whale-igniter 1.5.3 → 1.6.0

package/CHANGELOG.md

@@ -2,6 +2,35 @@
 
 All notable changes to Whale Igniter are documented here.
 
+## 1.6.0 - 2026-07-14
+
+### Added
+
+- Added GitHub Actions CI for builds, tests, production dependency audits, security scanning, package validation, and committed `dist/` freshness.
+- Added npm Trusted Publishing through GitHub Actions OIDC, restricted to version tags in the protected `npm` environment and published with provenance.
+- Added migration coverage for Markdown-backed decisions and refinements, including legacy JSON compatibility, duplicate handling, and malformed legacy stores.
+- Added launch metadata to generated landings: description, Open Graph and Twitter cards, canonical/social image support, and a themed inline favicon.
+- Added configurable contact form actions plus native required, email, and minimum-length validation.
+
+### Changed
+
+- Updated the release workflow to Node.js 24 and current GitHub Actions, without long-lived npm publishing tokens or release-build dependency caches.
+- Rebuilt and reconciled committed `dist/` output with `src/`; CI now rejects stale or untracked build artifacts.
+- Removed internal planning documents from the public repository and documented the verified release process.
+
+### Release history note
+
+- An older source commit was titled `Release 1.6.0`, but no `v1.6.0` tag, GitHub Release, or npm version was created from it. Version `1.6.0` in this entry is the first real published release with that number.
+
+## 1.5.4 - 2026-07-08
+
+### Security
+
+- Added automatic secret redaction before Selene prompts are copied, written, cached, or sent to Anthropic/OpenAI.
+- Added `npm run security:scan` to detect likely committed secrets in source and compiled output.
+- Added the security scan to `prepublishOnly`, after build and before tests, so npm releases fail before publishing if high-confidence secrets are found.
+- Replaced the `gray-matter`/`js-yaml` dependency path with a local frontmatter parser, restoring a zero-vulnerability production audit.
+
 ## 1.5.3 - 2026-07-06
 
 ### Added

package/README.md

@@ -4,6 +4,7 @@
 
 <p align="center">
   <a href="https://www.npmjs.com/package/whale-igniter"><img alt="npm" src="https://img.shields.io/npm/v/whale-igniter?color=%230034D3&labelColor=%23F2ECE1&style=flat-square"></a>
+  <a href="https://github.com/luisviol/whale-igniter/actions/workflows/ci.yml"><img alt="CI" src="https://img.shields.io/github/actions/workflow/status/luisviol/whale-igniter/ci.yml?branch=main&label=CI&style=flat-square"></a>
   <a href="./LICENSE"><img alt="MIT" src="https://img.shields.io/badge/license-MIT-%230034D3?labelColor=%23F2ECE1&style=flat-square"></a>
   <img alt="node" src="https://img.shields.io/badge/node-%E2%89%A520-%230034D3?labelColor=%23F2ECE1&style=flat-square">
   <img alt="local first" src="https://img.shields.io/badge/local--first-agent%20memory-%230034D3?labelColor=%23F2ECE1&style=flat-square">
@@ -224,6 +225,24 @@ Whale Igniter has no telemetry or analytics.
 
 ---
 
+## Development and releases
+
+Start from a clean checkout and use the locked dependency graph:
+
+```bash
+npm ci
+npm run build
+npm test
+npm audit --omit=dev --audit-level=high
+npm run security:scan
+```
+
+`dist/` is versioned because the CLI and MCP smoke tests execute it directly. Every source change that affects compiled output must include the matching `dist/` change. CI rebuilds the package and fails if `dist/` is modified or if the build creates an untracked distribution file.
+
+npm releases are published only by `.github/workflows/publish.yml`, triggered from a GitHub Release whose tag matches `v<package.json version>`. The GitHub `npm` environment must provide the `NPM_TOKEN` secret. The workflow installs from `package-lock.json`, audits production dependencies, runs `prepublishOnly`, and publishes with npm provenance. Do not run `npm publish` from a development checkout.
+
+---
+
 ## Credits
 
 Brand assets reference JetBrains Mono (SIL Open Font License 1.1) and Special Elite (Apache License 2.0). No font binaries are shipped.

