads the branch out of .git/HEAD (linked worktrees included), finds the open PR for it, and re-checks on a cadence that tightens to 12s while a run is in flight and relaxes to 90s once everything is terminal. Switch branches or worktrees and it retargets itself — you never tell it a PR number.

shuck monitor          # what it is watching, and where those PRs stand
shuck monitor watch    # follow this working tree (starts the daemon if needed)
shuck monitor events   # hand over what has happened since you last looked

In Claude Code you run none of that. The plugin's hooks register the session's working tree on start, deliver new events into the conversation on each prompt, poke the monitor after a git push, and — on Stop — hand over anything still asking to be dealt with rather than let a turn end on a red build. A ci.failed event carries the failing job's log inline (whole under 8 KiB, distilled failing steps above that) plus the on-disk path to the rest.

Everything is local: no webhook, no server, no credential beyond the GITHUB_TOKEN the CLI already used.

⚠️ Breaking changes

The self-hosted v2 backend is gone. The gateway, ingest, worker and portal services, the Terraform module, the Helm chart, the shuck-channel plugin, and the four ghcr.io/justanotherspy/shuck-{ingest,worker,gateway,portal} images are all removed. If you deployed any of it, it is no longer built or published — the monitor replaces it with a daemon on your own machine.

The MCP server is gone. Every tool it exposed was a thin wrapper over a subcommand that already existed. Remove the registration:

claude mcp remove --scope user shuck

Each removed tool has a direct CLI equivalent — inspect_logs → shuck logs, monitor_events → shuck monitor events, check_pins → shuck pins.

Three commands are gone: shuck compliance, shuck dependabot, shuck image. They answered a quarterly question about a repository rather than "what is wrong with this branch". Running any of them now prints what replaced it instead of a confusing parse error. Dependabot alerts are unaffected — shuck security still reports them.

The command surface

Command
shuck monitor (m)	the background monitor: CI, reviews and pin drift as they happen
shuck logs (l)	failing CI step logs for a PR or a single run
shuck reviews (r)	a PR's reviews and review-comment threads
shuck / shuck all	CI + reviews + security in one report
shuck security (s)	code scanning, secret scanning, Dependabot alerts
shuck pins (p)	workflow actions that are unpinned or stale
shuck action (a)	resolve one Action to its latest tag + SHA

Plus setup / version / upgrade.

Also new

shuck pins — finds uses: references that are not SHA-pinned, or whose # v4.2.2 comment names a superseded release, each with the corrected line to paste. Workflow YAML is walked as yaml.Node, so line numbers and trailing comments are exact.

A standing portability budget. CI fails the build if the binary's import graph ever picks up a cloud SDK, a serverless runtime, or a server framework. Dependencies are down from 35 modules to 3 direct + 22 indirect.

Fixes

Nine production defects, every one of which had passing tests over it. Each was proved by applying a mutation that reinstates the bug and observing a real test failure:

• Reviews sharing a watermark second were lost forever. GitHub stamps submitted_at to the whole second and filters strictly-after, so a second reviewer landing in the same second was excluded from every later poll.
• First-sighting watermarks came from the daemon's clock, then were compared against GitHub-stamped times — a daemon a second fast swallowed every review inside the skew.
• The CI-failure dedupe evicted the wrong end, trimming by text order over "<id>/<attempt>" keys, so a failure could be reported into a session twice.
• shuck monitor events --wait 30m stopped at ten minutes and said nothing new — indistinguishable from a genuinely quiet wait.
• The monitor never reclaimed its own disk. Nothing swept the cache from the daemon, so a machine that only ran shuck monitor accumulated job logs forever.
• pins.json was rewritten once per watched tree per second, for the life of the daemon.
• shuck monitor status --json answered in prose when no daemon was running.
• The Stop hook could hold a turn open for a stale action pin or a review that was an approval.
• shuck upgrade left the old daemon running, so a new binary's clients talked to the previous version's daemon. It now stops it; the next session starts a fresh one.

Upgrading

shuck upgrade                                    # in-place, checksum-verified
brew upgrade --cask justanotherspy/tap/shuck     # Homebrew

The Claude Code plugin requires v1.0.0 or newer for the monitor hooks; on anything older it says so at session start rather than failing quietly.

