v4.10.0

4.10.0 (2026-05-21)

Features

• ci: mirror supply-chain hardening from printing-press-library (#1619) (f671b7b)
• cli: add auth set-token escape hatch for cookie-auth CLIs (#1641) (275646a)
• cli: add cliutil.LooksLikeJWT shared validator with length floor (#1602) (b5b1dd5)
• cli: add Quo (formerly OpenPhone) catalog entry and OpenAPI spec (#1597) (1a24381)
• cli: add sync --path-context KEY=VAL runtime override for template placeholders (#1631) (766354e)
• cli: default mcp.transport=[stdio, http] for small APIs (#1629) (14bc18a)
• cli: detect Auth0 SPA in-memory auth + emit CDP extractor (#1645) (015478b)
• cli: flag empty defaultSyncResources at dogfood time (#1633) (042a78d)
• cli: GraphQL credential probe in doctor + actionable copy (#1701) (b534884)
• cli: press-auth companion for cookie capture + generated CLI integration (#1466) (89816d4)
• cli: rename generator binary to cli-printing-press (#1722) (7c4bedd)
• skills: check public library for existing CLI before generating (#1650) (81f07e5)

Bug Fixes

• ci: allow queue drafts to skip Greptile (96bc822)
• ci: trust queued Greptile gate (9a47433)
• cli: correct live-check and helper emission (#1637) (8c95570)
• cli: create llm prompt temp files privately (#1674) (c5d8682)
• cli: detect path params in browser-sniff URL grouper (#1657) (2c3271f)
• cli: dogfood prefers bundled <dir>/spec.yaml over caller --spec (#1625) (17cd277)
• cli: emit structured cache_warning JSON on auto-refresh failure (#1632) (187b699)
• cli: gate ship plans on agent readiness (#1638) (ed17d30)
• cli: handle binary-only response endpoints (Accept + base64 envelope) (#1574) (d817807)
• cli: harden browser-sniff PII placeholders (#1639) (7eee7df)
• cli: harden manifest-gen remote spec loader against hangs and silent truncation (#1699) (aecf495)
• cli: make live-dogfood runner enum-aware and resilient to empty outcomes (#1656) (cda9b43)
• cli: polish press-auth output and make spec warnings testable (#1710) (61f919a)
• cli: redact shipcheck api key in json (#1673) (4093ef3)
• cli: require documented flags in verify-skill (#1707) (595ed9e)
• cli: resolve shipcheck CLI binary name from .printing-press.json (#1700) (9eff1e2)
• cli: return failure exit from verify json (#1693) (5261ae7)
• cli: route Swagger 2.0 specs through openapi2conv to avoid OOM on circular refs (#1630) (e798f67)
• cli: sync pagination, auth aliases, narrative timing, and codex prompt (#1341) (ac3e15b)
• cli: verify-mode HTTP-verb short-circuit + N1 envelope + doctor + read-only POST bypass (#1398) (75e4d1b)
• skills: Clarify publish skill's PR review loop and terminal state (#1713) (6870329)
• skills: reprint discovers and carries prior patches (#1649) (f9bb82c)
• skills: stop phase 4.95 code review from being skipped (#1655) (5cb39a6)