Release BetterWright 2.8.8

[CuriosityOS]

What and why

Version bump, changelog date, and SKILL.md stamp for 2.8.8. Ships everything under Unreleased since 2.8.7:

• Security: trailing-dot hostname normalization, allowLoopback: false honoured on its own, snippet secret overwrites refused without allowCredentialOverwrite (Harden hostname rules, loopback policy, and snippet credential overwrites #222)
• Fixed: Windows vault lock EPERM handled as contention (fix: treat Windows vault lock EPERM as contention #211)
• Internal: credential-fill extraction (Extract credential fill from the worker into credential-fill.ts #223), dead-code cleanup (Dead-code cleanup: consolidate #213–#221 #224)

Checklist

• bun install --frozen-lockfile && bun run release:check passes locally (1298 pass; package smoke test betterwright-2.8.8.tgz OK).
• Guard proxy — unchanged.
• Secret redaction — unchanged.
• Dependency pins — unchanged; check:versions passes.
• Public API — no change in this commit.
• CI job names unchanged.
• No test imports src/worker.ts.
• CHANGELOG: Unreleased moved under [2.8.8].
• Nothing private committed.

[greptile-apps]

Confidence Score: 5/5

Safe to merge; no release-blocking issues were found.

What we checked:

• Validated the client-to-vault flow for snippet-originated credential writes, confirming default behavior preserves existing secrets and explicit host opt-in replaces them, alongside a regression suite outcome of 42 passes, 1 skipped, no failures.
• Compared normal and trailing-dot hostname behavior and confirmed the updated policy denies localhost and metadata.google.internal, while dotted search URLs remain public; the PR-head hostname matrix completed.
• Described the enforcement changes in code paths: src/client.ts overwrites snippet-supplied replaceSecret with the host option, and vault.ts blocks existing-record saves or secret-bearing updates when false; proof reports show original remains false and update-replacement persists when true.
• Executed the hostnames check script before and after change, verifying localhost and metadata.google.internal are now denied while dotted public searches remain allowed, with exit code 0.

Summary

Prepares the 2.8.8 release by aligning package metadata, the generated skill stamp, and changelog links and notes. The release also documents the updated hostname-policy, proxy-boundary, and credential-overwrite behavior. No issues found.

_{Reviews (1) · Last reviewed commit: "Release BetterWright 2.8.8"}