Changelog

All notable GitHits CLI and public package changes are recorded here. Unreleased changes use independent files under changes/ and are consolidated here only during release preparation. Dated, versioned sections are historical records and change only to correct blatant factual errors.

[githits 0.29.0] - 2026-10-12

Minor release with version-grouped upgrade evidence and expanded JSON statement data. Agent classifications describe release-note statements; callers still assess applicability and verify upgrades locally. The backing API must support the new statement and coverage fields. Hosted MCP clients receive these changes after adoption and deployment of the released MCP package.

Added

• Upgrade statement evidence - Show bulleted agent-classified release-note quotes grouped by version with sources listed once, separate lexical keyword matches and honest coverage in CLI/MCP upgrade reviews, preserve raw quotes and model provenance in JSON, present backend ambiguity as uncertainty and oversize statements explicitly, and use pre-cap backend totals to summarize and rank batch triage by confident action count without assigning package verdicts.

• Statement source data - Preserve backend statement URLs independent of sampled entries and return complete uncut statements in CLI/MCP JSON, selecting large full text only for JSON while leaving terminal output design unchanged.

Changed

• Upgrade review text - Remove the redundant compatibility disclaimer from CLI/MCP upgrade-review reports while retaining agent attribution and factual statement evidence.

• Upgrade note navigation - Put available note references beside each version, use statement URLs beyond sampled entries, identify agent classification in the Changes heading, and remove redundant section counts and keyword rows for already quoted evidence in CLI/MCP text.

[@githits/mcp 0.29.0] - 2026-10-12

Minor release with version-grouped upgrade evidence and expanded JSON statement data. Agent classifications describe release-note statements; callers still assess applicability and verify upgrades locally. The backing API must support the new statement and coverage fields. Hosted MCP clients receive these changes after adoption and deployment of the released MCP package.

Added

• Upgrade statement evidence - Show bulleted agent-classified release-note quotes grouped by version with sources listed once, separate lexical keyword matches and honest coverage in CLI/MCP upgrade reviews, preserve raw quotes and model provenance in JSON, present backend ambiguity as uncertainty and oversize statements explicitly, and use pre-cap backend totals to summarize and rank batch triage by confident action count without assigning package verdicts.

• Statement source data - Preserve backend statement URLs independent of sampled entries and return complete uncut statements in CLI/MCP JSON, selecting large full text only for JSON while leaving terminal output design unchanged.

Changed

• Upgrade review text - Remove the redundant compatibility disclaimer from CLI/MCP upgrade-review reports while retaining agent attribution and factual statement evidence.

• Upgrade note navigation - Put available note references beside each version, use statement URLs beyond sampled entries, identify agent classification in the Changes heading, and remove redundant section counts and keyword rows for already quoted evidence in CLI/MCP text.

[githits 0.28.0] - 2026-10-09

Pre-1.0 minor release with breaking wait behavior. Search and search-status --wait values now use integer milliseconds: replace --wait 30 or --wait 30s with --wait 30000 for 30 seconds. Seconds suffixes are no longer accepted. Omitted indexing waits default to 30000 ms; use explicit zero for non-waiting requests. Hosted clients receive MCP changes after adoption and deployment of the released MCP package.

Added

• Portable upgrade scorer - Repository eval tooling compares a local Python dependency-upgrade candidate against its original source and lockfile using original tests and an independent probe, with documented setup and optional scenario-specific attribution rules.

Changed

• CLI wait units - Search and search-status use milliseconds, matching other wait-bearing commands and emitted retry actions. Public CLI code guidance documents the migration and grep's new 30000 ms first-page default.

• Shorter, sectioned GitHits guide - The MCP skill and quick_start share a shorter guide for tool choice, workflow, targets, results, dependency upgrades, and external content. Selected tool descriptions retain per-tool mechanics. Guidance states the private-input boundary directly.

• Upgrade verification workflow - Required local before-and-after checks appear directly after tool selection in MCP guidance; CLI package guidance carries the same local checks. Agents preserve original source and lockfiles, record API responses, stored values and side effects beyond existing tests, compare after upgrading, fix unintended differences, and report verification gaps.

Fixed

• Consistent indexing waits and timeout errors - Search/status, read, list, grep, and direct service clients default preparation waits to 30000 ms, including direct searchStatus, whose omitted wait previously used zero. Explicit zero and non-waiting grep cursor continuation are preserved. Longer waits receive HTTP headroom; GraphQL and example response-body expiry is classified as TIMEOUT.

Security

• CLI dependency security and compatibility - Refresh runtime dependencies to address known direct and transitive advisories, and use maintained Commander 14 to preserve the advertised Node 20 support.

• Workflow permissions - CI and package-release workflows default to no token permissions and grant required access per job, preserving manual MCP publishing and validation.

[@githits/mcp 0.28.0] - 2026-10-09

Pre-1.0 minor release with changed default wait behavior. Omitted indexing preparation waits use 30000 ms, including direct searchStatus, whose omitted wait previously used zero. Use explicit zero for non-waiting requests. Hosted clients require adoption and deployment of this package.

Changed

• Shorter, sectioned GitHits guide - The MCP skill and quick_start share a shorter guide for tool choice, workflow, targets, results, dependency upgrades, and external content. Selected tool descriptions retain per-tool mechanics. Guidance states the private-input boundary directly.

• Upgrade verification workflow - Required local before-and-after checks appear directly after tool selection. Agents preserve original source and lockfiles, record API responses, stored values and side effects beyond existing tests, compare after upgrading, fix unintended differences, and report verification gaps.

Fixed

• Consistent indexing waits and timeout errors - Search/status, read, list, grep, and direct service clients default preparation waits to 30000 ms. Explicit zero and non-waiting grep cursor continuation are preserved. Longer waits receive HTTP headroom; GraphQL and example response-body expiry is classified as TIMEOUT.

[githits 0.27.1] - 2026-10-07

Patch release. Hosted clients receive the MCP changes after adoption and deployment of the released MCP package. Example source follow-ups require supporting backends.

Changed

• Concise search and grep output - Use plain outcome counts and shared Read, More results and Follow-up footers, retaining exact native actions, source/preparation provenance and meaningful coverage warnings without repeated header flags. JSON and request behavior are unchanged.

• Example source follow-ups - CLI examples explicitly request copyable source-read commands and MCP examples request read tool calls from supporting backends, retaining source links, licenses, and JSON envelopes. CLI text also strips terminal controls; JSON preserves the original Markdown.

Fixed

• Package review guidance - Clarify that changelog ranges exclude the starting version and include the ending version across tool schemas, CLI help, text output, and skills. Encourage using upgrade-review signals to evaluate codebase impact, with changelog and source-diff tools available for details.

[@githits/mcp 0.27.1] - 2026-10-07

Patch release. Hosted clients require adoption and deployment of this package.

Changed

• Concise search and grep output - Use plain outcome counts and shared Read, More results and Follow-up footers, retaining exact native actions, source/preparation provenance and meaningful coverage warnings without repeated header flags. JSON and request behavior are unchanged.

• Example source follow-ups - MCP examples explicitly request read tool calls from supporting backends, retaining source links, licenses, and JSON envelopes.

Fixed

• Package review guidance - Clarify that changelog ranges exclude the starting version and include the ending version in tool schemas, descriptions, and text output. Encourage using upgrade-review signals to evaluate codebase impact, with changelog and source-diff tools available for details.