Dependency and tooling updates since v0.4.3

• fix(deps): bump toolchain to go1.26.5 and migrate go-github v88 → v89 (#180)
• fix(deps): update all non-major dependencies (#188, #173, #157, #155, #150, #140, #137)
• fix(deps): tidy go.sum to unblock the CI tidy check (#192)
• fix(deps): bump semgrep pinned deps to clear security alerts (#131)
• fix(release): cap binary extraction to bound decompression bombs (#132)
• chore(deps): update actions/setup-node to v7 (#183), actions/setup-python to v7 (#191), actions/setup-go to v7 (#184), actions/checkout to v7 (#117)
• chore(deps): update github/codeql-action to v4.37.3 (#195)
• chore(deps): update release-drafter/release-drafter to v7.5.0 (#136)
• chore(deps): update goreleaser/goreleaser-action to v7.2.3 (#149)
• chore(deps): update docker/build-push-action to v7.3.0 (#154)
• chore(deps): update dependency @anthropic-ai/claude-code (#194, #169, #168, #147, #144, #142)
• chore(deps): rolling cgr.dev/chainguard/go and chainguard/static digest bumps (#203, #199, #196, #189, #181, #175, #177, #172, #156, #153, #152, #151, #148, #146, #145, #143, #141, #139, #138, #135, #133)
• chore(deps): lock file maintenance (#190, #174)
• chore: migrate release-drafter config off deprecated label fields (#134)

v0.4.3

Changes

• chore(deps): update all non-major dependencies @renovate[bot] (#130)
• chore(deps): update all non-major dependencies @renovate[bot] (#129)
• chore(deps): update cgr.dev/chainguard/go:latest docker digest to af948d0 @renovate[bot] (#128)
• chore(deps): update cgr.dev/chainguard/go:latest docker digest to cbd2829 @renovate[bot] (#127)
• chore(deps): update all non-major dependencies to v2.1.183 @renovate[bot] (#126)
• chore(deps): update cgr.dev/chainguard/go:latest docker digest to 2beb733 @renovate[bot] (#125)
• chore(deps): update cgr.dev/chainguard/go:latest docker digest to 49611a7 @renovate[bot] (#123)
• chore(deps): update cgr.dev/chainguard/go:latest docker digest to 5719118 @renovate[bot] (#122)
• chore(deps): update all non-major dependencies to v2.1.181 @renovate[bot] (#121)
• chore(deps): update cgr.dev/chainguard/go:latest docker digest to 7596cc2 @renovate[bot] (#120)
• chore(deps): update all non-major dependencies to v2.1.179 @renovate[bot] (#119)
• chore(deps): update cgr.dev/chainguard/go:latest docker digest to 0b886e3 @renovate[bot] (#118)
• chore(deps): update actions/checkout action to v7 @renovate[bot] (#117)
• chore(deps): update all non-major dependencies to v2.1.178 @renovate[bot] (#116)
• chore(deps): update all non-major dependencies to v3.95.6 @renovate[bot] (#115)
• chore(deps): update cgr.dev/chainguard/go:latest docker digest to 3c71d1f @renovate[bot] (#114)
• feat(setup): expand the managed CLAUDE.md note and refresh it on upgrade @justanotherspy (#113)
• chore(deps): update cgr.dev/chainguard/go:latest docker digest to b0b9c89 @renovate[bot] (#112)
• chore(deps): update all non-major dependencies to v7.4.0 @renovate[bot] (#111)
• chore(deps): update cgr.dev/chainguard/go:latest docker digest to 774c944 @renovate[bot] (#110)

v0.4.2

Changes

• chore(deps): pin dependencies @renovate[bot] (#109)
• chore(deps): extend shared Renovate preset @justanotherspy (#108)
• Update cgr.dev/chainguard/go:latest Docker digest to 3cea887 @renovate[bot] (#107)
• Update cgr.dev/chainguard/go:latest Docker digest to 31b6504 @renovate[bot] (#106)
• Update cgr.dev/chainguard/go:latest Docker digest to 2ac9d52 @renovate[bot] (#105)
• Update dependency @anthropic-ai/claude-code to v2.1.177 @renovate[bot] (#104)
• docs(skill): trigger on PR open/push and document the watch-loop workflow @justanotherspy (#102)
• fix: close leaked response body, surface zip CRC errors, multiline FAIL classify @justanotherspy (#101)
• Update cgr.dev/chainguard/go:latest Docker digest to 005a745 @renovate[bot] (#100)
• feat: list a run's artifacts and add --download-artifacts @justanotherspy (#99)
• Update cgr.dev/chainguard/go:latest Docker digest to 35d57d0 @renovate[bot] (#96)
• Update dependency @anthropic-ai/claude-code to v2.1.175 @renovate[bot] (#97)
• Update dependency @anthropic-ai/claude-code to v2.1.173 @renovate[bot] (#95)
• Update cgr.dev/chainguard/go:latest Docker digest to a6e840a @renovate[bot] (#94)
• Update cgr.dev/chainguard/go:latest Docker digest to 3928ca0 @renovate[bot] (#93)
• Update dependency @anthropic-ai/claude-code to v2.1.170 @renovate[bot] (#92)
• fix(deps): update golang.org/x/term to v0.44.0 with tidy go.sum @justanotherspy (#91)
• Update dependency @anthropic-ai/claude-code to v2.1.169 @renovate[bot] (#90)

