4.0.6 (2026-05-08)
Bug Fixes
- cli: close MCP sql tool exfiltration vector with allowlist + read-only handle (#709) (b196bd8)
- cli: correct named-array envelope detection and api_key set-token slot (#706) (c46cf01)
- cli: dedupe TypeField identifiers in same struct (#705) (d1c3371), closes #697
- cli: gate orphan token scaffolding on auth surface (#704) (35d7e84)
- cli: parse x-mcp extension in OpenAPI parser (#702) (41c87cf)
- cli: shard sub-resource tables per parent on collision (#707) (1023054)
- cli: source store columns from response schema, not query params (#708) (9e039c0)