v4.16.0

4.16.0 (2026-05-25)

Features

• catalog: add IT Glue Printing Press spec (#2063) (48ec8d0)
• cli: add OAuth device-code auth generation (#2171) (15739cc)
• cli: hook agentcookie secrets bus into the generator (#1972) (8bae9aa)
• skills: add oauth grant reachability probe (#2148) (1fa5614)
• skills: capture reachability 4xx body hints (#2150) (9d72564)
• skills: offer reprint spec enrichment before handoff (#2154) (163e4bc)

Bug Fixes

• ci: clarify review feedback gates (#2146) (eb4decb)
• cli: accept nested internal body schemas (#2161) (08eaf12)
• cli: add data-source strategy contract (#2174) (552e5e8)
• cli: add editable store migration extras hook (#2172) (79c0c6f)
• cli: allow reserved PII placeholders (#2159) (deeeb71)
• cli: allowlist reserved synthetic values and GitHub IDs in PII scanner (#2165) (77b5a16), closes #1589 #1343 #1477
• cli: annotate help-only parent-grouper commands mcp:read-only (#2158) (e594d2c)
• cli: count parent-grouper scorecard commands (#2176) (4c42770)
• cli: credit positional type fidelity (#2178) (2e4aded)
• cli: default generated sync max-pages to unlimited (#2151) (9b30c01)
• cli: derive BaseURL from spec source URL for relative-only servers (#2175) (c0e5b4a), closes #1383
• cli: derive MCPBinary from api_name slug not spec title (#2149) (140b418), closes #1473
• cli: detect Mailchimp/Linear/Anthropic key shapes in secret scanner (#2162) (6e6fc29), closes #1593
• cli: infer sniffed response type stubs (#2164) (bebc256)
• cli: make scoreVision 10/10 reachable (#2163) (8208ab8), closes #1721
• cli: raise generated CLI default request timeout to 60s (#2157) (dba4b9e), closes #1626
• cli: reject placeholder URLs when inferring auth key URL (#2169) (e0edc96), closes #2011
• cli: restore canonical prediction-goat learn loop (engine + schema + package + CLI) (#2200) (cc7e69c)
• cli: reword UpsertBatch cache-index warning to not imply data loss (#2221) (b5267a8), closes #1224
• cli: store only basename for local spec_path in manifest (#2156) (4a92662), closes #1587
• cli: store synced_at as RFC3339 UTC so SQLite strftime works (#2173) (b01b62e), closes #1588
• cli: streamline oauth login setup (#2177) (7709698)
• cli: support csv array body fields (#2160) (1f8d390)
• cli: unwrap nested data list envelopes (#2126) (1a9aec8)
• cli: wire GraphQL query list variable (#2152) (c9e39d7)
• generator: preserve required bool flag presence (#1940) (5157252)
• skills: rerun live dogfood during publish (#2155) (d8f806e)
• skills: route polish instrumentation through client (#2168) (5929945)
• skills: warn on multi-spec directories (#2167) (93d43b5)

Code Refactoring

• cli: collapse Recall *entities.Config into Opts.EntityConfig (#2189) (0c3f032)