vibefortress 0.1.50 → 0.1.52

package/.claude-plugin/plugin.json

@@ -1,4 +1,4 @@
 {
   "name": "vibefortress",
-  "version": "0.1.50"
+  "version": "0.1.52"
 }

package/dist/MANIFEST.sha256

@@ -1,7 +1,7 @@
 43acc2492adebae8e98d838a0f0b4b6e8e1d12073385b67306c123287a6051ad  THIRD_PARTY_LICENSES.txt
 f1f23262dcf2fe49120dcc50d8d5c228d3c4ccd34976931c06bb9b1ec1ad44d2  cli.js
-e9b01001a1309f59f2c371b49548dcb87308ded13fc98182f260da3ff5eb3dcc  hook.js
+b5647dd61e739195912a5132d55b671dba78e1a100de72af11951ba8a0983306  hook.js
 501dc52451ad036d7345b1cdf152b0e9ab6ecaaee718b13459983356f97ce43f  panel.html
 cb454e01aa8690db6a4589c97d9d683b866d93fae4163b516951ae1cc27774a8  rules/vibefort.yaml
 86821fb93d339d54a9a5a1488128ec2bb313d04ec0213a6b88a58f9d6e94068c  scanners.lock.json
-80f999e816df2538c046d671835fbe4f3497bbbc452d4170fe201967014c2e9b  server.js
+9d9301fe27919ce338c60d78568155888f305da98fa04b1e45ddb350426b36c6  server.js

package/dist/hook.js

@@ -19749,6 +19749,10 @@ var env = external_exports.object({
   APP_SECRET: external_exports.string().min(16).optional(),
   GITHUB_CLIENT_ID: external_exports.string().optional(),
   GITHUB_CLIENT_SECRET: external_exports.string().optional(),
+  CONTACT_EMAIL: external_exports.string().email().optional(),
+  REVIEWER_LOGIN: external_exports.enum(["0", "1"]).default("0"),
+  REVIEWER_LOGIN_SECRET: external_exports.string().optional(),
+  REVIEWER_LOGIN_UNTIL: external_exports.string().optional(),
   SIGNIN_LOCKED: external_exports.enum(["0", "1"]).default("0"),
   SERVE_SITE: external_exports.enum(["0", "1"]).default("0"),
   GITLAB_CLIENT_ID: external_exports.string().optional(),
@@ -19766,6 +19770,7 @@ var env = external_exports.object({
   STRIPE_PRICE_ID: external_exports.string().optional(),
   STRIPE_PRICE_MONTH: external_exports.string().optional(),
   STRIPE_PRICE_YEAR: external_exports.string().optional(),
+  STRIPE_API_VERSION: external_exports.string().default("2025-09-30.clover"),
   MANTIS_DIR: external_exports.string().default("vendor/mantis"),
   OSV_MODE: external_exports.enum(["real", "fake"]).default("real"),
   FREE_REPOS: num(1),
@@ -19842,6 +19847,10 @@ var config2 = {
   host: env.HOST,
   /** Gated private beta (feature 032, D-264): allows AUTH_MODE=dev and BILLING_MODE=fake in production, only with DEV_ACCESS_TOKEN. */
   privateBeta: env.PRIVATE_BETA === "1",
+  /** The owner's contact address shown on the legal pages (043, D-399). */
+  contactEmail: env.CONTACT_EMAIL,
+  /** Temporary review account for app directory reviewers (043, D-396). Off unless all three values are set and valid: see src/auth/reviewer.ts. */
+  reviewer: { flag: env.REVIEWER_LOGIN === "1", secret: env.REVIEWER_LOGIN_SECRET ?? "", until: env.REVIEWER_LOGIN_UNTIL ?? "" },
   /** Serve the marketing site (site/dist) from this server, and send other host names of the domain to PUBLIC_URL (D-303). */
   serveSite: env.SERVE_SITE === "1",
   publicUrl: env.PUBLIC_URL.replace(/\/$/, ""),
@@ -19861,7 +19870,7 @@ var config2 = {
     locked: env.SIGNIN_LOCKED === "1"
   },
   billingMode: env.BILLING_MODE,
-  stripe: { secretKey: env.STRIPE_SECRET_KEY, webhookSecret: env.STRIPE_WEBHOOK_SECRET, priceMonth: env.STRIPE_PRICE_MONTH ?? env.STRIPE_PRICE_ID, priceYear: env.STRIPE_PRICE_YEAR },
+  stripe: { secretKey: env.STRIPE_SECRET_KEY, webhookSecret: env.STRIPE_WEBHOOK_SECRET, priceMonth: env.STRIPE_PRICE_MONTH ?? env.STRIPE_PRICE_ID, priceYear: env.STRIPE_PRICE_YEAR, apiVersion: env.STRIPE_API_VERSION },
   mantisDir: env.MANTIS_DIR,
   osvMode: env.OSV_MODE,
   skillTokenBudget: env.SKILL_TOKEN_BUDGET,

