v0.7.0

What's Changed

• chore(deps-dev): Bump tsx from 4.22.0 to 4.22.1 by @dependabot[bot] in #153
• Cli/breaking flag cleanup by @simongdavies in #167
• chore(deps-dev): Bump vitest from 4.1.6 to 4.1.7 in /src/code-validator/guest by @dependabot[bot] in #164
• chore(deps-dev): Bump @types/node from 25.8.0 to 25.9.1 by @dependabot[bot] in #163
• chore(deps-dev): Bump @xarsh/ooxml-validator from 0.1.10 to 0.2.0 by @dependabot[bot] in #162
• chore(deps): Bump @azure/msal-node from 5.2.1 to 5.2.2 by @dependabot[bot] in #161
• chore(deps-dev): Bump tsx from 4.22.1 to 4.22.3 by @dependabot[bot] in #156
• chore(deps): Bump serde_json from 1.0.149 to 1.0.150 in /src/code-validator/guest by @dependabot[bot] in #168
• chore(deps): Bump qs from 6.15.1 to 6.15.2 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #169
• chore(deps-dev): Bump @xarsh/ooxml-validator from 0.2.0 to 0.2.1 by @dependabot[bot] in #170
• chore(deps-dev): Bump @xarsh/ooxml-validator from 0.2.1 to 0.3.0 by @dependabot[bot] in #171
• chore(deps): Bump cargo-hyperlight from 0.1.10 to 0.1.11 in /src/code-validator/guest by @dependabot[bot] in #174
• chore(deps-dev): Bump @napi-rs/cli from 3.6.2 to 3.7.0 in /src/code-validator/guest by @dependabot[bot] in #172
• chore(deps-dev): Bump tsx from 4.22.3 to 4.22.4 by @dependabot[bot] in #176
• chore(deps): Bump highlight.js from 10.7.3 to 11.11.1 by @dependabot[bot] in #140
• chore(deps): Bump sha2 from 0.10.9 to 0.11.0 in /src/sandbox/runtime by @dependabot[bot] in #128
• chore(deps): Bump marked from 15.0.12 to 18.0.4 by @dependabot[bot] in #155
• chore(deps-dev): Bump typescript from 5.9.3 to 6.0.3 by @dependabot[bot] in #60
• chore(deps): Bump sha1 from 0.10.6 to 0.11.0 in /src/sandbox/runtime by @dependabot[bot] in #129
• chore(deps): Bump digest from 0.10.7 to 0.11.3 in /src/sandbox/runtime by @dependabot[bot] in #130
• chore(deps): Bump rquickjs from 0.11.0 to 0.12.0 in /src/code-validator/guest by @dependabot[bot] in #173
• ci: KVM ARM64 runner probe by @simongdavies in #177
• fix(module_info): use anyOf for functionName to satisfy CAPI schema validator by @simongdavies in #180
• fix(mcp): improve read-only classification and approval prompt by @simongdavies in #179
• chore(deps): Bump napi-derive from 2.16.13 to 3.5.6 in /src/code-validator/guest by @dependabot[bot] in #133
• chore(deps): Bump spin from 0.10.0 to 0.12.0 in /src/code-validator/guest by @dependabot[bot] in #166
• chore(deps): Bump rquickjs from 0.11.0 to 0.12.0 in /src/sandbox/runtime by @dependabot[bot] in #175
• ci: lint Windows-only Rust with a native Windows clippy job by @simongdavies in #182
• chore(deps-dev): Bump vitest from 4.1.7 to 4.1.8 in /src/code-validator/guest by @dependabot[bot] in #184
• chore(deps): Bump marked from 18.0.4 to 18.0.5 by @dependabot[bot] in #186
• chore(deps): Bump hono from 4.12.18 to 4.12.23 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #185
• chore(deps-dev): Bump @types/node from 25.9.1 to 25.9.2 by @dependabot[bot] in #188
• chore(deps): Bump @azure/msal-node from 5.2.2 to 5.2.3 by @dependabot[bot] in #187
• chore(deps-dev): Bump prettier from 3.8.3 to 3.8.4 by @dependabot[bot] in #189
• chore(deps-dev): Bump @napi-rs/cli from 3.7.0 to 3.7.1 in /src/code-validator/guest by @dependabot[bot] in #194
• chore(deps-dev): Bump esbuild from 0.28.0 to 0.28.1 by @dependabot[bot] in #195
• chore(deps): Bump @azure/msal-node from 5.2.3 to 5.2.4 by @dependabot[bot] in #193
• chore(deps): Bump napi from 3.9.0 to 3.9.1 in /src/code-validator/guest by @dependabot[bot] in #192
• chore(deps): Bump napi from 3.9.1 to 3.9.2 in /src/code-validator/guest by @dependabot[bot] in #197
• chore(deps-dev): Bump @types/node from 25.9.2 to 25.9.3 by @dependabot[bot] in #190
• chore(deps-dev): Bump @napi-rs/cli from 3.7.1 to 3.7.2 in /src/code-validator/guest by @dependabot[bot] in #196
• chore(deps-dev): Bump vitest from 4.1.8 to 4.1.9 in /src/code-validator/guest by @dependabot[bot] in #200
• chore(deps): Bump @azure/msal-node from 5.2.4 to 5.2.5 by @dependabot[bot] in #203
• chore(deps): Bump hono from 4.12.23 to 4.12.25 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #204
• fix(build): harden build scripts against shell-injection (CodeQL) by @simongdavies in #181
• chore(deps): Bump napi from 3.9.2 to 3.9.3 in /src/code-validator/guest by @dependabot[bot] in #207
• chore(deps-dev): Bump just-bash from 3.0.1 to 3.0.2 by @dependabot[bot] in #210
• chore(deps-dev): Bump @types/node from 25.9.3 to 26.0.0 by @dependabot[bot] in #208
• chore(deps): Bump spin from 0.12.0 to 0.12.1 in /src/code-validator/guest by @dependabot[bot] in #212
• chore(deps): Bump napi-derive from 3.5.6 to 3.5.7 in /src/code-validator/guest by @dependabot[bot] in #216
• chore(deps): Bump anyhow from 1.0.102 to 1.0.103 in /src/sandbox/runtime by @dependabot[bot] in #219
• chore(deps): Bump anyhow from 1.0.102 to 1.0.103 in /src/code-validator/guest by @dependabot[bot] in #217
• chore(deps): Bump napi from 3.9.3 to 3.9.4 in /src/code-validator/guest by @dependabot[bot] in #215
• chore(deps-dev): Bump @types/node from 26.0.0 to 26.0.1 by @dependabot[bot] in #213
• chore(deps): Bump @azure/msal-node from 5.2.5 to 5.3.0 by @dependabot[bot] in #211
• chore(deps): Bump @azure/msal-node from 5.3.0 to 5.3.1 by @dependabot[bot] in #222
• chore(deps): Bump napi from 3.9.4 to 3.10.0 in /src/code-validator/guest by @dependabot[bot] in #226
• chore(deps-dev): Bump tsx from 4.22.4 to 4.22.5 by @dependabot[bot] in #227
• chore(deps): Bump actions/checkout from 6 to 7 by @dependabot[bot] in #206
• Update dependencies to hyperlight-js released version by @simongdavies in #228
• update dependencies by @simongdavies in #236
• chore(deps): Bump @github/copilot-sdk from 0.3.0 to 1.0.5 by @dependabot[bot] in #225

