Chris Tate
2e38882664
* add security hardening features - Add authentication vault (`auth save/login/list/show/delete`) so credentials are stored locally and never exposed to the LLM (fixes Snyk W007) - Add `--content-boundaries` flag to wrap page-sourced output in structural markers, helping LLMs distinguish tool output from untrusted page content (fixes Snyk W011) - Add `--allowed-domains` flag to restrict browser navigation to trusted domains - Add `--action-policy` for static allow/deny gating of action categories, with opt-in `--confirm-actions`/`--confirm-interactive` for orchestrator or human-in-the-loop confirmation - Add `--max-output` flag to truncate large page outputs, preventing context flooding - New docs page at /security, updated README, SKILL.md, CLI help text, and templates * fixes * fixes * fixes * fixes * fixes * fixes * fixes * docs * prepare v0.15
Changesets
This project uses Changesets for versioning and changelog generation.
Adding a changeset
When you make a change that should be released, run:
pnpm changeset
This will prompt you to:
- Select the type of change (patch, minor, major)
- Write a summary of your changes
The changeset file will be committed with your PR.
Release process
When changesets are merged to main, the release workflow will:
- Create a "Version Packages" PR that updates version numbers and changelogs
- When that PR is merged, packages are automatically published to npm