package/dist/release.json

@@ -1,19 +1,19 @@
 {
   "schema": 1,
   "product": "vibefort-plugin",
-  "version": "0.1.50",
-  "seq": 29909720,
-  "issuedAt": "2026-11-13T15:20:22.567Z",
-  "expiresAt": "2027-12-18T15:20:22.567Z",
+  "version": "0.1.52",
+  "seq": 29910109,
+  "issuedAt": "2026-11-13T21:49:04.049Z",
+  "expiresAt": "2027-12-18T21:49:04.049Z",
   "keyId": "7c19bfe68d9fa025",
   "files": {
-    "MANIFEST.sha256": "94272c2a2ae2c3bdd89f5beb474335022f8b88d039d22898a2caf44ae3239bcc",
+    "MANIFEST.sha256": "9523e685300a3a0cf9179f98b863eb6c2b1f3d6057dd8952383160b807dda213",
     "THIRD_PARTY_LICENSES.txt": "43acc2492adebae8e98d838a0f0b4b6e8e1d12073385b67306c123287a6051ad",
     "cli.js": "f1f23262dcf2fe49120dcc50d8d5c228d3c4ccd34976931c06bb9b1ec1ad44d2",
-    "hook.js": "e9b01001a1309f59f2c371b49548dcb87308ded13fc98182f260da3ff5eb3dcc",
+    "hook.js": "b5647dd61e739195912a5132d55b671dba78e1a100de72af11951ba8a0983306",
     "panel.html": "501dc52451ad036d7345b1cdf152b0e9ab6ecaaee718b13459983356f97ce43f",
     "rules/vibefort.yaml": "cb454e01aa8690db6a4589c97d9d683b866d93fae4163b516951ae1cc27774a8",
     "scanners.lock.json": "86821fb93d339d54a9a5a1488128ec2bb313d04ec0213a6b88a58f9d6e94068c",
-    "server.js": "80f999e816df2538c046d671835fbe4f3497bbbc452d4170fe201967014c2e9b"
+    "server.js": "9d9301fe27919ce338c60d78568155888f305da98fa04b1e45ddb350426b36c6"
   }
 }

package/dist/release.sig

@@ -1 +1 @@
-DWyqb9BgS09uNp+8xJQpe6TXxrG0yzFKQHwTJzHx+D504Pj670s1HUM0fvZ/QpgeKnQ2HHimzkbr3fOutV4yBA==
+tnC7b0uTU8XO20botm7Od7kTO5sDHMI7Xxuiqu3WYiQaceKkGGcGqBH09mydnNkl9AUHkwXtwNARK3cCpYDHCw==

package/dist/server.js

@@ -36793,6 +36793,10 @@ var env = external_exports.object({
   APP_SECRET: external_exports.string().min(16).optional(),
   GITHUB_CLIENT_ID: external_exports.string().optional(),
   GITHUB_CLIENT_SECRET: external_exports.string().optional(),
+  CONTACT_EMAIL: external_exports.string().email().optional(),
+  REVIEWER_LOGIN: external_exports.enum(["0", "1"]).default("0"),
+  REVIEWER_LOGIN_SECRET: external_exports.string().optional(),
+  REVIEWER_LOGIN_UNTIL: external_exports.string().optional(),
   SIGNIN_LOCKED: external_exports.enum(["0", "1"]).default("0"),
   SERVE_SITE: external_exports.enum(["0", "1"]).default("0"),
   GITLAB_CLIENT_ID: external_exports.string().optional(),
@@ -36810,6 +36814,7 @@ var env = external_exports.object({
   STRIPE_PRICE_ID: external_exports.string().optional(),
   STRIPE_PRICE_MONTH: external_exports.string().optional(),
   STRIPE_PRICE_YEAR: external_exports.string().optional(),
+  STRIPE_API_VERSION: external_exports.string().default("2025-09-30.clover"),
   MANTIS_DIR: external_exports.string().default("vendor/mantis"),
   OSV_MODE: external_exports.enum(["real", "fake"]).default("real"),
   FREE_REPOS: num(1),
@@ -36886,6 +36891,10 @@ var config2 = {
   host: env.HOST,
   /** Gated private beta (feature 032, D-264): allows AUTH_MODE=dev and BILLING_MODE=fake in production, only with DEV_ACCESS_TOKEN. */
   privateBeta: env.PRIVATE_BETA === "1",
+  /** The owner's contact address shown on the legal pages (043, D-399). */
+  contactEmail: env.CONTACT_EMAIL,
+  /** Temporary review account for app directory reviewers (043, D-396). Off unless all three values are set and valid: see src/auth/reviewer.ts. */
+  reviewer: { flag: env.REVIEWER_LOGIN === "1", secret: env.REVIEWER_LOGIN_SECRET ?? "", until: env.REVIEWER_LOGIN_UNTIL ?? "" },
   /** Serve the marketing site (site/dist) from this server, and send other host names of the domain to PUBLIC_URL (D-303). */
   serveSite: env.SERVE_SITE === "1",
   publicUrl: env.PUBLIC_URL.replace(/\/$/, ""),
@@ -36905,7 +36914,7 @@ var config2 = {
     locked: env.SIGNIN_LOCKED === "1"
   },
   billingMode: env.BILLING_MODE,
-  stripe: { secretKey: env.STRIPE_SECRET_KEY, webhookSecret: env.STRIPE_WEBHOOK_SECRET, priceMonth: env.STRIPE_PRICE_MONTH ?? env.STRIPE_PRICE_ID, priceYear: env.STRIPE_PRICE_YEAR },
+  stripe: { secretKey: env.STRIPE_SECRET_KEY, webhookSecret: env.STRIPE_WEBHOOK_SECRET, priceMonth: env.STRIPE_PRICE_MONTH ?? env.STRIPE_PRICE_ID, priceYear: env.STRIPE_PRICE_YEAR, apiVersion: env.STRIPE_API_VERSION },
   mantisDir: env.MANTIS_DIR,
   osvMode: env.OSV_MODE,
   skillTokenBudget: env.SKILL_TOKEN_BUDGET,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibefortress",
-  "version": "0.1.50",
+  "version": "0.1.52",
   "description": "Security that keeps up with vibe coding: scans your project on your own machine, explains findings in plain language, and fixes them on a branch. Never blocks a commit or push.",
   "type": "module",
   "bin": {