package/dist/commands/changes.js

@@ -1,7 +1,7 @@
 import { execFileSync } from "node:child_process";
-import matter from "gray-matter";
 import { resolveTarget } from "../utils/paths.js";
 import { loadComponents } from "../utils/components.js";
+import { parseFrontmatter } from "../utils/frontmatter.js";
 import { ui } from "../ui/index.js";
 const DECISIONS_DIR = "intelligence/decisions";
 const REFINEMENTS_DIR = "intelligence/refinements";
@@ -42,10 +42,10 @@ function mdLabelAtRef(target, ref, file, label) {
     }
 }
 const decisionLabel = (raw) => {
-    const title = matter(raw).data?.title;
+    const title = parseFrontmatter(raw).data.title;
     return title ? String(title) : "";
 };
-const refinementLabel = (raw) => matter(raw).content.trim().split("\n")[0] ?? "";
+const refinementLabel = (raw) => parseFrontmatter(raw).content.trim().split("\n")[0] ?? "";
 function gitDirChanges(target, since, dir, label) {
     const result = { added: [], removed: [], modified: [] };
     let raw = "";

package/dist/commands/createLanding.js

@@ -63,7 +63,7 @@ export async function createLandingCommand(options = {}) {
         await fs.ensureDir(path.dirname(contentAbs));
         await fs.writeJson(contentAbs, content, { spaces: 2 });
     }
-    await fs.writeFile(htmlAbs, renderHtml(content, sections), "utf8");
+    await fs.writeFile(htmlAbs, renderHtml(content, sections, theme), "utf8");
     await fs.writeFile(cssAbs, renderCss(theme, {
         includeProof: sections.includes("proof"),
         includeContact: sections.includes("contact")
@@ -300,7 +300,7 @@ function validateLandingContent(value) {
     if (!isRecord(value))
         return { ok: false, error: "expected a JSON object" };
     const input = value;
-    for (const key of ["brand", "eyebrow", "title", "subtitle"]) {
+    for (const key of ["brand", "eyebrow", "title", "subtitle", "description", "canonicalUrl", "socialImage"]) {
         if (input[key] !== undefined && typeof input[key] !== "string") {
             return { ok: false, error: `${key} must be a string` };
         }
@@ -354,6 +354,7 @@ function defaultLandingContent(title, sections) {
         eyebrow: "Launch-ready landing",
         title: `${title} turns interest into qualified conversations.`,
         subtitle: "A focused page with clear benefits, trust signals and a path that is easy to scan.",
+        description: `${title} helps visitors understand the offer, evaluate proof, and take the next step.`,
         cta: {
             label: "Start a conversation",
             href: ctaTarget
@@ -382,7 +383,8 @@ function defaultLandingContent(title, sections) {
             eyebrow: "Contact",
             title: "Tell us what you want to launch.",
             body: "Share a few details and we will follow up with next steps.",
-            submitLabel: "Send message"
+            submitLabel: "Send message",
+            action: "#"
         }
     };
 }
@@ -392,6 +394,7 @@ function sampleLandingContent() {
         eyebrow: "Nutrition planning",
         title: "Meal planning for athletes who train hard.",
         subtitle: "Build training-aware menus, grocery lists, and coach-ready exports without rebuilding spreadsheets.",
+        description: "Plan athlete meals, grocery lists, and coach-ready exports around each training block.",
         cta: {
             label: "Request early access",
             href: "#contact"
@@ -427,11 +430,12 @@ function sampleLandingContent() {
 function mergeLandingContent(base, next) {
     return {
         ...base,
-        ...definedPick(next, ["brand", "eyebrow", "title", "subtitle"]),
+        ...definedPick(next, ["brand", "eyebrow", "title", "subtitle", "description", "canonicalUrl", "socialImage"]),
+        description: next.description ?? next.subtitle ?? base.description,
         cta: { ...base.cta, ...definedPick(next.cta ?? {}, ["label", "href"]) },
         features: next.features ?? base.features,
         proof: { ...base.proof, ...definedPick(next.proof ?? {}, ["eyebrow", "title", "quote", "byline"]) },
-        contact: { ...base.contact, ...definedPick(next.contact ?? {}, ["eyebrow", "title", "body", "submitLabel"]) }
+        contact: { ...base.contact, ...definedPick(next.contact ?? {}, ["eyebrow", "title", "body", "submitLabel", "action"]) }
     };
 }
 function definedPick(source, keys) {
@@ -442,7 +446,7 @@ function definedPick(source, keys) {
     }
     return out;