Full Changelog: v0.6.1...v0.7.0

v0.6.1

What's Changed

• docs: add Quick Install section near top of README by @simongdavies in #149
• Fix/agent repl ux by @simongdavies in #151
• chore(deps): Bump @github/copilot from 1.0.39 to 1.0.48 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #150
• docs: changelog for v0.6.1 by @simongdavies in #152

Full Changelog: v0.6.0...v0.6.1

v0.6.0

What's Changed

• chore(deps): Bump @azure/msal-node from 5.1.5 to 5.2.0 by @dependabot[bot] in #118
• chore(deps): Bump fast-uri from 3.1.0 to 3.1.2 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #120
• chore(deps-dev): Bump @types/node from 25.6.0 to 25.6.2 by @dependabot[bot] in #117
• chore(deps): Bump tokio from 1.52.2 to 1.52.3 in /src/code-validator/guest by @dependabot[bot] in #122
• chore(deps): Bump @github/copilot from 1.0.39 to 1.0.45 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #123
• Feat execute bash by @simongdavies in #119
• chore(deps-dev): Bump just-bash from 2.14.5 to 3.0.0 by @dependabot[bot] in #127
• chore(deps): Bump napi-build from 2.3.1 to 2.3.2 in /src/code-validator/guest by @dependabot[bot] in #132
• chore(deps): Bump hashbrown from 0.17.0 to 0.17.1 in /src/code-validator/guest by @dependabot[bot] in #121
• chore(deps-dev): Bump @types/node from 25.6.2 to 25.7.0 by @dependabot[bot] in #124
• chore(deps): Bump @azure/msal-node from 5.2.0 to 5.2.1 by @dependabot[bot] in #125
• chore(deps-dev): Bump vitest from 4.1.5 to 4.1.6 in /src/code-validator/guest by @dependabot[bot] in #126
• chore(deps-dev): Bump just-bash from 3.0.0 to 3.0.1 by @dependabot[bot] in #131
• fix: HybridFs subclass, Prettier template literal fixes, path normali… by @simongdavies in #134
• Feat markdown rendering by @simongdavies in #135
• fix: address remaining PR #135 review feedback by @simongdavies in #136
• Feat kql expert by @simongdavies in #137
• fix: marked v15 + marked-terminal v7 incompat in markdown-renderer by @simongdavies in #138
• chore(deps-dev): Bump @types/node from 25.6.0 to 25.8.0 by @dependabot[bot] in #147
• chore(deps): Bump tokio from 1.52.2 to 1.52.3 in /src/code-validator/guest by @dependabot[bot] in #146
• chore(deps-dev): Bump tsx from 4.21.0 to 4.22.0 by @dependabot[bot] in #143
• chore(deps): Bump @azure/msal-node from 5.1.5 to 5.2.1 by @dependabot[bot] in #142
• Feat user skills by @simongdavies in #139
• docs: changelog for v0.6.0 by @simongdavies in #148

