v4.3.0

4.3.0 (2026-05-11)

Features

• cli: add cliutil.ExtractNumber/ExtractInt for JSON-string-encoded numeric fields (#1002) (182395c), closes #989
• cli: emit nested-object body fields as parent-prefixed flags (#957) (ebc8cd8)
• cli: mechanical PII gate before promote/publish (#958) (#1023) (a3e07d0)
• cli: point users at where to get a token (URL + instructions + auth setup --launch) (#871) (4fac827)

Bug Fixes

• cli: allow runtime override of OAuth2 OIDC URLs (#970) (a9e9d00)
• cli: bind typed upsert values in column-declaration order (#1018) (fef70ba), closes #1014
• cli: block vendor-prefix secrets during publish (#852) (8cf5459)
• cli: classify doctor HTTP 403 as scope-limited WARN, not invalid FAIL (#1033) (b1dded7)
• cli: emit AccessToken-only AuthHeader for all OAuth2 grants (#1010) (3b05089)
• cli: emit form-encoded request bodies (#947) (48cc2a3)
• cli: emit multipart requests for upload endpoints (#904) (fc291ca)
• cli: fold per-spec base URL path prefixes on multi-spec merge (#995) (6e086c0)
• cli: force UTF-8 stdio in verify-skill Python subprocess (#985) (cb1697e), closes #976 #819
• cli: gate sync since-param emission per resource (#1036) (dc5e8c5)
• cli: handle empty sync pages (#903) (d94d89d)
• cli: hide raw resource groups when api browser is generated (#1045) (ed693b0)
• cli: honor --resources filter in dependent sync fan-out (#1047) (e2f3a53)
• cli: honor auth.prefix on bearer_token specs (#1054) (d2770e1)
• cli: infer resource-prefixed IDField from item-schema properties (#938) (6cd57cc)
• cli: isolate generic resources by type (#901) (ff75531)
• cli: preserve hand-edits to templated files on --force regen (#967) (618fa45)
• cli: preserve internal sibling packages on force regen (#897) (dceb6e5)
• cli: reconcile MCPB manifest against internal/client env reads (#859) (#1035) (c93ce0c)
• cli: reject control-plane flag injection in MCP shellout (#1022) (4b04f4c)
• cli: reject reserved placeholder hosts in spec validation (#984) (5f8dae1), closes #818
• cli: route explicit --csv/--quiet/--plain above piped-pipe gate (#968) (ab6edbe), closes #918
• cli: seed template-var placeholders in verify mode (#934) (a1d39bf), closes #893
• cli: Store.Get propagates sql.ErrNoRows so callers can gate on existence (#1031) (66fd401)
• cli: sync skips resources with unresolved {key} placeholders (#1009) (5fabad6)
• cli: walk parent dirs for research.json in live-check (#1057) (9a07f28), closes #885
• generator: preserve multi-spec server prefixes (#861) (3e56bed)
• generator: rename trailing '_test' stems to avoid Go test-file exclusion (#1020) (#1021) (a03a7b8)
• generator: route receiver JSON helper through filters (#933) (e952e80)
• skills: forward --research-dir to scorecard --live-check in mid-pipeline polish (#980) (e0240ce)
• skills: gate polish Publish Offer on --standalone, not path detection (#1017) (54f007f), closes #1008
• skills: preflight Go toolchain before generation runs (#973) (0562bca)