 }
-function renderHtml(content, sections) {
+function renderHtml(content, sections, theme) {
     const header = sections.includes("header") ? `${indent(renderSection("header", content, sections), 4)}\n` : "";
     const footer = sections.includes("footer") ? `\n${indent(renderSection("footer", content, sections), 4)}` : "";
     const mainBlocks = sections
@@ -455,6 +459,14 @@ function renderHtml(content, sections) {
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>${escapeHtml(content.brand)}</title>
+    <meta name="description" content="${escapeAttr(content.description)}" />
+    <meta property="og:type" content="website" />
+    <meta property="og:title" content="${escapeAttr(content.title)}" />
+    <meta property="og:description" content="${escapeAttr(content.description)}" />
+    <meta name="twitter:card" content="${content.socialImage ? "summary_large_image" : "summary"}" />
+    <meta name="twitter:title" content="${escapeAttr(content.title)}" />
+    <meta name="twitter:description" content="${escapeAttr(content.description)}" />
+${content.canonicalUrl ? `    <link rel="canonical" href="${escapeAttr(content.canonicalUrl)}" />\n    <meta property="og:url" content="${escapeAttr(content.canonicalUrl)}" />\n` : ""}${content.socialImage ? `    <meta property="og:image" content="${escapeAttr(content.socialImage)}" />\n    <meta name="twitter:image" content="${escapeAttr(content.socialImage)}" />\n` : ""}    <link rel="icon" href="${renderFaviconData(theme)}" type="image/svg+xml" />
     <link rel="stylesheet" href="./styles.css" />
   </head>
   <body>
@@ -527,18 +539,19 @@ ${indent(content.features.map(renderFeature).join("\n"), 6)}
       <h2 id="contact-title">${escapeHtml(content.contact.title)}</h2>
       <p class="lede">${escapeHtml(content.contact.body)}</p>
     </div>
-    <form class="contact-form">
+    <form class="contact-form" action="${escapeAttr(content.contact.action)}" method="post">
+      <p class="form-help" id="contact-form-help">All fields are required.</p>
       <label>
         Name
-        <input name="name" type="text" autocomplete="name" required />
+        <input name="name" type="text" autocomplete="name" placeholder="Ada Lovelace" aria-describedby="contact-form-help" required />
       </label>
       <label>
         Email
-        <input name="email" type="email" autocomplete="email" required />
+        <input name="email" type="email" autocomplete="email" placeholder="ada@example.com" aria-describedby="contact-form-help" required />
       </label>
       <label>
         Message
-        <textarea name="message" rows="4" required></textarea>
+        <textarea name="message" rows="4" minlength="10" placeholder="Tell us what you want to launch." aria-describedby="contact-form-help" required></textarea>
       </label>
       <button class="button" type="submit">${escapeHtml(content.contact.submitLabel)}</button>
     </form>
@@ -583,6 +596,10 @@ function escapeHtml(value) {
 function escapeAttr(value) {
     return escapeHtml(value).replace(/'/g, "&#39;");
 }
+function renderFaviconData(theme) {
+    const svg = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64"><rect width="64" height="64" rx="12" fill="${theme.identity.accent}"/><path d="M14 18l9 28 9-18 9 18 9-28" fill="none" stroke="${theme.identity.onAccent}" stroke-width="6" stroke-linecap="round" stroke-linejoin="round"/></svg>`;
+    return `data:image/svg+xml,${encodeURIComponent(svg)}`;
+}
 function printLandingHints(args) {
     console.log();
     console.log(ui.section("Next edits"));
@@ -594,7 +611,7 @@ function printLandingHints(args) {
         `${ui.kv("copy", contentHint, { keyWidth: 8 })}`,
         `${ui.kv("design", "try --theme atlas | harbor | aurora", { keyWidth: 8 })}`,
         `${ui.kv("scope", `trim sections with --sections ${args.sections.join(",")}`, { keyWidth: 8 })}`,
-        `${ui.kv("dev", "wire the form action in src/index.html", { keyWidth: 8 })}`
+        `${ui.kv("launch", "set contact.action, canonicalUrl, and a 1200x630 socialImage", { keyWidth: 8 })}`
     ];
     console.log(ui.indent(lines.join("\n")));
 }
@@ -750,6 +767,10 @@ blockquote {
 }
 
 .eyebrow {
+  display: inline-flex;
+  width: fit-content;
+  max-width: 100%;
+  align-self: flex-start;
   margin: 0 0 calc(var(--space-grid) * 2);
   color: var(--color-accent-strong);
   font-size: 0.875rem;
@@ -982,6 +1003,12 @@ label {
   font-weight: 700;
 }
 