[githits 0.27.0] - 2026-10-06

Pre-1.0 minor release. Custom MCP service providers must now supply resolveTargetService. Search returns partial results by default; use CLI --no-allow-partial or MCP allow_partial_results: false for atomic results. Production schema support was verified during release preparation; hosted clients require adoption and deployment of the released MCP package.

Added

• Stable target resolution - Enable githits resolve and resolve_target by default, with stable guidance, public resolver clients and smoke coverage. OSS dependency discovery wording and compact uncertainty/empty-result text guide follow-up calls. MCP providers must now supply resolveTargetService; hosted availability follows released-package adoption and deployment.

Changed

• Readable MCP errors - Default and explicit text responses now explain failures in readable text, including early validation and service-provider failures. Request format: "json" when parsing the structured error envelope; its error codes, retryability and supplied metadata remain available.

• Dated search snapshot provenance - Shared CLI/MCP search and retained status text show independently known UTC commit dates without changing read-now or conditional wait advice; shared read and legacy navigation provenance retain full timestamps. Production backend schema deployment must be confirmed before client release or hosted adoption, or reads fail and search/status fallback drops target provenance.

• Shared source and preparation rows - Search/status, grep, list and annotated reads use consistent pinned source and actual-work identities, independently known dates and compact timing. List adds selected nullable commit timestamps without fetching detailed metadata for text. Confirm production backend schema support before client release or hosted adoption: GraphQL validates the complete list/read query even when directives skip fields. Search now defaults to partial results so ready sources contribute while others prepare; opt out with CLI --no-allow-partial or MCP allow_partial_results: false. Indexed alternatives stay with their preparation target. Grep hides backend input numbers in human text and puts read guidance after matches. Raw content, silent paths, JSON actions and native continuations remain unchanged.

• Actionable indexing preparation - Grep lists resolved sources and omitted targets separately, marks sources without results on the returned page, combines each omission's indexing status and timing, and places concise retry guidance after the matches. Waiting tools preserve uniform advisory indexing duration metadata and share timing/wait logic. Production backend schema deployment is required before client release or hosted adoption.

• CLI skill parity - Code and package skills route vague dependency names through stable githits resolve with the same selection gates as MCP. Code guidance documents the partial-search default and atomic opt-out.

Fixed

• Changelog preview precedence - MCP pkg_changelog accepts verbose:true together with body_lines or omit_bodies:true and fetches and returns full bodies instead of rejecting redundant preview controls.

• Consistent indexing messages - Read, list, search and annotated legacy output share compact advisory total timing and native retry guidance. List preserves estimates supplied by zero-wait errors, distinguishes pending inventories from available data, and puts retry advice after cursor instructions; raw content and paths-only output stay clean.

• Resolver eval accounting - Include CLI githits resolve calls in agent-eval tool-call metrics and flag them as CLI fallbacks in MCP-only evaluations.

[@githits/mcp 0.27.0] - 2026-10-06

Pre-1.0 minor release. Custom MCP service providers must now supply resolveTargetService. Search returns partial results by default; use CLI --no-allow-partial or MCP allow_partial_results: false for atomic results. Production schema support was verified during release preparation; hosted clients require adoption and deployment of the released MCP package.

Added

• Stable target resolution - Enable githits resolve and resolve_target by default, with stable guidance, public resolver clients and smoke coverage. OSS dependency discovery wording and compact uncertainty/empty-result text guide follow-up calls. MCP providers must now supply resolveTargetService; hosted availability follows released-package adoption and deployment.

Changed

• Readable MCP errors - Default and explicit text responses now explain failures in readable text, including early validation and service-provider failures. Request format: "json" when parsing the structured error envelope; its error codes, retryability and supplied metadata remain available.

• Dated search snapshot provenance - Shared CLI/MCP search and retained status text show independently known UTC commit dates without changing read-now or conditional wait advice; shared read and legacy navigation provenance retain full timestamps. Production backend schema deployment must be confirmed before client release or hosted adoption, or reads fail and search/status fallback drops target provenance.

• Shared source and preparation rows - Search/status, grep, list and annotated reads use consistent pinned source and actual-work identities, independently known dates and compact timing. List adds selected nullable commit timestamps without fetching detailed metadata for text. Confirm production backend schema support before client release or hosted adoption: GraphQL validates the complete list/read query even when directives skip fields. Search now defaults to partial results so ready sources contribute while others prepare; opt out with CLI --no-allow-partial or MCP allow_partial_results: false. Indexed alternatives stay with their preparation target. Grep hides backend input numbers in human text and puts read guidance after matches. Raw content, silent paths, JSON actions and native continuations remain unchanged.

• Actionable indexing preparation - Grep lists resolved sources and omitted targets separately, marks sources without results on the returned page, combines each omission's indexing status and timing, and places concise retry guidance after the matches. Waiting tools preserve uniform advisory indexing duration metadata and share timing/wait logic. Production backend schema deployment is required before client release or hosted adoption.

Fixed

• Changelog preview precedence - MCP pkg_changelog accepts verbose:true together with body_lines or omit_bodies:true and fetches and returns full bodies instead of rejecting redundant preview controls.

• Consistent indexing messages - Read, list, search and annotated legacy output share compact advisory total timing and native retry guidance. List preserves estimates supplied by zero-wait errors, distinguishes pending inventories from available data, and puts retry advice after cursor instructions; raw content and paths-only output stay clean.

[githits 0.26.0] - 2026-10-05

Added

• Stable source diff - Make githits code diff and public MCP code_diff available by default, with repository-wide scope guidance, stable smoke/eval coverage, and bounded patch evidence. Custom MCP service providers must implement codeDiff on codeNavigationService; the built-in client already does. Hosted availability follows adoption and deployment of the released MCP package.

• Refresh installed MCP guidance - Local CLI MCP startup refreshes eligible older githits-mcp installations automatically; skills.auto_update and GITHITS_DISABLE_SKILL_UPDATE can disable it, while unrecognized and newer managed content is preserved.

• Upgrade evidence routing workload - Add a neutral Lodash upgrade workload with uninformative release notes to observe whether agents supplement upgrade assessment with exact source changes.

Changed

• Source diff graduation evidence - Add a production CLI/MCP audit matrix and four neutral agent workloads covering repository refs, monorepo scope, unavailable-version recovery, and bounded patch evidence; the recorded baseline predates default-enabled graduation.

• Documentation homepage - Point the githits npm package and generated plugin homepage metadata to https://docs.githits.com.

• Source diff CLI guidance - Code and package Agent Skills route exact source comparisons to stable githits code diff, disclose repository-wide package comparisons and bounded evidence, and supplement upgrade review when release notes are uninformative. Onboarding guidance explains automatic local MCP skill refresh and its opt-outs.

Fixed

• Exact site wait outcomes - CLI and MCP list JSON preserve FAILED and SUPERSEDED alongside the four existing outcomes by selecting the additive backend status field as outcome; deploy that field to dev and production before publishing either client artifact, while older clients remain supported without a forced upgrade.

• Use repository snapshots while HEAD indexes - CLI and MCP search text shows the served commit and historical indexing ref, offers a pinned read before optional waiting for updated results, and directs ended searches to a new search instead of polling a stored reference. JSON and explicit wait options are unchanged.

• GitHits-first agent guidance - Guided githits init now explicitly directs agents to use GitHits first when looking up OSS code, docs, examples, packages, or dependencies, read the routing skill before external lookups, and use other sources when GitHits is unavailable or insufficient. Rerun guided setup for the intended agents to update an existing managed instruction block.

