v4.30.3

4.30.3 (2026-08-17)

Bug Fixes

• cli: accept object release ledger changes (#4118) (31f2436)
• cli: align auth set-token references with command surface (#4198) (6dc0cee)
• cli: allow ungated MCP tenant gate (#4171) (9d274a9)
• cli: bind MCP HTTP to loopback by default (#4192) (142617f)
• cli: block MCP filesystem destination flags (#4212) (20d5058)
• cli: bound workflow archive and keep the store crash-safe (#4206) (1515265)
• cli: bump Go floor to 1.26.6 (#4155) (f8b50c9)
• cli: clamp MCP code-orch search limit before slice. Closes #3742. (#4223) (808a986)
• cli: collapse html error bodies (#4183) (7389a2f)
• cli: correct novel scaffold safety hints (#4172) (023beb3)
• cli: decouple agent mode from yes (#4182) (e20b65e)
• cli: disable sqlite mmap to stop SIGBUS store corruption (#4191) (bd6c65e)
• cli: encode path params as single segments (#4184) (d49c457)
• cli: fail sync integrity and hydration aliasing (#4185) (801de21)
• cli: guard shipcheck live mutations (#4173) (c63890c)
• cli: handle auth-none generation metadata (#4113) (91fb730)
• cli: harden generated SQLite concurrency (#4138) (ee01a6e)
• cli: parse SQLite CURRENT_TIMESTAMP in ParseStoredTime (#4224) (813788f)
• cli: preserve .git on lock promote in-place (#4194) (5568e71)
• cli: preserve compact and select projection payloads (#4135) (d74ddbf)
• cli: preserve generated pagination contracts (#4115) (fd69e7f)
• cli: preserve mcp-sync intent parity and reject version skew (#4146) (8b2c361), closes #4134
• cli: preserve OAuth bearer auth headers (#4112) (1a5f6ca)
• cli: preserve standalone force regen files (#4174) (4b3569f)
• cli: preserve zero-valued integer query params (#4143) (5e77ac1)
• cli: register novel framework commands and manifest entries (#4139) (a529a81)
• cli: repair credential load refusal and merge state (#4205) (1e8fe39)
• cli: route generated error output and preserve no-op semantics (#4121) (eae5b3d)
• cli: sanitize insights similar FTS queries (#4213) (2b69deb)
• cli: scope browser credentials by host (#4107) (1a1a65f)
• cli: scope the default store path to the credential (#4204) (c5bc30e)
• cli: speed up generated Windows shellout tests (#4119) (781a1c7)
• cli: stop name-keying records when a real identifier exists (#4215) (a6eb395)
• cli: stop storing nested objects as sync rows (#4226) (9bac860)
• cli: surface success-path CLI stderr to MCP clients (#4225) (8136196)
• cli: treat unclassified dogfood commands as mutating (#4193) (ca3a6dd)
• cli: validate composed-auth login --chrome sessions (#4207) (6a54174)
• cli: wire stdin fixtures through verification (#4136) (a6923ce)
• skills: refuse physical side effects under every harness (#4203) (a5400a4)
• windows: generated CLIs could neither build nor test on Windows (#4106) (deb0b07)