v1.1.0 — Scan API + False Positive Fix

What's New in v1.1.0

/api/scan Endpoint

Scan arbitrary text through FireClaw's stages 2–4 pipeline without fetching a URL. Perfect for:

• Tool descriptions and MCP server responses
• Memory artifacts and plugin outputs
• Any untrusted text that needs injection scanning

curl -X POST http://localhost:8420/api/scan \
  -H 'Content-Type: application/json' \
  -d '{"text":"untrusted content here","source":"mcp-tool"}'

Also accessible via /api/proxy with X-FireClaw-Action: scan header.

False Positive Reduction

Reduced Stage 4 output scanner aggressiveness — three patterns were triggering on legitimate content:

• unicode_trickery — no longer flags normal Unicode (curly quotes, em dashes)
• credential_request — scoped to actual extraction attempts, not contextual mentions
• sensitive_op_format — tightened to match real tool-call syntax, not prose

Community Threat Feed

Supabase-backed community threat feed verified working across instances. Anonymous detection metadata is shared with INSERT-only Row Level Security — no instance can read or modify another's data.

---

Full Changelog: See CHANGELOG.md