[@githits/mcp 0.26.0] - 2026-10-05

Pre-1.0 minor release with a breaking provider API change: custom MCP service providers must implement codeDiff on codeNavigationService. The built-in client already implements it.

Added

• Stable source diff - Make githits code diff and public MCP code_diff available by default, with repository-wide scope guidance, stable smoke/eval coverage, and bounded patch evidence. Custom MCP service providers must implement codeDiff on codeNavigationService; the built-in client already does. Hosted availability follows adoption and deployment of the released MCP package.

Fixed

• Exact site wait outcomes - CLI and MCP list JSON preserve FAILED and SUPERSEDED alongside the four existing outcomes by selecting the additive backend status field as outcome; deploy that field to dev and production before publishing either client artifact, while older clients remain supported without a forced upgrade.

• Use repository snapshots while HEAD indexes - CLI and MCP search text shows the served commit and historical indexing ref, offers a pinned read before optional waiting for updated results, and directs ended searches to a new search instead of polling a stored reference. JSON and explicit wait options are unchanged.

Before publishing either package, deploy the additive site-wait status field to dev and production. Hosted clients receive these changes after adoption and deployment of @githits/mcp@0.26.0 by remote-mcp.

[githits 0.25.1] - 2026-10-01

Added

• Explicit request session identifiers - Set GITHITS_SESSION_ID to an identifier matching [A-Za-z0-9_-]{1,64} to override terminal detection in CLI and local MCP request headers. Valid identifiers are forwarded unchanged without hashing; invalid values fail local MCP startup and CLI requests with a configuration error. Unset the variable to retain hashed automatic detection.

[@githits/mcp 0.25.1] - 2026-10-01

Added

• Explicit request session identifiers - The @githits/mcp/client header builder honors GITHITS_SESSION_ID matching [A-Za-z0-9_-]{1,64}, forwarding valid identifiers unchanged without hashing. Exports getEnvSessionId and SessionIdConfigError; invalid overrides produce non-retryable configuration errors. Unset the variable to retain hashed automatic detection.

Hosted clients receive these changes after adoption and deployment by remote-mcp; local environment variables do not configure hosted connections.

[githits 0.25.0] - 2026-10-01

Minor release: replaces local MCP code_grep with unified source and hosted-documentation grep; the legacy githits code grep CLI remains available.

Changed

• Unified MCP grep - Replace code_grep with mixed source-and-documentation grep. New requests use ordered targets: [{ target, corpus?, path_selectors? }] and a required pattern instead of one target and an optional pattern. Per-target exact/prefix/glob selectors replace legacy path, path_prefix, globs, and extensions arguments. Defaults change from literal to RE2 regex, case-insensitive to case-sensitive (ignore_case: true opts in), and 50 to 100 matches per page. Replace case_sensitive with inverse ignore_case; pattern_type: "literal" opts into literal matching. Grep now covers all indexed repository files and package-selected hosted docs by default; context remains zero, and preparation wait changes from 30 seconds to zero. context_lines becomes independent context_lines_before and context_lines_after controls, and context above 10 is rejected instead of clamped. To replace exclude_doc_files, set a target's corpus to source for repository files; package-selected hosted docs remain included independently. wait_timeout_ms remains available for explicit preparation waits. MCP no longer accepts per-file limits, test exclusions, or symbol fields. The legacy githits code grep CLI remains available. The public smoke helper now exercises grep, and request-scoped MCP providers must supply grepService; remote-mcp must migrate its provider and helper use before adopting this package version.

Hosted clients receive these changes after @githits/mcp@0.25.0 adoption and deployment by remote-mcp.

[@githits/mcp 0.25.0] - 2026-10-01

Minor release: replaces code_grep with unified source and hosted-documentation grep and requires hosts to provide McpToolServices.grepService.

Changed

• Unified MCP grep - Replace code_grep with mixed source-and-documentation grep. New requests use ordered targets: [{ target, corpus?, path_selectors? }] and a required pattern instead of one target and an optional pattern. Per-target exact/prefix/glob selectors replace legacy path, path_prefix, globs, and extensions arguments. Defaults change from literal to RE2 regex, case-insensitive to case-sensitive (ignore_case: true opts in), and 50 to 100 matches per page. Replace case_sensitive with inverse ignore_case; pattern_type: "literal" opts into literal matching. Grep now covers all indexed repository files and package-selected hosted docs by default; context remains zero, and preparation wait changes from 30 seconds to zero. context_lines becomes independent context_lines_before and context_lines_after controls, and context above 10 is rejected instead of clamped. To replace exclude_doc_files, set a target's corpus to source for repository files; package-selected hosted docs remain included independently. wait_timeout_ms remains available for explicit preparation waits. MCP no longer accepts per-file limits, test exclusions, or symbol fields. The legacy githits code grep CLI remains available. The public smoke helper now exercises grep, and request-scoped MCP providers must supply grepService; remote-mcp must migrate its provider and helper use before adopting this package version.
• Public grep client API - Export GrepServiceImpl, grep request/result types, and typed grep errors from @githits/mcp/client for host service composition.

Hosted clients receive these changes after adoption and deployment by remote-mcp.

[githits 0.24.0] - 2026-09-30

Minor release: adds unified CLI grep and MCP listing, and improves exact read follow-ups across search, listing, and research results.

Added

• Unified grep CLI - Add githits grep across ordered package, repository and hosted documentation targets, defaulting to regex, case-sensitive matching and zero context, with -F, -i, rg-style -s, exact read actions and explicit partial coverage, including retained unvisited scopes and cursor continuation. Legacy CLI code grep and MCP code_grep remain available pending the MCP migration.

Changed

• Unified MCP inventory browsing - Replace the callable code_files and docs_list tools with one list tool for package, repository, and explicit site inventories. Its description retains both retired names for stale tool searches; legacy grouped CLI commands remain available. MCP hosts must provide McpToolServices.listService, and custom endpoints must implement Query.list. Default text includes the opaque after continuation when more entries are available.
• Claude plugin metadata - Add the GitHits display name, publisher contact email, and publisher website to the generated Claude plugin manifest.
• Backend-owned read actions - Search/status and inventory listings emit canonical read commands using backend-selected targets, paths, selectors and bounds, preserving producer attribution and existing JSON shapes and caps. CLI commands safely handle dash-leading filenames; capped MCP continuations retain the whole remaining selection and served revision. Additive SDK metadata preserves custom-provider compatibility, and agent guidance tells callers to replay complete actions. Production descriptor support gates publication; the stable MCP guide and exact public skill copy ship in this release.
• Grouped grep output - Group unified CLI grep matches by file or page with aligned line numbers, native match highlighting and numbered copyable file/page locators and one source summary. Remove repeated rows, read footers and routine status scaffolding while retaining coverage warnings, every distinct evidence window and lossless JSON.
• Compact search results - Omit repeated per-hit read commands from CLI and MCP search text; headers remain usable for reads and JSON retains exact follow-up actions.

Fixed

• Source listing filters - CLI and MCP list accept language and file-type names regardless of casing. Clarify classification filters and extension globs, and distinguish full page URLs from site target/path reads in agent guidance.
• Leading-slash site selectors - CLI and local MCP list accept one leading / in a site path and keep it within the required target's scope; / alone browses that target's root. Source paths and backend-authored read actions remain unchanged.
• Backend-owned Research display - Experimental CLI and local MCP Research display the API's complete Markdown, allowing answer sections and citations to evolve without client releases. JSON preserves the minimal display_markdown envelope and optional IDs. Requires the coordinated backend update; replaces the old structured answer/source JSON contract. Transport limits, error handling, and terminal sanitization remain intact.
• Site directory paths - Fix CLI list text losing the first directory component or printing repeated / entries, and keep descendant-site headers compatible with emitted relative paths. Correct CLI and MCP read-path guidance while preserving exact read/browse actions.

