v0.7.0 — sally badge: wear the verdict

v0.7.0 — sally badge: wear the verdict

Your repo's verdict badge, without the copy-paste ritual.

New

• sally badge — prints the ready-to-paste badge markdown for your README, plus your current verdict. Burns zero quota: it reads the badge's ETag instead of running a fresh verdict.
• sally badge --add — inserts the badge into README.md right under the title. Idempotent: run it twice and Sally just compliments your enthusiasm.
• No verdict yet? Sally refuses: "A badge without a verdict is just a sticker. Earn it first: sally verdict."

Improved

• sally verdict now points to sally badge --add after printing the markdown — one command from judged to badged.
• Welcome screen and README document the new command.

The badge image updates automatically on every new sally verdict — add it once, judged forever.

Published to npm with SLSA provenance and to the MCP Registry via trusted publishing (OIDC). The attached .mcpb is the Claude Desktop bundle.

npm i -g @cynicalsally/cli@latest

v0.6.2 — Magic-link login resilience

v0.6.2 — Magic-link login resilience

Hardens sally login against transient backend hiccups.

Fixed

• sally login no longer fails on a one-off server/network blip. The magic-link request now retries (with backoff and a 30s timeout) on 5xx and connection/timeout errors, and only surfaces an error if it genuinely can't get through. Rate-limit (429) and invalid-email responses are never retried — so you fail fast when you should, and recover quietly when it's just a cold connection.

Cosmetic-free, behaviour-only. Published to npm with SLSA provenance and to the MCP Registry via trusted publishing (OIDC).

npm i -g @cynicalsally/cli@latest

v0.6.1 — Welcome screen polish

v0.6.1 — Welcome screen polish

A small follow-up to v0.6.0.

Fixed

• Tidied the sally verdict line in the welcome screen so its description no longer wraps mid-word on narrower terminals.

Cosmetic only — no behaviour changes. Published to npm with SLSA provenance and to the MCP Registry via trusted publishing (OIDC).

npm i -g @cynicalsally/cli@latest

v0.6.0 — Growth & memorability

v0.6.0 — Growth & memorability

Strong top-of-funnel, weak conversion: this release closes the activation and memorability gap so visitors become users (and stars).

New

• First-run guided roast — sally with no args now offers to roast your directory on the spot. Value in 20 seconds, not a wall of commands.
• Verdict badge, front and centre — sally verdict is elevated in the welcome screen, nudged after you keep coming back, and now has its own README section. Score an 8+ and the badge is a flex worth wearing. Every README that wears it links back.
• Share at the moment of delight — a high score surfaces a one-tap, receipt-framed share nudge (--share publishes only the score + Sally's one-liner, never your code).
• Sally remembers your sins — recurring issues across runs get called out ("that's the 4th time you've shipped this"). Entirely local.
• Signature everywhere — a subtle "Roasted by Cynical Sally" line on CLI roasts and every MCP tool response — so Sally travels in your screenshots.
• Activation telemetry — a one-time, code-free CLI-FIRST-ROAST signal (score bucket + mode only) so real activation is finally measurable.

Changed

• README "Full Suite" reframed from a tool catalogue into three outcomes: ship faster, be less embarrassing, polish for humans.

Internal

• Reusable trackEvent helper (install ping now leans on it).
• runRoast() extracted so the command and the guided flow share one implementation.
• Background log (~/.sally/bg.log) capped at 256 KB.

Published to npm with SLSA provenance and to the MCP Registry via trusted publishing (OIDC).

npm i -g @cynicalsally/cli

v0.5.2 — install ping

What's new in v0.5.2

Install analytics — one-time install ping. Sally now fires a single, fire-and-forget CLI-INSTALL event on the first run of a fresh install. This makes real, used installs visible alongside the existing per-device review/tool journey — so the dashboard can show installs → first roast → returning developers.

Details

• Privacy-first: sends only an anonymous install fingerprint (random deviceId, version, OS, Node version) — never any code. The same data already accompanies every review.
• Non-blocking: 5s timeout, never delays or breaks a command, fails silently when offline.
• Once per install: the flag is only set after a successful ping, so a (rare) offline first run simply retries next time.