+.form-help {
+  margin: 0;
+  color: var(--color-muted);
+  font-size: 0.875rem;
+}
+
 input,
 textarea {
   width: 100%;

package/dist/commands/selene.js

@@ -14,6 +14,7 @@ import { copyToClipboard } from "../selene/clipboard.js";
 import { resolveProvider, describeProviderState } from "../selene/providers.js";
 import { callProvider, estimateTokens, estimateCostUsd } from "../selene/apiClient.js";
 import { readCache, writeCache, clearCache } from "../selene/cache.js";
+import { redactSecrets } from "../selene/redaction.js";
 import { ui } from "../ui/index.js";
 const PENDING_DIR = ".whale/selene";
 // ---------------------------------------------------------------------------
@@ -83,6 +84,10 @@ async function emitPrompt(target, prompt, kind, options) {
  * prompt mode, etc. Centralising keeps the policy consistent.
  */
 async function runSelene(target, kind, prompt, options) {
+    const safePrompt = redactSecrets(prompt);
+    if (safePrompt !== prompt) {
+        console.log(ui.warning("Potential secrets were redacted before Selene output/API use."));
+    }
     const config = await loadConfig(target);
     const sel = config.selene ?? {};
     // Step 1: figure out the mode.
@@ -103,7 +108,7 @@ async function runSelene(target, kind, prompt, options) {
             process.exitCode = 1;
             return { rawResponse: null };
         }
-        await emitPrompt(target, prompt, kind, options);
+        await emitPrompt(target, safePrompt, kind, options);
         return { rawResponse: null };
     }
     // ---- API mode --------------------------------------------------------------
@@ -111,7 +116,7 @@ async function runSelene(target, kind, prompt, options) {
     // Cache lookup, unless the user opted out.
     const cacheEnabled = !options.noCache && !sel.noCache;
     if (cacheEnabled) {
-        const cached = await readCache(target, resolved.model, prompt);
+        const cached = await readCache(target, resolved.model, safePrompt);
         if (cached) {
             console.log(ui.muted("  cache hit — no API call needed"));
             // Still stash the response so `apply` from disk works if the user wants.
@@ -122,7 +127,7 @@ async function runSelene(target, kind, prompt, options) {
     // Cost confirmation.
     const confirm = options.confirmCost || sel.confirmCost;
     if (confirm) {
-        const inputTokens = estimateTokens(prompt);
+        const inputTokens = estimateTokens(safePrompt);
         const expectedOutput = sel.maxTokens ?? 1500;
         const cost = estimateCostUsd(resolved.model, inputTokens, expectedOutput);
         const costStr = cost === null ? "unknown" : `≈ $${cost.toFixed(4)}`;
@@ -135,13 +140,13 @@ async function runSelene(target, kind, prompt, options) {
         });
         if (!ok) {
             console.log(ui.warning("Aborted — falling back to prompt mode."));
-            await emitPrompt(target, prompt, kind, options);
+            await emitPrompt(target, safePrompt, kind, options);
             return { rawResponse: null };
         }
     }
     const spin = ora({ text: "Calling provider", stream: process.stderr }).start();
     const result = await callProvider(resolved, {
-        prompt,
+        prompt: safePrompt,
         maxTokens: sel.maxTokens ?? 1500,
         temperature: sel.temperature ?? 0.2
     });
@@ -152,7 +157,7 @@ async function runSelene(target, kind, prompt, options) {
         }
         // Graceful fallback: still emit the prompt so the user isn't stuck.
         console.log(ui.warning("\nFalling back to prompt mode so you can run this manually:"));
-        await emitPrompt(target, prompt, kind, options);
+        await emitPrompt(target, safePrompt, kind, options);
         return { rawResponse: null };
     }
     const usage = result.inputTokens !== null && result.outputTokens !== null
@@ -160,7 +165,7 @@ async function runSelene(target, kind, prompt, options) {
         : "";
     spin.succeed(`Response received${usage}`);
     if (cacheEnabled) {
-        await writeCache(target, resolved.model, prompt, result.text);
+        await writeCache(target, resolved.model, safePrompt, result.text);
     }
     await stashResponse(target, kind, result.text);
     return { rawResponse: result.text };