Hosted clients receive MCP changes after @githits/mcp@0.24.0 adoption and deployment by remote-mcp.

[@githits/mcp 0.24.0] - 2026-09-30

Minor release: unifies MCP inventory browsing and improves exact read follow-ups.

Changed

• Unified MCP inventory browsing - Replace the callable code_files and docs_list tools with one list tool for package, repository, and explicit site inventories. Its description retains both retired names for stale tool searches. Hosts must provide McpToolServices.listService; ListService and ListServiceImpl are exported from @githits/mcp/client. Custom endpoints must implement Query.list. Default text includes the opaque after continuation when more entries are available.
• Backend-owned read actions - MCP search/status and list emit backend-selected read targets, paths, selectors and bounds. Capped continuations retain the whole remaining selection and served revision; JSON shapes and caps remain stable. Additive SDK metadata preserves custom-provider compatibility, and the stable MCP guide tells agents to replay complete actions. Production descriptor support gates publication.
• Compact search results - Omit repeated per-hit read commands from MCP search text; headers remain usable for reads and JSON retains exact follow-up actions.

Fixed

• Source listing filters - MCP list accepts language and file-type names regardless of casing. Clarify classification filters and extension globs, and distinguish full page URLs from site target/path reads in agent guidance.
• Leading-slash site selectors - MCP list accepts one leading / in a site path and keeps it within the required target's scope; / alone browses that target's root. Backend-authored read actions remain unchanged.
• Site directory paths - Correct MCP read-path guidance for descendant sites while preserving exact read/browse actions.

Hosted clients receive these changes after adoption and deployment by remote-mcp.

[githits 0.23.0] - 2026-09-28

Minor release: adds unified CLI inventories and site-page reads, adopts v31 search evidence, and selects development services with GITHITS_ENV.

Changed

• Update public CLI skills for this release - Route inventory discovery to githits list, document site-page reads and opaque-cursor paging, remove retired search JSON claims, and explain development login selection. MCP guidance retains the existing code_files and docs_list catalog.
• Service environment presets - GITHITS_ENV=dev selects development MCP, REST, OSS, and CLI accounts defaults; unset, blank, or prod selects production. URL overrides remain independent. The production OSS default is now https://oss.githits.dev. Development uses a separate MCP login namespace; run login with the same environment. doctor reports the selected environment or invalid selector, and local recovery commands remain available with malformed network settings. This does not reconfigure hosted MCP or plugin endpoints.
• GPT-6 Luna agent evals - Use GPT-6 Luna for new local and PR eval runs, with its current rate card while retaining historical GPT-5.6 Luna metrics.
• Unified CLI listing and site reads - githits list <target> [paths...] browses package, repository, and explicit documentation-site inventories with path/glob selectors, recursive traversal, filters, opaque-cursor paging, direct read guidance, paths-only --silent output, and lossless JSON. CLI and local MCP read accept emitted site: targets plus host-relative page paths. githits code files is deprecated in help; grouped command execution remains available. The MCP catalog retains code_files and docs_list.
• Direct exact-file reads - Compact githits read file requests now use the unified typed read operation while preserving CLI ranges, output identity, and file recovery guidance. Custom OSS endpoints must implement Query.read; the new inventory command requires Query.list.

Removed

• Remove legacy Discovery hit fields - Search and search status no longer select or emit summary, highlights.summary, hit contentSafety, or repositoryEvidence.focusedSource. JSON consumers must use v31 repository evidence (matchedSource, indexed-field provenance, and semantic context) and documentationPreview. Text shows proven repository source, navigation candidates, and crawled documentation previews without legacy summary hydration.
• Remove the PKGSEER_URL alias - PKGSEER_URL no longer configures the OSS backend or passes through eval launches; move custom OSS endpoint values to the existing GITHITS_CODE_NAV_URL. This applies to the CLI, local MCP, and consumers of @githits/mcp/client URL getters; it does not change hosted MCP configuration.

Fixed

• Label advisory applicability in text - CLI pkg vulns and MCP pkg_vulns mark each advisory as affecting the inspected version or historical when the service supplies that status, so mixed-scope output does not make fixed critical advisories appear active. JSON retains the existing lossless status fields.
• Count unified CLI calls in agent evals - Recognize top-level githits list and githits read in captured shell events so new eval metrics and MCP CLI-fallback validation include those operations; historical artifacts are unchanged. Document private token injection from the existing host login for authenticated isolated evals.
• Claude plugin listing metadata and packaged icon - Add the approved Pulse monogram icon and privacy-policy link to the generated Claude manifest, and ship the referenced SVG in npm packages.
• Consistent package-addressed repo docs - Search displays package-attributed repository documentation with the served package target and target-relative path and line range, matching repo code headers; generated unified-read follow-ups use the same package addressing while JSON retains snapshot provenance.

Hosted clients receive MCP tool changes after @githits/mcp@0.23.0 adoption and deployment by remote-mcp. Local environment selection does not change hosted configuration.

[@githits/mcp 0.23.0] - 2026-09-28

Minor release: adds site-page reads, adopts v31 search evidence, and updates public client URL configuration.

Changed

• Client service environment presets - @githits/mcp/client URL getters accept an optional environment object and select production or development defaults through GITHITS_ENV=prod|dev. Unset or blank selects production; existing URL overrides remain independent. The production OSS default is now https://oss.githits.dev. This affects hosts using these getters and does not reconfigure separately managed hosted endpoints.
• Site-page reads - MCP read accepts an emitted site: target plus a host-relative page path, with optional heading selection. The MCP inventory catalog remains code_files and docs_list; unified MCP list is a later increment.

Removed

• Remove legacy Discovery hit fields - Search and search status no longer select or emit summary, highlights.summary, hit contentSafety, or repositoryEvidence.focusedSource. JSON consumers must use v31 repository evidence (matchedSource, indexed-field provenance, and semantic context) and documentationPreview. Text shows proven repository source, navigation candidates, and crawled documentation previews without legacy summary hydration.
• Remove the PKGSEER_URL alias - Consumers of @githits/mcp/client URL getters must move custom OSS endpoint values to GITHITS_CODE_NAV_URL; PKGSEER_URL is ignored.

Fixed

• Label advisory applicability in text - CLI pkg vulns and MCP pkg_vulns mark each advisory as affecting the inspected version or historical when the service supplies that status, so mixed-scope output does not make fixed critical advisories appear active. JSON retains the existing lossless status fields.
• Repository-page smoke checks - The public MCP smoke helper now validates repository-page reads as indexed files with snapshot identity, matching the current backend result.
• Consistent package-addressed repo docs - Search displays package-attributed repository documentation with the served package target and target-relative path and line range, matching repo code headers; generated unified-read follow-ups use the same package addressing while JSON retains snapshot provenance.

Hosted clients receive MCP tool changes after @githits/mcp@0.23.0 adoption and deployment by remote-mcp. Local environment selection does not change hosted configuration.

[githits 0.22.1] - 2026-09-25

Patch release: adds compact code-symbol reads to the CLI and local MCP server.

