v13.7.0

Web sign-in now uses an OAuth code flow bound to the tab that started it (#569). Only that tab can finish sign-in, and PocketBase's realtime /api/oauth2-redirect route is turned off. This release also gets the Security Audit gate passing again (#570).

Self-hosters: this release changes sign-in. The Docker image carries the new hooks, so update the image, then register https://<your-server>/api/gsd/oauth-callback as the redirect URL with Google, GitHub, and Apple. The old /api/oauth2-redirect route now answers 404. See docker/README.md.

What's Changed

• fix(deps): floor browserslist at 4.28.7 to clear two high advisories by @vscarpenter in #526
• fix(security): resolve repository security review findings by @vscarpenter in #527
• chore(tooling): diagram-design profile marker and architecture diagrams by @vscarpenter in #528
• fix(sync): publish isEnabled on load, and add a sign out control by @vscarpenter in #530
• refactor(settings): split the account row and danger zone out of SyncSettings by @vscarpenter in #531
• fix(deps): bump next, sharp, and hono to patched versions by @vscarpenter in #532
• chore(security): drop vendored impeccable and ui-ux-pro-max skills by @vscarpenter in #533
• ci(security): harden workflow permissions and run scripts by @vscarpenter in #534
• fix(mcp): strip deleted ids from dependents after a bulk delete by @vscarpenter in #535
• fix(deps): bump vitest packages to 4.1.11 to clear audit advisory by @vscarpenter in #536
• fix(docker): put node_modules/.bin on PATH in the builder stage by @vscarpenter in #537
• fix(sync): fence stale sync writes after sign-out and reset by @vscarpenter in #538
• docs(mcp): pin install docs and server card to 1.2.6 by @vscarpenter in #539
• chore(ci): retire the development deploy by @vscarpenter in #540
• fix(docker): build the static export on real node instead of bun by @vscarpenter in #541
• chore(config): remove the retired gsd-dev host and staging environment by @vscarpenter in #542
• chore(deps): bump stagehand to 4.1.0 and playwright to 1.63.0 by @vscarpenter in #544
• fix(reset): fail closed when reset cannot delete local data by @vscarpenter in #543
• fix(notifications): find incomplete tasks without the completed index by @vscarpenter in #545
• perf: cut cold LCP on the first-visit path by @vscarpenter in #546
• feat(matrix): quiet topbar on scroll and touch swipe actions by @vscarpenter in #547
• fix(deps): floor proxy-addr at 2.0.8 for GHSA-jqcg-44mw-7w3h by @vscarpenter in #548
• fix(pwa): keep injected sw registration failures out of sentry by @vscarpenter in #549
• feat(sync): copy auth tokens from Cloud Sync settings by @vscarpenter in #550
• chore(quality): update PWA code-shape baseline by @vscarpenter in #551
• fix(mcp): import readline so the setup wizard can prompt by @vscarpenter in #552
• docs(security): state the hosted sync encryption posture by @vscarpenter in #553
• test(e2e): run critical journeys against the production export by @vscarpenter in #554
• perf(build): add a first-load JavaScript budget and two splits by @vscarpenter in #555
• fix(docker): keep the export Playwright config out of the image build by @vscarpenter in #556
• docs(mcp): pin install docs and server card to 1.2.7 by @vscarpenter in #557
• perf(sync): stop polling coordinator status while sync is idle by @vscarpenter in #558
• docs(prompts): fix stale tool descriptions and agent references by @vscarpenter in #559
• chore(mcp): bump @modelcontextprotocol/sdk to 1.30.1 by @vscarpenter in #560
• chore(mcp): release gsd-mcp-server 1.2.8 by @vscarpenter in #561
• fix(release): align README and sw.js with package version 13.5.1 by @vscarpenter in #562
• chore(deps): update dependencies and hold back four breaking bumps by @vscarpenter in #563
• chore(deps): migrate the root test suite to vitest 5 by @vscarpenter in #564
• Add Claude Code GitHub Workflow by @vscarpenter in #565
• refactor(telemetry): remove sentry from web app and mcp server by @vscarpenter in #566
• test(stagehand): add a labeled eval for the verify judge by @vscarpenter in #567
• chore(deps): repair dependency update and restore green main by @vscarpenter in #568
• fix(sync): bind OAuth sign-in to the tab that started it by @vscarpenter in #569
• chore(release): prepare 13.7.0 and clear the braces audit failure by @vscarpenter in #570

Full Changelog: v12.7.0...v13.7.0