v0.7.11

release: 0.7.11 — finding-led positioning + PR-trail study post

Reframes every published surface around the measured finding (0% OWASP
greenfield / 13% edit-mode footguns) instead of generic "high-signal,
low-noise" adjectives that had converged into category wallpaper. Adds
a demo GIF, encloses the PR-trail field study with its reproducible
receipt script, and publishes the Glama ownership file.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

v0.7.10

release: 0.7.10 — fix mcpb/Smithery bundle crash, MCP tool metadata

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

v0.7.9

release: 0.7.9 — per-rule path scoping + docs-prose carve-out (Backst…

v0.7.8

release: 0.7.8 — dependency-manifest goes section-aware (version bump…

v0.7.7

Full Changelog: v0.7.6...v0.7.7

v0.7.6

v0.7.6 — distribution plumbing

v0.7.5

release: 0.7.5, republish with updated README after 0.7.4 publish

v0.7.4

feat: git history audit, gate hardening, and 0.7.4 rule coverage

Squash of feat/check-history-scan (7 commits):

- diffgate check can audit git history per-commit: --since/--range/--author/
  --ai-authored/<sha>, --limit. Report-only, sourced from git objects (no
  checkout/mutation), honors --json/--fail-on.
- diffgate check accepts space-separated flag values (--range A..B), not just
  --flag=value.
- Silent-failure sweep: the gate path can no longer exit 0 on a failure to run
  (non-git dir, unresolvable --base/--range, invalid --fail-on all now exit 2);
  --json/--sarif/--github now carry the real gate exit code.
- dangerous-exec (JS/TS) no longer flags RegExp.prototype.exec(); path-traversal
  (JS/TS) is guard-aware (path.basename wrapper, startsWith containment check).
- permissive-cors extended to all 8 AST-precision languages (was JS/Python/PHP):
  Go, Ruby, Java, C#, Kotlin, covering both wildcard/allow-all configs and
  reflected-Origin writes; explicit allowlists are not flagged.
- hardcoded-secret recognizes AI-era provider key formats (Anthropic, OpenAI,
  Hugging Face, GitLab, npm), kept in sync between the rule and classifySecret.
- research/ (internal experiment scripts) untracked and gitignored — not part
  of the shipped tool.

769 tests green, typecheck clean, extension smoke passing.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

v0.7.3

chore: add .env.example for marginal/AI provider runs

Documents the provider API-key env vars (read via the LLM registry, not
inline process.env) and the custom-endpoint overrides for `diffgate marginal`.
.gitignore gains `!.env.example` so the template is trackable while `.env`/`.env.*`
stay ignored. The deterministic engine needs none of these.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

v0.7.2

chore: readme & security docs