Added

• Compact code-symbol reads - Read package and repository symbols with target#symbol and an optional exact path. The backend's unified result chooses code or documentation presentation, preserving HTTP(S) documentation fragments and emitted repository page IDs. @githits/mcp@0.22.0 already includes this MCP behavior; hosted clients still require adoption and deployment by remote-mcp.

Fixed

• Protect root release tag provenance - The release workflow creates the root tag before npm publication, so a failed release can resume at its original source commit. It stops if a published version has no tag instead of tagging a later main commit.
• Keep package builds deterministic - Root and MCP builds clean their output directories before bundling, preventing an intermittent missing-file failure during release validation.

[githits 0.22.0] - 2026-09-23

Minor release: adds selector reads and renames the experimental research entrypoints.

Added

• Selector reads - githits read --selector and local MCP read with selector read documentation headings and indexed code symbols. Ambiguous, missing, and unsupported-snapshot symbol selections return typed outcomes with recovery guidance.

Changed

• Rename experimental research entrypoints - The local MCP tool is now research; the CLI uses githits research and retains githits ask as an alias. Both CLI spellings now emit command.research telemetry instead of command.ask. Local MCP clients using ask must switch to research when experimental tools are enabled.

Fixed

• Clarify candidate code search hits - CLI and local MCP text search show bounded inspection windows, visible identifier-query fragments, and known enclosing declarations in candidate headers, without presenting fallback summaries as verified source matches.
• Keep server error pages out of CLI and local MCP errors - GraphQL HTTP errors retain status and safe JSON details without displaying HTML or plain-text response bodies.

[@githits/mcp 0.22.0] - 2026-09-23

Minor release: adds selector reads to the public MCP read tool.

Added

• Selector reads - MCP read accepts selector for documentation headings and indexed code symbols, including typed ambiguity, miss, and unsupported-snapshot outcomes. Hosted clients receive this after @githits/mcp adoption and deployment by remote-mcp.

Fixed

• Clarify candidate code search hits - MCP text search shows bounded inspection windows, visible identifier-query fragments, and known enclosing declarations in candidate headers, without presenting fallback summaries as verified source matches.
• Keep server error pages out of MCP errors - GraphQL HTTP errors retain status and safe JSON details without displaying HTML or plain-text response bodies.

[githits 0.21.0] - 2026-09-22

Minor release: makes package changelog lookup package-only and adopts compact targets for its MCP and CLI surfaces.

Changed

• Package-only changelog targets - MCP pkg_changelog replaces registry, package_name, repo_url, git_ref, from_version, and to_version with one required target (npm:express, npm:express@5.2.1, or npm:express@4.21.2..5.2.1). CLI drops --repo-url and --git-ref, accepts the same package forms, and keeps --from/--to as package range flags. Exact pins return one selected release or VERSION_NOT_FOUND; empty timeline selections succeed instead of becoming NOT_FOUND.
• Clarify compact targets - Agent guidance, CLI help, and MCP target schemas now explain suffix omission for latest-package/default-branch selection, distinguish package-subpath scope from full-repository scope, and state where changelog limit is accepted or rejected.

MCP callers must refresh tool discovery and migrate pkg_changelog calls to the required compact target. CLI users must replace repository changelog lookups with package targets. Hosted clients receive these changes only after @githits/mcp adoption and deployment by remote-mcp.

[@githits/mcp 0.21.0] - 2026-09-22

Minor release: makes package changelog lookup package-only and adopts its compact target schema.

Changed

• Package-only changelog targets - MCP pkg_changelog replaces registry, package_name, repo_url, git_ref, from_version, and to_version with one required target (npm:express, npm:express@5.2.1, or npm:express@4.21.2..5.2.1). CLI drops --repo-url and --git-ref, accepts the same package forms, and keeps --from/--to as package range flags. Exact pins return one selected release or VERSION_NOT_FOUND; empty timeline selections succeed instead of becoming NOT_FOUND.
• Clarify compact targets - Agent guidance, CLI help, and MCP target schemas now explain suffix omission for latest-package/default-branch selection, distinguish package-subpath scope from full-repository scope, and state where changelog limit is accepted or rejected.

MCP callers must refresh tool discovery and migrate pkg_changelog calls to the required compact target. Hosted clients receive these changes only after package adoption and deployment by remote-mcp.

[githits 0.20.0] - 2026-09-18

Minor release: adopts compact canonical targets across four MCP package tools.

Added

• OpenRouter Codex model trials - Explicit main model config and prompt-based JSON reporting enable isolated caller-selected OpenRouter workload/suite runs with truthful model identity and credential redaction; the trusted generic OpenRouter PR label and an explicitly committed candidate config select the shared full main matrix and aggregate Braintrust export while Luna remains the default.

Changed

• Compact package tool targets - MCP docs_list, pkg_info, pkg_vulns, and pkg_deps replace registry, package_name, and version inputs with string target (for example npm:express@5.2.1); pkg_info requires an unpinned latest-only target. CLI syntax, filters, and service requests are unchanged; output is unchanged except that docs_list retry hints use the new target syntax. pkg_changelog and pkg_upgrade_review retain their structured inputs.
• Compact agent instructions - Centralize shared policy in the routing guide and skills, retain selected-tool call essentials and original format/safety reminders, and make catalog selection sentences complete within 79 characters. Clarify changelog upper caps and dependency graph opt-ins without changing runtime behavior. Hosted MCP clients require the next MCP package release and server adoption; bootstrap remains guidance, not enforcement.

Fixed

• Agent eval timeout reporting - Keep awaited subprocess cleanup alive so a final workload timeout cannot make Bun exit successfully before failed-run and suite reports are written.
• Keep hosted documentation follow-ups stable across publications - Automatic search follow-ups now reuse mutable hosted page URLs or exact emitted fragments without stale search line bounds, while repository-document snapshots and explicit read ranges remain unchanged.

MCP callers must refresh tool discovery and migrate the four changed package tool call shapes after updating. Hosted clients receive these changes only after @githits/mcp adoption and deployment by remote-mcp.

[@githits/mcp 0.20.0] - 2026-09-18

Minor release: adopts compact canonical targets across four MCP package tools.

Changed

• Compact package tool targets - MCP docs_list, pkg_info, pkg_vulns, and pkg_deps replace registry, package_name, and version inputs with string target (for example npm:express@5.2.1); pkg_info requires an unpinned latest-only target. CLI syntax, filters, and service requests are unchanged; output is unchanged except that docs_list retry hints use the new target syntax. pkg_changelog and pkg_upgrade_review retain their structured inputs.
• Compact agent instructions - Centralize shared policy in the routing guide and skills, retain selected-tool call essentials and original format/safety reminders, and make catalog selection sentences complete within 79 characters. Clarify changelog upper caps and dependency graph opt-ins without changing runtime behavior. Hosted MCP clients require the next MCP package release and server adoption; bootstrap remains guidance, not enforcement.

Fixed

• Keep hosted documentation follow-ups stable across publications - Automatic search follow-ups now reuse mutable hosted page URLs or exact emitted fragments without stale search line bounds, while repository-document snapshots and explicit read ranges remain unchanged.

MCP callers must refresh tool discovery and migrate the four changed package tool call shapes after updating. Hosted clients receive these changes only after package adoption and deployment by remote-mcp.

[githits 0.19.0] - 2026-09-16

Removed

• Remove language discovery - MCP search_language and githits languages are gone. Pass a language to get_example / githits example --lang, or omit it to infer. If GitHits cannot match the language, the error lists alternatives to retry with. Callers of GitHitsService.getLanguages / searchLanguages must migrate.

