4.16.0 (2026-05-25)
Features
- catalog: add IT Glue Printing Press spec (#2063) (48ec8d0)
- cli: add OAuth device-code auth generation (#2171) (15739cc)
- cli: hook agentcookie secrets bus into the generator (#1972) (8bae9aa)
- skills: add oauth grant reachability probe (#2148) (1fa5614)
- skills: capture reachability 4xx body hints (#2150) (9d72564)
- skills: offer reprint spec enrichment before handoff (#2154) (163e4bc)
Bug Fixes
- ci: clarify review feedback gates (#2146) (eb4decb)
- cli: accept nested internal body schemas (#2161) (08eaf12)
- cli: add data-source strategy contract (#2174) (552e5e8)
- cli: add editable store migration extras hook (#2172) (79c0c6f)
- cli: allow reserved PII placeholders (#2159) (deeeb71)
- cli: allowlist reserved synthetic values and GitHub IDs in PII scanner (#2165) (77b5a16), closes #1589 #1343 #1477
- cli: annotate help-only parent-grouper commands mcp:read-only (#2158) (e594d2c)
- cli: count parent-grouper scorecard commands (#2176) (4c42770)
- cli: credit positional type fidelity (#2178) (2e4aded)
- cli: default generated sync max-pages to unlimited (#2151) (9b30c01)
- cli: derive BaseURL from spec source URL for relative-only servers (#2175) (c0e5b4a), closes #1383
- cli: derive MCPBinary from api_name slug not spec title (#2149) (140b418), closes #1473
- cli: detect Mailchimp/Linear/Anthropic key shapes in secret scanner (#2162) (6e6fc29), closes #1593
- cli: infer sniffed response type stubs (#2164) (bebc256)
- cli: make scoreVision 10/10 reachable (#2163) (8208ab8), closes #1721
- cli: raise generated CLI default request timeout to 60s (#2157) (dba4b9e), closes #1626
- cli: reject placeholder URLs when inferring auth key URL (#2169) (e0edc96), closes #2011
- cli: restore canonical prediction-goat learn loop (engine + schema + package + CLI) (#2200) (cc7e69c)
- cli: reword UpsertBatch cache-index warning to not imply data loss (#2221) (b5267a8), closes #1224
- cli: store only basename for local spec_path in manifest (#2156) (4a92662), closes #1587
- cli: store synced_at as RFC3339 UTC so SQLite strftime works (#2173) (b01b62e), closes #1588
- cli: streamline oauth login setup (#2177) (7709698)
- cli: support csv array body fields (#2160) (1f8d390)
- cli: unwrap nested data list envelopes (#2126) (1a9aec8)
- cli: wire GraphQL query list variable (#2152) (c9e39d7)
- generator: preserve required bool flag presence (#1940) (5157252)
- skills: rerun live dogfood during publish (#2155) (d8f806e)
- skills: route polish instrumentation through client (#2168) (5929945)
- skills: warn on multi-spec directories (#2167) (93d43b5)