package/dist/selene/redaction.js

@@ -0,0 +1,45 @@
+const REDACTED = "[REDACTED_SECRET]";
+const SECRET_PATTERNS = [
+    {
+        name: "private-key",
+        pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/g
+    },
+    { name: "openai-key", pattern: /\bsk-[A-Za-z0-9_-]{20,}\b/g },
+    { name: "github-token", pattern: /\bgh[pousr]_[A-Za-z0-9_]{20,}\b/g },
+    { name: "slack-token", pattern: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
+    { name: "aws-access-key", pattern: /\bAKIA[0-9A-Z]{16}\b/g },
+    { name: "google-api-key", pattern: /\bAIza[0-9A-Za-z_-]{30,}\b/g },
+    { name: "anthropic-key", pattern: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g }
+];
+const ASSIGNMENT_PATTERN = /\b(api[_-]?key|token|secret|password|passwd|client[_-]?secret|private[_-]?key)\b(\s*[:=]\s*)(["']?)([^"'\s,;)}\]]{16,})(\3)/gi;
+function redactAssignment(match, key, separator, quote, value) {
+    if (isLikelyPlaceholder(value))
+        return match;
+    return `${key}${separator}${quote}${REDACTED}${quote}`;
+}
+function isLikelyPlaceholder(value) {
+    const normalized = value.toLowerCase();
+    return [
+        "example",
+        "placeholder",
+        "changeme",
+        "dummy",
+        "fake",
+        "mock",
+        "sample",
+        "test",
+        "xxxx",
+        "..."
+    ].some((needle) => normalized.includes(needle));
+}
+export function redactSecrets(input) {
+    let output = input;
+    for (const { pattern } of SECRET_PATTERNS) {
+        output = output.replace(pattern, REDACTED);
+    }
+    output = output.replace(ASSIGNMENT_PATTERN, redactAssignment);
+    return output;
+}
+export function containsRedactedSecret(input) {
+    return redactSecrets(input) !== input;
+}

package/dist/utils/decisions.js

@@ -1,6 +1,6 @@
 import path from "node:path";
 import fs from "fs-extra";
-import matter from "gray-matter";
+import { parseFrontmatter, stringifyFrontmatter } from "./frontmatter.js";
 const DIR = "intelligence/decisions";
 const LEGACY_STORE = "intelligence/decisions.json";
 function slugify(title) {
@@ -17,7 +17,7 @@ function section(body, heading) {
     return text && text.length > 0 ? text : undefined;
 }
 function parseFile(raw) {
-    const { data, content } = matter(raw);
+    const { data, content } = parseFrontmatter(raw);
     const decision = section(content, "Decision");
     if (!data.id || !data.title || !decision)
         return null;
@@ -34,7 +34,7 @@ function parseFile(raw) {
     };
 }
 function serialize(d) {
-    const fm = matter.stringify([
+    return stringifyFrontmatter([
         "## Context",
         d.context ?? "",
         "",
@@ -51,7 +51,6 @@ function serialize(d) {
         createdAt: d.timestamp,
         supersedes: d.supersedes ?? null
     });
-    return fm;
 }
 async function loadLegacy(target) {
     const file = path.join(target, LEGACY_STORE);

package/dist/utils/frontmatter.js

@@ -0,0 +1,62 @@
+function parseValue(raw) {
+    const value = raw.trim();
+    if (value === "null")
+        return null;
+    if (value === "true")
+        return true;
+    if (value === "false")
+        return false;
+    if (/^-?\d+(?:\.\d+)?$/.test(value))
+        return Number(value);
+    if ((value.startsWith('"') && value.endsWith('"')) ||
+        (value.startsWith("'") && value.endsWith("'"))) {
+        try {
+            return JSON.parse(value);
+        }
+        catch {
+            return value.slice(1, -1);
+        }
+    }
+    return value;
+}
+function stringifyValue(value) {
+    if (value === null || value === undefined)
+        return "null";
+    if (typeof value === "boolean" || typeof value === "number")
+        return String(value);
+    const text = String(value);
+    if (text === "" || /[:#\n\r]|^\s|\s$/.test(text))
+        return JSON.stringify(text);
+    return text;
+}
+export function parseFrontmatter(raw) {
+    if (!raw.startsWith("---\n") && !raw.startsWith("---\r\n")) {
+        return { data: {}, content: raw };
+    }
+    const lineEnding = raw.startsWith("---\r\n") ? "\r\n" : "\n";
+    const startLength = 3 + lineEnding.length;
+    const endMarker = `${lineEnding}---${lineEnding}`;
+    const end = raw.indexOf(endMarker, startLength);
+    if (end === -1)
+        return { data: {}, content: raw };
+    const block = raw.slice(startLength, end);
+    const content = raw.slice(end + endMarker.length);
+    const data = {};
+    for (const line of block.split(/\r?\n/)) {
+        if (!line.trim())
+            continue;
+        const match = /^([A-Za-z0-9_-]+):\s*(.*)$/.exec(line);
+        if (!match)
+            continue;
+        data[match[1]] = parseValue(match[2]);
+    }
+    return { data, content };
+}
+export function stringifyFrontmatter(content, data) {
+    const lines = ["---"];
+    for (const [key, value] of Object.entries(data)) {
+        lines.push(`${key}: ${stringifyValue(value)}`);
+    }
+    lines.push("---", content);
+    return lines.join("\n");
+}