MCP callers must refresh tool discovery after updating. Hosted clients receive these changes only after @githits/mcp adoption and deployment by remote-mcp.

[@githits/mcp 0.19.0] - 2026-09-16

Removed

• Remove language discovery - MCP search_language is gone. Pass a language to get_example, or omit it to infer. If GitHits cannot match the language, the error lists alternatives to retry with. Callers of GitHitsService.getLanguages / searchLanguages must migrate.

MCP callers must refresh tool discovery after updating. Hosted clients receive these changes only after @githits/mcp adoption and deployment by remote-mcp.

[githits 0.18.0] - 2026-09-16

Changed

• Use compact MCP targets - search, code_files, code_grep, and experimental code_diff now require target strings: migrate {registry:"npm",package_name:"express",version:"5.2.1"} to "npm:express@5.2.1", {repo_url:"https://github.com/expressjs/express",git_ref:"main"} to "github:expressjs/express@main", and search {site:"https://expressjs.com/"} to "site:expressjs.com"; CLI syntax is unchanged.
• Unify compact reads - Compact reads now use backend Query.read; deprecated reads and --repo-url compatibility paths remain on legacy roots so migration usage stays observable. McpToolServices.readService is now required, with ReadService and ReadServiceImpl exported from @githits/mcp/client for hosts. Custom GITHITS_CODE_NAV_URL or PKGSEER_URL endpoints must implement Query.read for compact reads.
• Separate repository revisions from fragments - Repository targets now use provider:path@ref, preserve later @ characters inside refs, and reject legacy #ref input with the exact canonical replacement. Package registry:name@version targets and documentation fragments remain unchanged.
• Use inline MCP search qualifiers - Move category, kind, path_prefix, file_intent, name, and language into query as category:callable, kind:function, path:lib/, intent:production, name:Router, and lang:typescript; CLI flags, public_only, results, and continuation behavior are unchanged.

MCP callers must refresh tool discovery after updating. Hosted clients receive these changes only after @githits/mcp adoption and deployment by remote-mcp; custom hosts must supply the newly required readService.

[@githits/mcp 0.18.0] - 2026-09-16

Changed

• Use compact MCP targets - search, code_files, code_grep, and experimental code_diff now require target strings: migrate {registry:"npm",package_name:"express",version:"5.2.1"} to "npm:express@5.2.1", {repo_url:"https://github.com/expressjs/express",git_ref:"main"} to "github:expressjs/express@main", and search {site:"https://expressjs.com/"} to "site:expressjs.com"; CLI syntax is unchanged.
• Unify compact reads - Compact reads now use backend Query.read; deprecated reads and --repo-url compatibility paths remain on legacy roots so migration usage stays observable. McpToolServices.readService is now required, with ReadService and ReadServiceImpl exported from @githits/mcp/client for hosts. Custom GITHITS_CODE_NAV_URL or PKGSEER_URL endpoints must implement Query.read for compact reads.
• Separate repository revisions from fragments - Repository targets now use provider:path@ref, preserve later @ characters inside refs, and reject legacy #ref input with the exact canonical replacement. Package registry:name@version targets and documentation fragments remain unchanged.
• Use inline MCP search qualifiers - Move category, kind, path_prefix, file_intent, name, and language into query as category:callable, kind:function, path:lib/, intent:production, name:Router, and lang:typescript; CLI flags, public_only, results, and continuation behavior are unchanged.

MCP callers must refresh tool discovery after updating. Hosted clients receive these changes only after @githits/mcp adoption and deployment by remote-mcp; custom hosts must supply the newly required readService.

[githits 0.17.1] - 2026-09-14

Fixed

• Public-evidence tool annotations - Mark public code, documentation, package, search-result, and experimental research tools as open-world while keeping every tool read-only and non-destructive; static guidance and language lookup remain closed-world. Clients with open-world restrictions can now filter these evidence tools. Refresh tool discovery after updating; hosted clients require MCP package adoption and deployment. The published MCP smoke helper also rejects incorrect or missing domain and non-destructive annotations.

[@githits/mcp 0.17.1] - 2026-09-14

Fixed

• Public-evidence tool annotations - Mark public code, documentation, package, and search-result tools as open-world while keeping every tool read-only and non-destructive; static guidance and language lookup remain closed-world. Clients with open-world restrictions can now filter these evidence tools. Refresh tool discovery after updating; hosted clients require MCP package adoption and deployment. The published MCP smoke helper also rejects incorrect or missing domain and non-destructive annotations.

[githits 0.17.0] - 2026-09-14

Minor release: unifies code and documentation reading and adopts backend indexing estimates for longer discovery waits.

Changed

• Estimate-aware discovery waits - Preserve indexing timing evidence in search/status JSON and use it for shared CLI/MCP follow-up suggestions, with discovery waits up to 120 seconds, matching HTTP deadlines and MCP cancellation; defaults remain unchanged when ranges are unavailable. Requires backend estimate/extended-wait support on all production serving nodes and verified proxy/MCP caller timeout allowances before release/adoption.
• Unified reading - Replace MCP code_read and docs_read with read, using a compact target and optional file path; preserve documentation fragments and code indexing waits, translate Ask citations, and add githits read while retaining deprecated CLI aliases. MCP callers must rediscover the catalog; hosted clients receive the change after package adoption and deployment.

Fixed

• Copyable file-list targets - Render the served repository commit in MCP code_files headers instead of treating a Git SHA as a package version, so the displayed target can be passed directly to read.
• Copyable repository documentation targets - Show the backend's repo-doc read locator and separate line bounds in search text, matching the existing JSON follow-up and avoiding invented package/path locators.

[@githits/mcp 0.17.0] - 2026-09-14

Minor release: replaces the two reader tools with one unified read tool and adopts backend indexing estimates for longer discovery waits.

Changed

• Estimate-aware discovery waits - Preserve indexing timing evidence in search/status JSON and use it for shared CLI/MCP follow-up suggestions, with discovery waits up to 120 seconds, matching HTTP deadlines and MCP cancellation; defaults remain unchanged when ranges are unavailable. Requires backend estimate/extended-wait support on all production serving nodes and verified proxy/MCP caller timeout allowances before release/adoption.
• Unified reading - Replace MCP code_read and docs_read with read, using a compact target and optional file path; preserve documentation fragments and code indexing waits, translate Ask citations, and add githits read while retaining deprecated CLI aliases. MCP callers must rediscover the catalog; hosted clients receive the change after package adoption and deployment.

Fixed

• Copyable file-list targets - Render the served repository commit in MCP code_files headers instead of treating a Git SHA as a package version, so the displayed target can be passed directly to read.
• Copyable repository documentation targets - Show the backend's repo-doc read locator and separate line bounds in search text, matching the existing JSON follow-up and avoiding invented package/path locators.

[githits 0.16.2] - 2026-09-11

Changed

• Compact wait guidance - Move repeated MCP wait and indexing-recovery guidance into the shared quick_start and githits-mcp skill, and shorten wait parameter descriptions to units and bounds derived from shared constants. The next CLI and MCP releases carry the updated guidance.
• Longer default indexing wait - Increase the shared CLI and MCP search, search-status, and code-navigation wait from 20 to 30 seconds to allow more time for indexing and metadata fetches before returning progress. Explicit wait overrides and the 60-second maximum remain unchanged.
• Read exact documentation sections and ranges - Search now emits indexed fragments as ready-to-read targets, while docs read and docs_read resolve them without synthetic bounds, preserve absolute page coordinates, and keep unresolved sections distinct from missing pages; deploy the compatible backend schema before releasing this client.
• Ask follow-up scope - Explain how to change project, version, or topic in an existing thread and keep the thread when clarifying a failed lookup.
• Prefer token-efficient MCP text output - Keep model-visible results in text and reserve JSON for direct host-side field handling or fields absent from text, not ordinary MCP or TypeScript invocation.

