# Changelog All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). ## [0.6.0] - 2026-03-01 ### Added - **Vibe Audit Phase 2: Internal Code Audit** — 5 new Tier 1 tools + 1 Tier 2 workflow for local project security scanning (reads project files, no HTTP calls): - `check_env_exposure` — Checks .env files for secret leaks (Supabase service_role, Stripe, AWS, DB URL, OpenAI, GitHub tokens), verifies .gitignore exclusion, .env.example best practice - `check_rls_config` — Checks Supabase RLS configuration in SQL migrations: ENABLE/FORCE RLS, policy definitions, detects permissive USING(true) anti-pattern, skips system tables - `check_api_auth` — Checks API route authentication for Next.js App Router and Pages Router: detects 20+ auth patterns, global middleware auth, recognizes public routes (health, webhooks) - `check_client_secrets` — Detects secrets exposed in client-side code: NEXT_PUBLIC_ env vars with service keys, hardcoded Stripe/AWS/OpenAI/GitHub/PEM keys in client vs server files - `check_injection_risk` — Detects injection risks across 3 categories (SQL: 3 patterns, XSS: 3 patterns, Command: 4 patterns) with context lines and line numbers - `run_vibe_audit` — Tier 2 workflow: chains all 5 Tier 1 tools with 100-point scoring (Critical: -20, High: -10, Medium: -5, Low: -2), 60s workflow timeout, 15s per-tool timeout, progress notifications - New shared utility: `file-scanner.ts` — Secure file system operations with path traversal prevention, symlink blocking, 1MB file size limit, 100-file scan limit - New types: `VibeAuditFinding`, `VibeAuditToolResult`, `VibeAuditReport`, `VibeAuditSeverity`, `VibeAuditFindingStatus` - New format-summary functions: `summarizeVibeAuditFindings()`, `summarizeVibeAuditReport()` for Markdown output - Comprehensive test suite: file-scanner tests (path traversal, symlinks, size limits) and vibe-audit tests (all 5 Tier 1 tools + Tier 2 workflow with temp project fixtures) ### Changed - **Stripe detection regex broadened**: `check_env_exposure` and `check_client_secrets` now detect both `sk_live_` and `sk_test_` Stripe key prefixes (test keys should also not be committed to source code) - **`generate_jsonld` data property limit**: Added `.refine(max 50 keys)` to the `data` record parameter to prevent unbounded input - **`generate_htaccess` RewriteRule pattern escaping**: Added `escapeRewritePattern()` to escape regex metacharacters (`.`, `*`, `+`, etc.) in redirect `from` paths for literal matching (e.g., `/page.html` → `^page\.html$`) ### Fixed - **Timer leak in `executeTool()`**: `clearTimeout(timeoutTimer)` was not called in the catch block because the timer variable was declared inside the try block. Moved declaration outside try and added cleanup in catch. - **`scanProjectFiles` excludeDirs replacing defaults**: When `options.excludeDirs` was provided, it replaced `DEFAULT_EXCLUDE_DIRS` instead of merging. Now uses spread to merge both arrays. - **`format-summary.ts` multi-line fix code truncation**: `summarizeVibeAuditReport()` only showed the first line of multi-line fix suggestions. Now renders all lines with proper indentation. - **`check-injection-risk.ts` single-match per pattern**: `content.match(pattern)` without `g` flag only found the first occurrence. Changed to `matchAll` with global flag to find ALL occurrences. - **`check-client-secrets.ts` overly broad CLIENT_FILE_PATTERNS**: `/src\/.*\.tsx?$/` matched ALL files under `src/`, including server-side code. Narrowed to specific client-side path patterns (app/**/page.*, components/, pages/ excluding api/, hooks/). - **Unused imports in `file-scanner.ts`**: Removed unused `access` and `constants` imports from `node:fs/promises`. - **`formatError()` path sanitization**: Extended sanitization to ALL error types, not just `ApiError`. Now sanitizes `/home/`, `/usr/`, `/tmp/`, and Windows paths from all error messages (mcp-dev-checklist 2-A compliance). - **Standalone Tier 1 Vibe Audit tools timeout**: Added 15-second timeout wrapper (`withTimeout()`) for all 5 standalone Tier 1 Vibe Audit tool calls, matching mcp-dev-checklist 2-A requirement (Tier 1: 15s). ## [0.5.0] - 2026-02-21 ### Added - 4 new Tier 1 SEO inspection tools: - `check_cache_headers` — Check browser/CDN cache headers (Cache-Control, ETag, Last-Modified, etc.) with scoring (0-100) - `check_schema_completeness` — Check structured data (JSON-LD/microdata) completeness against Schema.org requirements with per-type validation - `check_redirect_chain` — Trace redirect chain (301/302/307/308) with loop detection and HTTP downgrade detection - `check_image_optimization` — Check image optimization (next-gen formats, file size, lazy loading, width/height attributes) with scoring (0-100) - Tier 2 workflow checklists expanded with new inspection items: - **SEO Audit**: 4 new items (cache headers, structured data completeness, redirect chain, image optimization) — now chains 10 tools with 20 auto-verified items (was 6 tools / 16 items) - **Web Launch Audit**: 4 new items (cache headers, structured data completeness, image optimization, redirect chain) — now chains 11 tools with 21 auto + 1 manual items (was 7 tools / 17 auto + 1 manual) - **Freelance Delivery Audit**: 2 new items (image optimization, redirect chain) — now chains 8 tools with 12 auto + 3 manual items (was 7 tools / 10 auto + 3 manual) - New Zod response schemas: `cacheCheckerResponseSchema`, `schemaCheckerResponseSchema`, `redirectCheckerResponseSchema`, `imageCheckerResponseSchema` - New evaluation functions: `evalCacheHeaders()`, `evalSchemaCompleteness()`, `evalRedirectChain()`, `evalImageOptimization()` ### Fixed - SSRF protection: `validateUrl()` now blocks `.local` and `.internal` domain suffixes (can resolve to private IPs) ## [0.4.1] - 2026-02-18 ### Fixed - Speed checker (`check_page_speed`) timeout extended from 15s to 30s to match the upstream PageSpeed Insights API timeout, reducing timeout failures in Tier 2 workflow audits ## [0.4.0] - 2026-02-18 ### Added - 5 Tier 3 config file generation tools ("Config as a Tool" — AI agents can safely generate validated config files): - `generate_robots_txt` — Generate valid robots.txt from structured input (sitemap URL, disallow/allow paths, user-agent, crawl-delay). Output validation ensures only valid directives. Path sanitization removes control characters. - `generate_sitemap_xml` — Generate valid XML sitemap from URL list (up to 50,000 entries with optional lastmod, changefreq, priority). XML special characters safely escaped as entities. Validates URL format, date format, changefreq values, and priority range. - `generate_htaccess` — Generate valid Apache .htaccess with redirect rules (301/302/307/308), gzip compression, cache control, force HTTPS, and trailing slash removal. Injection prevention: blocks backtick execution, `$()` substitution, `%{ENV:}` injection, newline injection, and null bytes in RewriteRule patterns. - `generate_jsonld` — Generate Schema.org-compliant JSON-LD structured data supporting 16 schema types. Uses JSON.stringify for safe serialization. Validates required fields per type. Returns both raw JSON and `