v0.4.0

Added

• npm run release:prepare derives the next version from the Conventional Commits since the last release and updates the changelog, package.json, package-lock.json, CITATION.cff, and the marketplace manifests.
• mcp-egress-guard blocks a call to a Youdede MCP server whose arguments name a host outside that server's declared egress, including lookalike, subdomain, userinfo, IP, and punycode forms. It binds every MCP tool in Claude Code and ships a preview Cursor adapter; secure-agent-boundaries 1.2.0 includes it.
• Three workflow commands (diagnose-ci-failure, preflight-change-environment, audit-repository-instructions) and four contexts (API, migration, CI, and dependency baselines).
• Preview MCP profiles for the official GitHub server (v1.12.2, read-only reduced toolset) and Playwright MCP (0.0.82, isolated, loopback only), in the new remote-review-evidence and browser-verification packs.
• One shared command parser and capability matcher for every Bash hook (scripts/lib/shared-hook/shell-items.mjs, capability.mjs, inline.mjs). Each hook declares what it protects as a CAPABILITY and sees through wrappers (sudo, env, xargs, find -exec, eval, sh -c), substitutions, here-documents, Git aliases, globs, brace words, and interpreter one-liners such as python3 -c "os.system('npm publish')". A command it cannot read blocks only when it could touch what the hook protects.
• quality/hook-verdicts.json records the verdict of all 64 Claude Code hooks on about 2,500 inputs: hook tests, audit probes, command sequences, and everyday developer commands. npm test fails on a verdict change without a declared reason, and on a verdict that contradicts a reviewed expectation unless it is quarantined with a follow-up.

Changed

• npm run check:readiness no longer requires model-judged semantic evidence to publish. Model replies vary between runs (about one case in eight changed outcome between two near-identical full runs), so a single run cannot fairly pass or fail a release. Semantic evaluation stays as an advisory maintainer test, run after prompt or case changes, and the committed receipt quality/release-evidence/ is removed.
• Links between artifacts have three levels: required prerequisites (the installer asks once, default yes), suggestions (one hint line after an install), and related artifacts (catalog only). Each link has a short reason that the installer prints. catalog/artifacts.json and catalog/packs.json move to schema version 2 and keep every version 1 field; docs/catalog-format.md describes the format.
• Every Bash hook names shell-command-guard as a prerequisite, so a command that hides what it runs (bash -c "$X", curl … | sh) is stopped even when only one hook was requested. add installs it first (--no-prerequisites opts out), remove refuses it while another hook needs it unless --force, and five packs now include it.
• shell-command-guard owns every program a command runs without containing it: network output run by a shell is internet-to-shell, and any other unknown program is uninspectable. Shell setup output (eval "$(pyenv init -)"), local scripts, and static feeds pass. The other hooks leave such programs to it, which removes many false positives.
• The hooks that read what a commit will take inspect git add … && git commit, git commit -am, pathspec commits, and Git aliases instead of refusing or ignoring them. A commit in the same command as git add -f or an alias definition is refused: run them as separate commands.
• Behavioral cases are written for each artifact: a concrete request with its evidence, a near miss that belongs to a neighbouring artifact, a missing input, and a boundary that crosses one of the artifact's refusals. Every skill, subagent, command, and context is covered.
• GitHub Copilot skill adapters and Gemini CLI subagent adapters are stable, following the vendors' documentation (read 2026-09-26). Gemini CLI adapters state that Google stopped serving Gemini CLI on 2026-06-18 for free use and for Google AI Pro and Ultra.
• The Cursor adapters of the three read-only MCP servers are back to preview until the egress guard is verified in a live Cursor client.
• The npm package no longer contains the marketplace copies or the README images: about 1.4 MB instead of 4.8 MB, with identical CLI behavior.
• resume-session-work is published only for Claude Code, the only runtime where its session ledger installs.
• The summaries of mobile-release-readiness, browser-verification, session-continuity, and plan-and-verify-loop state what their members actually check.
• File-editing hooks take the project root from CLAUDE_PROJECT_DIR when it is set, so a cd into a subdirectory no longer hides or wrongly blocks an edit.