No user-facing behavior changes. Backend already understood the CLI-INSTALL event — no server changes required.

---

🔒 Published to npm with provenance (SLSA, OIDC) + MCP Registry.
📦 .mcpb bundle attached below for Claude Desktop one-click install.

v0.5.1 — Sally explains herself

Metadata-only release: all 8 MCP tool descriptions rewritten to TDQS grade.

• Behavioral transparency on every tool: what gets sent (only what you point at), what doesn't (never stored, never used for training), and that Sally never modifies files.
• Sharper usage triggers so agents know exactly when to reach for each tool.
• Richer parameter docs: language codes with examples, tone options explained, concrete input formats (git diff main, gh pr diff).
• sally_usage grew from one bare line into a real description.

No behavior changes — same tools, same backend, same quota. Published with SLSA provenance via trusted publishing.

v0.5.0 — Share your shame

What's new

🔗 sally roast --share

Publish a roast as a public card link (cynicalsally.com/card/…) — only the score and Sally's one-liner go public, never your code. Opt-in, always. The MCP sally_roast tool has the same share flag.

⭐ Sally asks for the star

After your third roast, Sally asks for a GitHub star. Once. She has standards.

🎬 Demo GIF

A real roast, recorded live, at the top of the README — see exactly what you're installing.

🔏 First release with npm provenance

Starting with this release, every package is published from CI with a SLSA provenance attestation — cryptographic proof that the package on npm was built from this exact repo and commit. Verify it yourself: npm audit signatures.

Install

npm install -g @cynicalsally/cli

MCP one-click for Claude Desktop: download cynical-sally.mcpb below.

v0.4.0 — See exactly what leaves your machine

Trust you can verify, not just read. This release is about proving — not promising — that your code stays yours.

☢ sally roast --dry-run — see exactly what leaves your machine

Before a single byte is sent, Sally shows you the exact payload a real roast would upload:

• every file with its byte size, a token estimate, and a SHA-256 hash
• every file that was held back and why — secrets (.env, keys, certs), binaries, oversized files, .gitignore matches
• a local SHA-256 receipt written to .sally/ so you can verify it byte-for-byte

…and it sends nothing. The MCP sally_roast tool gets the same thing via a preview flag.

sally roast --dry-run ./src/

📇 sally roast --card

A shareable, screenshot-friendly roast card — score, one savage line, two findings, repo URL — saved to .sally/.

🔏 Signed releases

Packages now publish with npm provenance: a public, cryptographic attestation linking each release to the exact source commit and CI build.

📄 Privacy, in engineering detail

New docs/PRIVACY.md: full data-flow diagram, retention table, subprocessors, and log policy. Your code is never written to disk, logs, error traces, or APM — and now you can verify it yourself.

---

Reviewed and forgotten. Now with a receipt.

v0.3.1 — Reviewed and forgotten

A small one, all about trust. Sally now tells you up front what she does — and doesn't do — with your code.

New

• First-run privacy notice — after your first roast, Sally says it plainly: she doesn't remember your code, your secrets, or your next billion-dollar exit. Your files are reviewed and discarded.

Docs

• Clearer Privacy & Security in the README, and a new "Your Code" section on the privacy page: your code is sent only to generate the review, never stored, never trained on, sold, or shared — and only the files you explicitly point her at.

Install: npm i -g @cynicalsally/cli

v0.3.0 — Point and roast

This one's for the MCP side — Sally is smoother and smarter inside Claude Code, Cursor, and Windsurf.

New

• Point and roast — sally_roast now takes paths (files or directories). Sally reads them herself, skipping binaries and secret files, so your agent doesn't have to read and pass content. "Roast ./src" just works.
• Prompts — ready-made slash-command intents: roast, review-pr, and explain, for clients that surface MCP prompts.
• Progress on Full Truth — the deep-dive now sends progress updates, so your editor shows it's working instead of hanging silently.

Changed

• All 8 tools carry readOnlyHint annotations — Sally only reads your code, never writes — so agents can call her freely without second-guessing.

Install: npm i -g @cynicalsally/cli · Add to your editor: claude mcp add cynical-sally -- npx @cynicalsally/cli mcp

Point her at something. Tell her she's wrong. (She isn't.)