v4.7.0

4.7.0 (2026-05-15)

Features

• cli: surface per-endpoint evidence and confidence from browser-sniff (#1397) (f32214e)
• skills: contain session-state.json outside DISCOVERY_DIR (#1425) (55b0f16)

Bug Fixes

• cli: align publish-skill contract tests with api-slug staged path (#1459) (c57345a)
• cli: archive merged spec for multi-spec generate runs (#1432) (44f1ff7)
• cli: bypass response cache when polling async jobs (#1429) (acbb3df)
• cli: clear every emitted credential field in ClearTokens (#1433) (2bf7d1e)
• cli: derive doctor auth.verify_path from me-shaped endpoint (#1431) (95f0350), closes #1161
• cli: derive doctor probe path from auth.verify_path or me-shaped endpoint (#1406) (d022660), closes #1118
• cli: descend --select into list-envelope responses (#1379) (3bcb9d9), closes #1143
• cli: drop shell line comments + skip happy_path on missing file fixtures (#1378) (295fd03)
• cli: drop unused client import from param-less endpoint command files (#911) (72adfef)
• cli: emit structured JSON error from parents invoked without a subcommand in --agent mode (#1373) (fb9125e)
• cli: emit WithNumber/WithBoolean for OpenAPI-parsed numeric MCP params (#1372) (1f1b0bd)
• cli: extend verify-skill recipe scan to README.md (#1430) (73fe567)
• cli: force sync concurrency=1 under PRINTING_PRESS_VERIFY to avoid SQLITE_BUSY (#1441) (b8b1b6a)
• cli: handle single-quoted args in validate-narrative shell tokenizer (#1424) (33a6668), closes #1159
• cli: honor explicit "mcp:read-only": "false" in tools-audit (#1485) (ede5c35), closes #891
• cli: isolate typed-table upsert failures with per-item SAVEPOINT (#1402) (89f38c4)
• cli: kebab-case SKILL.md and README endpoint examples (#1445) (bd4dc64), closes #1270
• cli: make cookie-auth login --chrome work on Windows (#1404) (fdca9f7)
• cli: pick gid/sid/uid before name in PK heuristic (#1465) (01c816d), closes #1394
• cli: populate printer + run_id in generated .printing-press.json (#1442) (a1098f1)
• cli: preserve OpenAPI param casing in detected pagination (#1460) (272d8e8), closes #1353
• cli: propagate PRINTING_PRESS_VERIFY=1 to browser-session-proof probe (#1458) (dbfc611), closes #1389
• cli: query generic resources_fts from search empty-type branch (#1462) (35e515c), closes #1390
• cli: research-dir state.json api_name overrides info.title-derived name (#1476) (a9ffa08), closes #1375
• cli: scope HOME/XDG_CONFIG_HOME for verify/dogfood subprocesses (#1416) (c5a51ea)
• cli: stop generated main.go from printing every error twice (#1411) (46ad86b)
• cli: strip root-level binaries from staged publish tree (#1449) (096411c)
• cli: substitute server-URL variables from env vars at runtime (#1448) (e36050f), closes #1295
• cli: tighten phone-us PII regex to NANP-valid first digits (#1405) (1596497)
• cli: validate &&-chained narrative recipes segment-by-segment (#1447) (bb5e2de), closes #1271
• generator: support single-env basic auth credentials (#1381) (ac83f0f)
• skills: canonicalize auth env var when slug-derived differs (#1428) (2988814), closes #1157
• skills: correct install-internal-skills.sh path to repo skills/ (#1342) (5a04aca), closes #869
• skills: emit PRINTING_PRESS_BIN marker so later phases survive PATH non-inheritance (#1399) (2698690)
• skills: use api-slug in publish Step 6 staged path (#1444) (ce3aeb4), closes #1233