package/dist/utils/refinements.js

@@ -1,6 +1,6 @@
 import path from "node:path";
 import fs from "fs-extra";
-import matter from "gray-matter";
+import { parseFrontmatter, stringifyFrontmatter } from "./frontmatter.js";
 const DIR = "intelligence/refinements";
 const LEGACY_STORE = "intelligence/refinements.json";
 function slugify(text) {
@@ -11,7 +11,7 @@ function slugify(text) {
         .slice(0, 60);
 }
 function parseFile(raw) {
-    const { data, content } = matter(raw);
+    const { data, content } = parseFrontmatter(raw);
     const note = content.trim();
     if (!data.id || !note)
         return null;
@@ -40,7 +40,7 @@ function serialize(r) {
         fm.selector = r.scope.selector;
     if (r.scope?.file)
         fm.file = r.scope.file;
-    return matter.stringify(r.note, fm);
+    return stringifyFrontmatter(r.note, fm);
 }
 async function loadLegacy(target) {
     const file = path.join(target, LEGACY_STORE);

package/dist/version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = "1.5.3";
+export const PACKAGE_VERSION = "1.6.0";

package/docs/ROADMAP.md

@@ -184,23 +184,24 @@ These are listed explicitly to defend focus over time.
 
 ---
 
-## Operational milestones (not engineering work)
+## Operational milestones
 
 These are tasks that depend on the project owner, not on the codebase:
 
-- **Publish to npm.** Code is ready. Requires an npm account and
-  `npm publish` from a clean checkout.
-- **Public repo.** Move from local zips to a versioned GitHub repo
-  with releases.
+- **npm releases.** Publishing is performed by the GitHub Release workflow,
+  with a matching `v<version>` tag, the protected `npm` environment, and
+  provenance. Local `npm publish` is not part of the release process.
+- **Public repo.** Keep CI, release tags, changelog, package version, source,
+  and committed `dist/` synchronized.
 - **Demo video.** Record the 5-minute "adopt a real repo and watch
   Claude Code work with full context" walkthrough referenced in the
   done criteria.
 - **Field test.** Adopt the tool in three real projects (own or
   partner teams) and feed observations into v1.1.
 
-Until those happen, v1.0 is "feature-complete and ready to ship" but
-not "released and validated in the wild."
+Release readiness is decided from the CI run attached to the release commit,
+not from a development checkout.
 
 ---
 
-_Last updated: v1.1 release._
+_Last updated: release hardening after v1.5.4._

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whale-igniter",
-  "version": "1.5.3",
+  "version": "1.6.0",
   "description": "CLI-first operational intelligence. Bootstraps and adopts AI-readable project context so agents like Claude Code, Codex and Cursor understand your design system from the first commit. Includes an MCP server, a file watcher, deterministic insights, and an opt-in AI bridge (Selene).",
   "type": "module",
   "main": "./dist/index.js",
@@ -23,8 +23,9 @@
     "build": "tsc",
     "postbuild": "node -e \"require('node:fs').chmodSync('dist/index.js', 0o755)\"",
     "start": "node dist/index.js",
+    "security:scan": "tsx scripts/security-scan.ts",
     "test": "tsx tests/run.ts && tsx tests/mcp-smoke.ts && tsx tests/extractors.ts && tsx tests/driftAnalyzers.ts",
-    "prepublishOnly": "npm run build && npm test"
+    "prepublishOnly": "npm run build && npm run security:scan && npm test"
   },
   "engines": {
     "node": ">=20.0.0"
@@ -66,7 +67,6 @@
     "commander": "^12.1.0",
     "fs-extra": "^11.2.0",
     "glob": "^13.0.6",
-    "gray-matter": "^4.0.3",
     "ora": "^8.1.0",
     "postcss": "^8.4.47",
     "prompts": "^2.4.2",