v26.05.13

Highlights

Wave-2 review-and-fix cycle. Addresses all 4 HIGH and 14 MEDIUM findings from the wave-2 review pass, plus 4 post-validation follow-ups. Focus areas: cross-process state durability, refresh-token race hardening, and privacy.

Cross-process state

• internal/filelock package: cross-process advisory flock helper (sidecar <path>.lock inode pattern). Survives O_APPEND rename-safety semantics.
• Every append-only JSONL store (audit, idempotency, approval, schedule, httprecord cassette) now holds a sidecar flock and fsyncs writes + parent directory before close.
• internal/idempotency.Store.Acquire(ctx, key) exposes per-key serialisation; FileStore uses a SHA256-hashed lockfile so callers can span Lookup→Record under one lock.
• internal/schedule: state transitions serialised across processes (M6 follow-up).

Refresh-token hardening

• maybeRefreshSession now takes the refresh flock before re-reading the session, refreshing, and persisting. Concurrent callers re-read the freshly stored token instead of double-spending a rotated refresh-token (M13).
• Hard-fails on lock acquire error or SaveSession error rather than returning a half-persisted refresh result (M3, M4).
• New GOLINK_REFRESH_LOCK_PATH env var to override the sidecar lock path.

Privacy

• internal/privacy: redacts inline Bearer <token> strings in audit previews and HTTP record/replay cassettes (M11).
• internal/approval: payloads persist verbatim — approval run dispatches them literally; access control via file mode 0o600 (H1).

Correctness

• internal/plan: Args canonicalised through json.Number so SHA256 plan hashes are stable across encoder/decoder round-trips (M8).
• internal/api: Retry-After header honored on 429/503 retries (H2); percent-encoded URN keys decoded in SocialMetadata (M10).
• internal/httprecord: URL canonicalisation (sorted query params, default port stripped) for record/replay matching (M6).
• cmd/execute: honors settings.RequireApproval from env/config (M3); --notes persistent flag registered (H1).
• cmd/batch: idempotency marshal/record errors logged instead of dropped (L2); progress sidecar fsync'd to survive kernel crash (M8).

Install

# Go
go install github.com/mudrii/golink@v26.05.13

# Homebrew (tap is this repo)
brew tap mudrii/golink https://github.com/mudrii/golink
brew install mudrii/golink/golink

Requires Go 1.26.3+. make ci clean: vet + golangci-lint (0 issues) + test + race + govulncheck.

v26.05.12

Highlights

Quality-audit hardening release. Addresses all HIGH and MEDIUM findings from QUALITY_AUDIT.md (commit bf58ddb baseline).

Code quality

• Refactored cmd/post.go, cmd/approval.go, cmd/doctor.go, cmd/schedule.go into small testable helpers (cognitive complexity reductions)
• Made internal/auth keyring backend injectable for integration tests
• Up-front validation in cmd/batch.go (text 5–3000 chars, author_urn prefix, reaction type) with classified error codes

Correctness

• Fixed Rest.li URN encoding in internal/api/urn.go to escape /, ?, #, &, = (was only % and :)
• Capped HTTP record/replay response bodies at 8 MiB; dropped content-type gate so opaque bodies still flow through redaction

Tests

• Split 1013-line internal/output/schema_test.go into 19 per-feature files
• Total coverage 72.2% → 81.3%; every package now ≥75%
• Added keyring backend integration tests and approval store internal tests

Security

• Bumped Go 1.26.2 → 1.26.3 to clear stdlib net / net/http vulnerabilities (GO-2026-4918 et al.)
• Bumped golangci-lint-action v6 → v9 (matches v2 config schema; pinned to golangci-lint v2.12.2)

Install

# Go
go install github.com/mudrii/golink@v26.05.12

# Homebrew (tap is this repo)
brew tap mudrii/golink https://github.com/mudrii/golink
brew install mudrii/golink/golink

Requires Go 1.26.3+. Tested with brew test + brew style on macOS arm64.

golink 26.05.05

golink 26.05.05 is the date-versioned release replacing the previous v1.0.0 tag.

Versioning convention:

• Git tags use vYY.MM.DD so Go module installs remain valid.
• Displayed release versions use YY.MM.DD.

Highlights:

• LinkedIn OAuth login with native PKCE and standard OAuth 2.0 fallback.
• Posts, comments, reactions, organization posting, social metadata, scheduling, batch operations, approval gates, plan/execute workflows, diagnostics, and JSON/JSONL/table/compact output modes.
• Privacy-safe audit logging and HTTP record/replay redaction for tokens, URNs, emails, paths, and free-text payloads.
• Agent skill for Codex/OpenAI agents, OpenClaw, Hermes, and other CLI-capable agents.
• Homebrew formula updated to the date-based tag.

Install:

go install github.com/mudrii/golink@v26.05.05
brew install mudrii/golink/golink

Setup docs: see README.md and LINKEDIN_SETUP.md for LinkedIn Developer app scopes, redirect URI setup, OAuth flow selection, and troubleshooting.

Validation before release: make release-check passed.