Fixed

• The situation rules shared by every prompt artifact no longer contradict themselves. A request outside the artifact's purpose declines and names what fits instead, partial or informal material is worked from with its gaps recorded, and only an absent required input stops the work. A refused embedded instruction is recorded on its own line instead of being reported as a finding.
• Full static reviews found and resolved contradictions or gaps in dozens of prompt artifacts: finding thresholds that excluded defects the same brief defines, steps a supported branch cannot follow, unsafe completion rules, and output instructions that disagreed with the output contract. Every prompt artifact, commands included, now states one checkable output contract, and check:contracts rejects a missing one or one that names an instruction section.
• 139 behavioral cases now contain the code, logs, plan, or data they refer to, so a reply can be judged on the evidence.
• Generated contexts state forbidding rules as prohibitions and summary rules as "When the task calls for it", and they install where Cursor and GitHub Copilot read them (.cursor/rules/, .github/instructions/) instead of doubled paths.
• commit-guard and prompt-secret-guard share one list of 117 credential formats with the repository scan. Before, they had 7 rules and let GitHub fine-grained tokens, npm, GitLab, and Google API keys, and PGP private keys through. commit-guard also refuses credential stores (.git-credentials, .netrc, cloud CLI credentials) and inspects content staged by the same command, aliases, git commit -nm, and core.hooksPath overrides.
• protected-branch-guard refuses git filter-branch, git filter-repo, and git fast-import; follows branch switches inside one command; resolves a bare git push through @{push}; and fails closed when Git cannot be read. Before, an alias, a push mapping, or a timeout could move main.
• shell-command-guard blocks /bin/rm -rf /, a root among several rm operands, a force push after Git global options or with -f next to --force-with-lease, bash <(curl …), a download that the same command then runs, and git checkout -f. It no longer blocks text quoted inside an argument.
• The six operation guards recognize many more publish, delete, apply, and service commands (cloud storage, Kubernetes, Terraform, Pulumi, registries, cron, launchd, systemd), npm abbreviations such as npm publ, package runners such as npx npm@10 publish, and value-taking global options. Several hooks no longer stall on sudo -- until the runtime timeout, which let the command run.
• release-clean-state-guard and release-version-consistency-guard gate mobile store uploads (fastlane, eas submit, xcrun altool, Gradle publish*) and check Xcode, Gradle, and Expo version sources. npm publish --access public and npm run build && npm publish no longer block.
• The system path, user account, firewall, container privilege, and archive extraction guards recognize many more mutating commands and name the rule they apply instead of "cannot be normalized".
• sensitive-file-access-guard blocks recursive searches, archives, and copies that include a protected file, and more reading tools; outbound-data-guard reads grouped curl options. Unquoted globs are expanded as bash does instead of blocking, so wc -l src/*.js passes.
• database-query-mode-guard treats SELECT … INTO as a write and reads every client call; migration-safety-guard covers more drop and reset forms and no longer blocks the TRUNCATE(x, d) function; schema-compatibility-guard handles reserved Protobuf fields, Avro defaults, and integer to number widening.
• ci-reference-pinning-guard and submodule-target-guard check the absolute paths Claude Code sends; before, they never fired there. Several hooks now run when invoked through a symlink instead of exiting without checking. mcp-capability-drift-guard refuses unknown servers and tools in any letter case, recognizes plugin-scoped tools, and uses Cursor's real MCP event.
• Smaller hook fixes: transport-security-regression-guard, unsafe-deserialization-guard, test-integrity-guard, debug-artifact-guard, lint-suppression-guard, api-contract-compatibility-guard, policy-file-guard, binary-mutation-guard, generated-file-guard, phase-gate-guard, tool-output-budget-guard, completion-evidence-guard, instruction-config-integrity-guard, and a prompt-secret-guard false positive on sk- words. The Italian and Dutch texts of four hooks no longer change the meaning of the English source.
• A Codex project-scope hook resolves its script from the Git root instead of the installing machine's absolute path, which pointed nowhere in a clone.
• The read-only MCP runtime no longer runs programs chosen by repository configuration (core.fsmonitor, gpg.program, filter drivers), refuses credential files at any depth, and negotiates the protocol version instead of echoing it.
• Installer: add --json and add-pack --json print JSON, options accept --name=value, --dry-run lists the notice file, a failed pack install or removal restores everything it touched, and the state lock refuses symbolic links.
• Commands: draft-evidenced-plan runs right after add-pack plan-and-verify-loop, re-pin-mcp-tools reads the current pins, audit-release-evidence reports ready only when every check passed and prints its report, and three commands declare the Bash tool their precondition step needs.
• Skill helpers: the SQL, CI workflow, supply chain, schema evolution, setup wizard, work graph, skill validator, and release notes helpers miss fewer cases and reject fewer valid inputs, and six skills run their scripts from <skill-root> so they work from the project directory.
• Domain facts now follow their sources: the CAN-SPAM postal address requirement, the WCAG large-text threshold (14pt bold), localization text growth, and where a European standard's citation is checked.
• Catalog entries match their installed artifacts (capabilities, languages, product names, and runtimes), and rag-evaluation-reviewer no longer lists a tool Claude Code does not have.
• The release workflow publishes the exact commit it verified. CITATION.cff and documented counts are checked against the package, the package ships every module its published scripts import, and documentation claims match verified behavior.

Removed

• scripts/set-publisher-identity.mjs: both decisions it applied are settled. The namespace is youdede/toolkit, and Youdede is the publisher's exact company name.
• Internal working plans (docs/plans), which check:package now refuses if they return.

Integrity

Root digest printed by the release job: sha256:10cdeb02f9b559d431e13002b0260867123c2c9136f1d4b6bfd779eaf6cd2826

Compare it with the published package: npx @youdede/toolkit verify-integrity

Provenance: sigstore transparency log