v0.2.0

Highlights since v0.1.0

Security & correctness

• Fixed a ReDoS bypass in the regex-safety guard
• Fixed an info-disclosure bug: /stats was leaking raw request content over the network (redacted now; library callers via TelemetryStore.stats() still get full data)
• Fixed a write-barrier concurrency bug
• Fixed upstream-path handling
• Fixed a deferral regex lastIndex bug that caused silent partial extraction

Features

• Divergence tracking (previously dead code) is now working
• New --upstream-timeout CLI flag

Breaking change

• assemble() dropped its third parameter

Packaging

• Fixed a bug where the published package shipped no .d.ts files despite package.json declaring types - TypeScript consumers now get real type information
• Added test/e2e/package/ - verifies the actual packed npm artifact (library import + type-check, CLI via npx, standalone proxy) rather than just source

Docs

• Added a "Using with Claude Code" section (ANTHROPIC_BASE_URL), with an explicit note that Claude Desktop is not supported
• Clarified that the validation report's production numbers came from real Claude Code subscription traffic routed through the proxy, not metered API billing
• Added TL;DR sections to the README and validation report

See the validation report for the full methodology and numbers.