Full Changelog: v0.5.0...v0.6.0

v0.5.0

What's Changed

• chore(deps): Bump zod from 4.3.6 to 4.4.1 by @dependabot[bot] in #99
• chore(deps-dev): Bump pixelmatch from 7.1.0 to 7.2.0 by @dependabot[bot] in #98
• fix: use SDK SessionEvent type for copilot-sdk 0.3.0 compat by @simongdavies in #100
• chore(deps): Bump @github/copilot-sdk from 0.2.2 to 0.3.0 by @dependabot[bot] in #81
• Improve handler shape validation guidance by @simongdavies in #101
• chore(deps): Bump zod from 4.4.1 to 4.4.2 by @dependabot[bot] in #102
• chore(deps): Bump zod from 4.4.2 to 4.4.3 by @dependabot[bot] in #104
• chore(deps): Bump tokio from 1.52.1 to 1.52.2 in /src/code-validator/guest by @dependabot[bot] in #103
• Handler shape validation guidance by @simongdavies in #105
• chore(deps): Bump cargo-hyperlight from 0.1.9 to 0.1.10 in /src/code-validator/guest by @dependabot[bot] in #108
• chore(deps): Bump ip-address from 10.1.0 to 10.2.0 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #107
• chore(deps): Bump hono from 4.12.14 to 4.12.18 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #109
• Configurable plugin limits by @simongdavies in #106
• feat: add clarifying questions to pptx, pdf, xlsx skills by @simongdavies in #110
• fix: native module resolution breaks validation loop for ha:pdf by @simongdavies in #111
• feat: add actionable config hints to all limit error messages by @simongdavies in #112
• feat: add estimated cost to token usage display by @simongdavies in #114
• fix: restore shape ID counter before createPresentation in restorePre… by @simongdavies in #113
• fix: validate hex colours in hexColor() to prevent XML injection by @simongdavies in #115
• Update changelog by @simongdavies in #116

Full Changelog: v0.4.2...v0.5.0

v0.4.2

What's Changed

• feat(mcp): MSAL bootstrap for M365 server discovery by @simongdavies in #97

Full Changelog: v0.4.1...v0.4.2

v0.4.1

What's Changed

• fix(release): remove fragile package size check by @simongdavies in #96

Full Changelog: v0.4.0...v0.4.1

v0.4.0

What's Changed

• chore(deps): Bump @azure/msal-node from 5.1.4 to 5.1.5 by @dependabot[bot] in #90
• fix(release): reduce npm package size and harden smoke test by @simongdavies in #93
• fix(agent): detect bold suggested slash commands by @simongdavies in #94
• Fix/mcp tool discovery flow by @simongdavies in #95

Full Changelog: v0.3.0...v0.4.0

v0.3.0

What's Changed

• chore(deps): Bump cargo-hyperlight from 0.1.8 to 0.1.9 in /src/code-validator/guest by @dependabot[bot] in #82
• chore(deps): Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #80
• Feat/m365 mcp by @simongdavies in #83
• feat: /plugins as alias for /plugin by @simongdavies in #84
• ci(publish): add post-publish smoke test job by @simongdavies in #85
• docs: make README capabilities-first by @simongdavies in #87
• feat(modules): promote xlsx to builtin module by @simongdavies in #86
• fix(agent): improve handler edits and mcp gateway load by @simongdavies in #88

Full Changelog: v0.2.3...v0.3.0

v0.2.3

What's Changed

• fix npm install by @simongdavies in #79

Full Changelog: v0.2.2...v0.2.3

v0.2.2

What's Changed

• fix publish workflow by @simongdavies in #77
• update release docs by @simongdavies in #78

Full Changelog: v0.2.1...v0.2.2