v0.11.4

What's New

Unicode Steganography Expansion

• UNICODE-STEGO-001 now detects zero-width characters (U+200B-200D), mid-file BOM (U+FEFF), and bidi overrides (U+202A-202E, U+2066-2069) in addition to existing variation selector and tag character detection
• UNICODE-STEGO-005 (new): Homoglyph confusable detection -- finds Cyrillic, Greek, and Fullwidth characters that visually impersonate Latin letters in source code. Skips comment lines to reduce false positives
• Expanded file type scanning: .py, .md, .txt, .yaml, .yml, .json, .toml now scanned alongside JS/TS
• Severity: bidi/variation/tag = critical, zero-width-only = high, homoglyphs = high

CI Mode

• New --ci flag for secure and scan-soul: suppresses interactive prompts, defaults --no-contribute, exits non-zero on any findings

Taxonomy Alignment

• All 27 attack class identifiers now match the OpenA2A Registry (attack_classes table)

Bug Fixes

• scan --json no longer outputs "Scanning..." text before JSON
• Backup directory (.hackmyagent-backup/) excluded from scans -- fixes phantom CRITICAL findings and stuck score after --fix
• rollback error message now references correct command (secure --fix instead of harden --fix)
• File paths in fix suggestion commands are now shell-escaped to prevent injection via crafted filenames

Contribution Transparency

• New buildContributionSummary() function for previewing what data would be shared