Fixed

• Search path-prefix validation - Reject path prefixes locally when no code search source is selected, and correct CLI/MCP guidance to explain that documentation and symbol searches do not support this filter.
• Ask guidance - Remove the instruction to report defects using an Ask run ID because no such reporting action is available.
• Local evaluation cleanup - Wait for both target preflights before returning a setup failure, preventing Windows cleanup from racing an outstanding Git subprocess.

[@githits/mcp 0.16.2] - 2026-09-11

Changed

• Compact wait guidance - Move repeated MCP wait and indexing-recovery guidance into the shared quick_start and githits-mcp skill, and shorten wait parameter descriptions to units and bounds derived from shared constants. The next CLI and MCP releases carry the updated guidance.
• Longer default indexing wait - Increase the shared CLI and MCP search, search-status, and code-navigation wait from 20 to 30 seconds to allow more time for indexing and metadata fetches before returning progress. Explicit wait overrides and the 60-second maximum remain unchanged.
• Read exact documentation sections and ranges - Search now emits indexed fragments as ready-to-read targets, while docs read and docs_read resolve them without synthetic bounds, preserve absolute page coordinates, and keep unresolved sections distinct from missing pages; deploy the compatible backend schema before releasing this client.
• Ask follow-up scope - Explain how to change project, version, or topic in an existing thread and keep the thread when clarifying a failed lookup.
• Prefer token-efficient MCP text output - Keep model-visible results in text and reserve JSON for direct host-side field handling or fields absent from text, not ordinary MCP or TypeScript invocation.

Fixed

• Search path-prefix validation - Reject path prefixes locally when no code search source is selected, and correct CLI/MCP guidance to explain that documentation and symbol searches do not support this filter.
• Ask guidance - Remove the instruction to report defects using an Ask run ID because no such reporting action is available.

[githits 0.16.1] - 2026-09-10

Patch release: routes agents through a smaller self-contained MCP guide and accepts oversized grep context requests by clamping them to the supported range.

Added

• Reproducible agent context measurements - Add offline content inventory/replay, request-usage extraction, a production-schema fixture server, and documented Codex/Claude discovery and routing-format experiments without changing published guidance or runtime behavior.
• Skill-bearing PR eval coverage - Include the existing full-guidance scenario in agent-eval CI and Braintrust exports so canonical MCP skill changes are measured alongside descriptor-only scenarios.

Changed

• Routing guidance before tool discovery - Make the self-contained MCP skill and quick-start guide lead with question-to-tool routing, defer argument details to the selected tool, and preserve public-source scope, citations, and untrusted-content rules.

Fixed

• Grep oversized context without a retry - Clamp nonnegative integer context requests to 10 lines per side, preserve asymmetric overrides, and return requested/effective values in JSON with an actionable text notice. Direct larger source windows to code_read instead of repeating grep.

Hosted MCP users receive the routing and grep changes after the remote server adopts @githits/mcp@0.16.1 and deploys.

[@githits/mcp 0.16.1] - 2026-09-10

Patch release: improves evidence-tool routing and handles oversized grep context requests without requiring a retry.

Changed

• Routing guidance before tool discovery - Make the self-contained MCP skill and quick-start guide lead with question-to-tool routing, defer argument details to the selected tool, and preserve public-source scope, citations, and untrusted-content rules.

Fixed

• Grep oversized context without a retry - Clamp nonnegative integer context requests to 10 lines per side, preserve asymmetric overrides, and return requested/effective values in JSON with an actionable text notice. Direct larger source windows to code_read instead of repeating grep.

Hosted clients receive these changes after the remote server adopts @githits/mcp@0.16.1 and deploys.

[githits 0.16.0] - 2026-09-10

Minor release: removes feedback (breaking change) and marks all remaining MCP information tools read-only. Packaged skills match the smaller tool catalog.

Changed

• Read-only information tools - All remaining MCP tools advertise readOnlyHint: true, including local experimental Ask. Internal result storage, preparation, and research-thread behavior remain unchanged.

Removed

• Feedback submission - Remove the MCP feedback tool and githits feedback command. Remove feedback instructions; existing experimental.report_tool_issues config keys are ignored. Remove feedback calls from integrations and refresh MCP tool discovery after updating.

Fixed

• Actionable Ask target errors - CLI and local MCP Ask preserve validated server diagnostics and recovery guidance, including unfamiliar diagnostic codes and reasons. Diagnostic codes and reasons can evolve without a client update. Legacy or malformed responses receive actionable fallback text.
• Public skill guidance - Remove CLI feedback recommendations and the onboarding feedback disclosure. Onboarding and recovery preserve the requested CLI version, project scope, guidance preference, and separate Cursor authentication. This release packages the skill cleanup already merged to main.

Hosted MCP users, including plugins and direct Cursor setup, receive the tool annotation and feedback changes after the remote server adopts the new MCP package and deploys.

[@githits/mcp 0.16.0] - 2026-09-10

Minor release: removes the feedback tool and service API (breaking change).

Changed

• Read-only information tools - All remaining tools advertise readOnlyHint: true. The public runMcpSmoke() helper requires this annotation on every advertised tool and rejects catalogs that retain feedback. Internal result storage and preparation retain their existing behavior.

Removed

• Feedback submission - Remove the MCP feedback tool and submitFeedback from the public service interface and concrete clients. Remove feedback instructions. Consumers must remove calls to the retired API/tool and refresh MCP tool discovery after updating.

Hosted clients receive these changes after the remote server adopts @githits/mcp@0.16.0 and deploys.

[githits 0.15.1] - 2026-09-08

Patch release: aligns Ask target clarification across CLI and local MCP and preserves documentation indexing state.

Fixed

• Ask target clarification - Display resolver candidates with confidence, related targets, and evidence metadata when Ask requests a specific target. Question-only asks work in both the CLI and local MCP. Requires server support; answered responses and explicit-target behavior remain unchanged.
• Documentation indexing state - docs list distinguishes active preparation from terminal empty results and retains provisional pages with exact lifecycle state in JSON.

[@githits/mcp 0.15.1] - 2026-09-08

Patch release: preserves documentation indexing state.

Fixed

• Documentation indexing state - docs_list distinguishes active preparation from terminal empty results and retains provisional pages with exact lifecycle state in JSON.

Hosted MCP users receive applicable changes after the service rollout.

[githits 0.15.0] - 2026-09-08

Minor release: adds Codeberg and nested GitLab repository targets and lets experimental CLI Ask infer a target from a question.

Added

• Multi-provider repository targets - Add explicit codeberg:owner/repo and nested gitlab:group/subgroup/project targets alongside GitHub across search and code navigation. Preserve provider identity and exact refs in follow-ups, GitHub shorthand/HTTP compatibility, and registry-native Swift/Zig coordinates. Bare repository names and unsupported hosts are rejected. Public code, MCP, and package guidance now describe the supported target forms.
• Question-only Ask - Experimental CLI githits ask "question" lets GitHits identify a public package or repository from the question. Explicit targets and thread follow-ups remain supported.

