v3.23.1 — reliability and security fixes
This maintenance release brings together the reviewed PR cleanup. No new research sources or authentication defaults are introduced.
Highlights
- More reliable research: Bluesky refreshes expired sessions correctly, explicit research plans retain their selected sources, and named Instagram/TikTok creators retain first-party provenance in results.
- Safer execution: cross-origin redirects strip credential headers, the Claude Code hook no longer falls back to the current directory, and automatically discovered MCP Python interpreters must resolve to absolute paths.
- Quieter Keychain checks: setup and listing check whether entries exist without requesting plaintext passwords. The existing credential writer is unchanged; this is not a complete fix for command-line credential exposure.
- Maintenance: clearer hookless-install guidance, portable Amazon test dates, citation handling for Cursor agent chat, and security-tool updates.
Codex authentication and momentum analysis remain future proposals, not features shipped in this release.
Thanks to @Comradery64 for the original Keychain contribution in #1061; the safe presence-check subset shipped through #1111.
What's Changed
- fix(skill): Grok Bot / Cursor agent chat is a hidden-link citation host (LAW 8 detects CURSOR_AGENT) by @mvanhorn in #1095
- chore(deps): bump github/codeql-action/upload-sarif from 4.37.6 to 4.37.9 by @dependabot[bot] in #1106
- chore(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 by @dependabot[bot] in #1105
- chore(deps): bump google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml from 2.5.0 to 2.5.1 by @dependabot[bot] in #1079
- docs: add Validate workflow status badge to README by @SomSamantray in #1098
- docs(skill): correct LAW count in SKILL.md (five -> eleven) by @khsaurabh in #1102
- fix(http): drop credential headers on cross-origin redirects by @khsaurabh in #1069
- fix(hooks): use bare CLAUDE_PLUGIN_ROOT in SessionStart by @khsaurabh in #1092
- docs(skill): note config hook ships only with Claude Code plugin install by @khsaurabh in #1103
- test: keep Amazon date fixture portable on Windows by @dajiaohuang in #1080
- harden: detected non-static command inside command in run.go by @anupamme in #1109
- fix: named creator accounts (--ig-creators / --creators) count as first-party provenance by @khsaurabh in #1104
- fix(planner): honor operator --plan subquery sources at default/deep by @TheGusishere in #1093
- fix(bluesky): use refresh tokens for expired sessions by @huyua9 in #1065
- fix(keychain): check presence without requesting passwords by @mvanhorn in #1111
- chore(deps): bump trufflesecurity/trufflehog from 3.96.0 to 3.97.1 by @dependabot[bot] in #1107
- fix(ci): restore scheduled OSV scanner startup by @mvanhorn in #1112
- chore(release): bump version to 3.23.1 by @github-actions[bot] in #1113
New Contributors
- @dajiaohuang made their first contribution in #1080
- @TheGusishere made their first contribution in #1093
- @huyua9 made their first contribution in #1065
Full Changelog: v3.23.0...v3.23.1