Maintenance

• chore: bump chainguard/go from a6e840a to 35d57d0 in the docker group @dependabot[bot] (#98)

v0.4.1

Changes

• Update cgr.dev/chainguard/go:latest Docker digest to 595c4dd @renovate[bot] (#88)
• Update dependency @anthropic-ai/claude-code to v2.1.168 @renovate[bot] (#87)
• Update dataaxiom/ghcr-cleanup-action action to v1.2.2 @renovate[bot] (#86)
• feat: add shuck dependabot fix (+ cooldown in scaffold); skill/doc fixes @justanotherspy (#85)
• feat: add shuck dependabot to audit and scaffold Dependabot configs @justanotherspy (#84)
• Update dependency node to v24 @renovate[bot] (#83)
• Update dependency python to 3.14 @renovate[bot] (#82)
• Update trufflesecurity/trufflehog action to v3.95.5 @renovate[bot] (#80)
• Update dependency @anthropic-ai/claude-code to v2.1.167 @renovate[bot] (#79)
• Configure Renovate @renovate[bot] (#78)
• Always-allow shuck MCP tools + harden registry token handling @justanotherspy (#77)
• feat(target): inspect specific run attempts and PR "Checks" tab links @justanotherspy (#74)
• feat: surface check-run annotations and classify failed steps @justanotherspy (#73)
• fix(semver): compare numeric prerelease fields numerically @justanotherspy (#72)
• docs: tighten CLAUDE.md for accuracy, contribution, and dogfooding @justanotherspy (#71)
• Make the README more concise and accurate @justanotherspy (#70)
• Bake the shuck skill, MCP server, and agent guidance into the repo @justanotherspy (#69)
• Make report exit codes opt-in gating and harden plugin-validate install @justanotherspy (#68)
• Add GitHub Actions policies and full repository settings to shuck compliance @justanotherspy (#67)
• Gate release drafting on CI passing on main @justanotherspy (#64)
• Fix image referrer-tag pins, security false all-clear, and MCP TTL docs @justanotherspy (#63)
• Publish release images to GHCR behind the release approval; registry fallback for scopeless tokens @justanotherspy (#61)
• Add ruleset support to shuck compliance and sync compliance.yml @justanotherspy (#62)
• Add weekly GHCR cleanup workflow @justanotherspy (#60)
• docs: document shuck image (GHCR digest pinning) in the README @justanotherspy (#59)

Maintenance

• build(deps): bump chainguard/go from 4ad8c4b to 8333b6b in the docker group @dependabot[bot] (#75)
• build(deps): bump the github-actions group with 2 updates @dependabot[bot] (#76)
• build(deps): bump chainguard/go from 9b52ed6 to 4ad8c4b in the docker group @dependabot[bot] (#65)
• build(deps): bump the github-actions group with 2 updates @dependabot[bot] (#66)

v0.4.0

Changes

• Add shuck compliance discover to bootstrap and sync .github/compliance.yml @justanotherspy (#58)
• Expand fuzzing to every parser of external input @justanotherspy (#57)
• Move compliance config to .github/compliance.yml @justanotherspy (#56)
• Exclude main.go from coverage and gate CI at 80% internal coverage @justanotherspy (#55)
• Assign Dependabot PRs to justanotherspy @justanotherspy (#54)
• Fix OSSF Scorecard code-scanning findings @justanotherspy (#52)
• Add shuck compliance — check repo settings against .shuck/compliance.yaml @justanotherspy (#49)
• Improve unit test coverage for internal packages @justanotherspy (#51)
• Drill cancelled jobs' logs to show the interrupted step @justanotherspy (#50)
• cache: store under XDG cache dir (~/.cache/shuck) instead of ~/.shuck @justanotherspy (#47)
• Align shuck with go-template's feature set @justanotherspy (#48)
• Add shuck image: GHCR image versions and digests @justanotherspy (#46)
• Modernize to Go 1.26 with go fix and add it to the build process @justanotherspy (#45)
• Harden cache paths and release extraction against traversal/symlink abuse @justanotherspy (#44)
• fix(cli): honor focus flags offline and normalize --state casing @justanotherspy (#43)
• fix: reviews render panic on empty comment body; propagate --refresh to security @justanotherspy (#42)
• refactor(plugin): source shuck from central claude-plugins marketplace @justanotherspy (#41)
• Add standard repo scaffolding from go-template @justanotherspy (#38)

Maintenance

• build(deps): bump chainguard/go from 3d8fa86 to 9b52ed6 in the docker group across 1 directory @dependabot[bot] (#53)
• build(deps): bump the github-actions group with 2 updates @dependabot[bot] (#40)
• build(deps): bump golang.org/x/term from 0.42.0 to 0.43.0 in the go-dependencies group @dependabot[bot] (#39)

v0.3.6

Changes

• Improve caching: raw-log re-parse, default-branch-SHA keys, disk purge @justanotherspy (#37)
• fix(install): fall back to releases redirect when the GitHub API is rate-limited @justanotherspy (#36)
• feat(cli,mcp): split PR checks into logs/reviews/all subcommands; align MCP tools @justanotherspy (#35)
• feat(security): add shuck security to summarize a repo's security alerts @justanotherspy (#34)