1.0.0 (2026-03-26)

Bug Fixes

• add cache-busting param to screenshot URL (#82) (4aee8db)
• add chunked writing instructions to all agent prompts (30b5522)
• add file_path parameter to save_deliverable for large reports (#123) (2f4fa89)
• Add Linux support for Docker volume permissions (11fdb69)
• add universal billing error detection for router mode (9606ffc)
• auto-detect Podman to avoid host-gateway incompatibility (#117) (a5daa07)
• configure git to trust all directories in Docker (515ade8)
• copy deliverables to audit-logs once at workflow end instead of per-agent (7f9c5cc)
• critical bug - exploitation phase was always skipped (cfe8dc8)
• enable Playwright MCP browser automation in Docker containers (f40f52f), closes #docker-playwright-browser-issues
• ensure deliverables directory is writable by container user (#116) (24bcd29)
• err handling for claude code session limit (cc36fe9)
• extend heartbeat timeout to prevent stalls during sub-agent execution (#108) (9809c76)
• improve resume edge cases and shell quoting (539bd87)
• mount repos and configs directories into worker container (#107) (2e9ee2a)
• pass router env vars to SDK subprocess (742b74c)
• prevent deliverables from being lost during agent retry rollbacks (#112) (efb5368)
• removed comments (23618f1)
• renamed agent filename (bbd9db2)
• resolve Docker build failure and clarify env var configuration (719bf03)
• resolve named workspace workflow ID in logs command (759c8d8)
• resolve resume workflow ID in logs command (2cf237d)
• restore CLAUDE_CODE_MAX_OUTPUT_TOKENS env var support (c169b0d)
• set originalWorkflowId in logPhaseTransition and remove path import from agents.ts (f017a41)
• set write permissions on audit-logs and output directories for container user (65aa562)
• store checkpoint as success commit hash and show cumulative metrics (1b696ca)
• support absolute config paths in checkpoint manager (39766d0)
• update session.json status on workflow completion (dbcb458)
• use session's original createdAt instead of current time (f0b8c3a)

Features

• add beta release and rollback workflows with cosign signing (#247) (601fbe7)
• add claude-code-router support for multi-model testing (914860a)
• add configurable output directory with --output flag (#41) (8381198)
• add configurable pipeline retry and concurrency settings (#157) (d67c07d)
• add custom base URL support for Anthropic-compatible endpoints (#246) (ae4bd45)
• add DeepSeek provider support for claude-code-router (d925c49)
• add environment variable support for Claude Code token limits (0b9580a)
• add Google Vertex AI support with service account auth (6a76df2)
• add issue templates (#110) (77c5b26)
• add model tracking and reporting across pipeline (cd04c7a)
• add MSYS path fix, Claude Code CLI, and Windows instructions (e85f6e0)
• add named workspaces and workspace listing (ee5d7b8)
• add npx CLI with monorepo, CI/CD, and ephemeral worker architecture (#256) (bc8fd20), closes #252 #254 #255
• add OpenRouter provider support for claude-code-router (d01980c)
• add preflight validation phase with structured error reporting (c0d46cb)
• add resume header to workflow.log showing previous workflow ID and checkpoint (9074149)
• add three-tier model system with Bedrock support (b62abfe)
• add workflow resume from workspace via --workspace flag (f932fad)
• copy deliverables to audit-logs for self-contained audit trail (80bc8e3)
• expand injection analysis scope to cover LFI/RFI/SSTI/Path Traversal/Deserialization (d82d1fa)
• implement unified audit system v3.0 with crash-safety and self-healing (27334a4)
• improve audit log naming with timestamp and app context (258830b)
• migrate to use MCP tools instead of helper scripts (eae0b8d)
• typescript migration (#40) (3ac07a4)
• upgrade claude-agent-sdk to 0.2.38 and adapt to new SDK types (#113) (3c13a9a)

Reverts

• remove '402' billing pattern causing false positives (63741d7)