v1.7.1

Changed

• Grainulator devDeps (@playwright/test, serve) moved out of this
  repo into the maintainer's private ranch harness. Grainulator is
  now truly zero-devDep, matching the published ecosystem's zero-dep
  philosophy. E2E tests still pass (27/27); they now run locally only
  via the ranch harness — see CONTRIBUTING.md.

Internal

• Biome autofix pass on hooks and plugin JSON files.
• CI: removed the e2e job (moved to the ranch harness, local-only).
• Added release.yml — v* tag pushes now auto-create GitHub
  Release objects with CHANGELOG-extracted notes.

v1.7.0

Added

• Bearer auth on farmer hooks. The sprint-status notifier hook now
  attaches a Bearer token when .farmer-token is present. Narrow-scope
  tokens ensure admin/viewer credentials can't be reused against hook
  endpoints — aligns grainulator's hook transport with farmer's
  opportunistic-auth hardening.
• /healthcheck host-capability probe. Checks Claude Code's
  current tool/MCP contract and flags drift before it causes silent
  skill failures. Run before a sprint to verify the environment is
  compatible.

Fixed

• Windows hook compatibility. Inline JS in hooks.json silently
  failed on Windows cmd.exe (no fail-closed). Extracted to .cjs
  files invoked via node ${CLAUDE_PLUGIN_ROOT}/hooks/<name>.cjs so
  Windows runs the same code path as macOS/Linux.
• Port env override now respected by hook scripts.

Changed

• Skills: extracted shared WCAG checklist so brief and present
  skills reference one source instead of duplicating.

Internal

• .env added to .gitignore.

v1.6.0 — Sprint Mode + Security Hardening

What's new

Sprint-mode demo — grainulator.app now runs autonomous 3-pass research sprints instead of chat. Type a question, watch research → challenge → synthesis execute, get a confidence-graded answer with typed claims and tension detection.

Security hardening across the ecosystem:

• MCP directory containment (wheat, mill, silo)
• Shell injection prevention (grainulation)
• PDF template injection fix (mill)
• Edit guard on protected files (grainulator)
• Farmer tunnel flipped to opt-in
• CSP headers on all 9 sites
• Path traversal guards (orchard, harvest)
• Privacy disclosure for Pollinations API

Polish:

• OG image with lava shader + claim bar
• Mobile input readability + PWA safe area
• README with 2-step install + QA metrics
• 170+ tests (144 unit + 27 E2E)
• Lighthouse: Performance 99, Accessibility 100, SEO 100

Try it live →