Fixed

• Code navigation authentication - Recognize backend AUTHENTICATION_REQUIRED errors and attempt the existing single credential refresh, matching package-intelligence behavior while preserving access-denied errors.
• Rejected refresh credentials - Recognize OAuth and Supabase refresh-token and session rejection codes without relying on description wording, clearing unchanged rejected tokens while preserving client registration and credentials replaced during refresh.
• On-demand site documentation - Resolution describes site documentation needing preparation as crawled on demand while preserving ordinary on-demand search continuation, identity, ordering, and security checks.
• Release availability checks - Both npm release pipelines wait for the exact package version to become public before downstream publication, and recover accepted uploads still undergoing npm scanning when a release job is rerun.

[@githits/mcp 0.15.0] - 2026-09-08

Minor release: adds Codeberg and nested GitLab repository targets.

Added

• Multi-provider repository targets - Add explicit codeberg:owner/repo and nested gitlab:group/subgroup/project targets alongside GitHub across search and code navigation. Preserve provider identity and exact refs in follow-ups, GitHub shorthand/HTTP compatibility, and registry-native Swift/Zig coordinates. Bare repository names and unsupported hosts are rejected. MCP guidance and contextual tool help describe the supported target forms.

Fixed

• Code navigation authentication - Recognize backend AUTHENTICATION_REQUIRED errors and use the existing authentication handling path while preserving access-denied errors.
• On-demand site documentation - Resolution describes site documentation needing preparation as crawled on demand while preserving ordinary on-demand search continuation, identity, ordering, and security checks.

Hosted MCP clients receive these changes after remote-mcp updates this package and deploys the hosted server.

[githits 0.14.0] - 2026-09-07

Minor release: changes default search text to authoritative match evidence and adds opt-in resolved-dependency vulnerability audits and dependency registries.

Added

• Expand dependency registry support - CLI pkg deps and MCP pkg_deps now accept NuGet, Maven, and Packagist alongside the other deployed dependency registries.
• Discovery match evidence - Search JSON adds indexed-field provenance, authoritative matched source, and crawled-documentation previews. Default search text renders path-only matches as compact file headers instead of arbitrary source chunks, shows proven source snippets, and uses structural documentation previews. Requires the deployed additive v31 producer schema.
• Audit resolved dependency vulnerabilities - Add opt-in transitive vulnerability evidence to pkg vulns and pkg_vulns while preserving direct-only defaults and applying advisory scope consistently to root and dependency rows.

Changed

• Complete CLI vulnerability rows - CLI compact text now shows every selected direct and transitive advisory row; verbose mode adds clearer transitive evidence and JSON preserves advisory-wide affected-range and fixed-version fields.

Fixed

• Agent eval isolation validation - Stop treating rg --files guidance filename globs as guidance content reads, while retaining checks for actual reads in the same command.

Security

• Sanitize vulnerability terminal text - Strip hostile terminal control sequences from vulnerability display values while preserving lossless JSON evidence.

[@githits/mcp 0.14.0] - 2026-09-07

Minor release: changes default search text to authoritative match evidence and adds opt-in resolved-dependency vulnerability audits and dependency registries.

Added

• Expand dependency registry support - pkg_deps now accepts NuGet, Maven, and Packagist alongside the other deployed dependency registries.
• Discovery match evidence - Search JSON adds indexed-field provenance, authoritative matched source, and crawled-documentation previews. Default search text renders path-only matches as compact file headers instead of arbitrary source chunks, shows proven source snippets, and uses structural documentation previews. Requires the deployed additive v31 producer schema.
• Audit resolved dependency vulnerabilities - Add opt-in transitive vulnerability evidence to pkg vulns and pkg_vulns while preserving direct-only defaults and applying advisory scope consistently to root and dependency rows.

Changed

• Detailed vulnerability evidence - Verbose text adds clearer transitive evidence and JSON preserves advisory-wide affected-range and fixed-version fields. Compact MCP text remains capped; use verbose mode for all selected advisory rows.

Security

• Sanitize vulnerability terminal text - Strip hostile terminal control sequences from vulnerability display values while preserving lossless JSON evidence.

Hosted MCP clients receive these changes after remote-mcp updates this package and deploys the hosted server.

[githits 0.13.0] - 2026-09-07

Minor release: adds semantic search context and documentation read targets, simplifies MCP output formats, and replaces legacy -> upgrade ranges with ...

Added

• Semantic search context - Search and search-status show enclosing declarations and numbered focused source, with precise attributed read coordinates and additive structural evidence in JSON. Requires the backend structural-evidence schema; hosted MCP adoption also requires updating and deploying remote-mcp after the package release.

Changed

• Upgrade-review range syntax - Accept positional .. ranges, including scoped packages, and remove the legacy -> delimiter; use .. for all compact ranges.
• Read documentation through emitted targets - Docs list and search now retain docsReadTarget, stable pageId, and provenance sourceUrl, prefer clickable URL targets in follow-ups, and keep historical ID reads compatible.
• MCP output formats - All format-selectable tools now expose only text (default) and json, with guidance to reserve JSON for programmatic follow-up or exact structured details. Explicit text-v1 callers must switch to text or omit the format parameter; rendering and JSON payloads are unchanged.
• Text follow-up guidance - Tool format descriptions, quick_start, and the GitHits MCP skill explicitly recommend text for reading and subsequent tool calls, reserving JSON for parsing in code or required fields absent from text.

Fixed

• Go version compatibility (already shipped in CLI 0.12.1) - Package documentation, dependency, vulnerability, changelog, and upgrade-review inputs accept exact Go versions with or without v and send the canonical v-prefixed form. This records the previously omitted CLI release note; the matching MCP fix first ships in 0.13.0.

[@githits/mcp 0.13.0] - 2026-09-07

Minor release: adds semantic search context, documentation read targets, and simplifies MCP output formats.

Added

• Semantic search context - Search and search-status show enclosing declarations and numbered focused source, with precise attributed read coordinates and additive structural evidence in JSON. Requires the backend structural-evidence schema; hosted MCP adoption also requires updating and deploying remote-mcp after the package release.

Changed

• Read documentation through emitted targets - Docs list and search now retain docsReadTarget, stable pageId, and provenance sourceUrl, prefer clickable URL targets in follow-ups, and keep historical ID reads compatible.
• MCP output formats - All format-selectable tools now expose only text (default) and json, with guidance to reserve JSON for programmatic follow-up or exact structured details. Explicit text-v1 callers must switch to text or omit the format parameter; rendering and JSON payloads are unchanged.
• Text follow-up guidance - Tool format descriptions, quick_start, and the GitHits MCP skill explicitly recommend text for reading and subsequent tool calls, reserving JSON for parsing in code or required fields absent from text.

Fixed

• Accept canonical Go module versions - Package documentation, dependency, vulnerability, changelog, and upgrade-review inputs now accept exact Go versions with or without v and send the backend the canonical v-prefixed form.

[githits 0.12.1] - 2026-09-04

Patch release: adds opt-in dependency issue analysis and expanded package overview evidence, and improves GitHits skill discovery.

Added

• Dependency issue analysis - Opt into deprecated, outdated, duplicate, and conflict analysis with pkg deps --issues or MCP include_issues: true, including actionable conflict constraints and importer provenance in text and JSON.
• Clarify package overview evidence - pkg_info separates latest-version affected vulnerabilities from package-wide advisory history, keeps that summary evidence-only, improves URL contrast, and exposes published-version count plus download freshness in verbose text and JSON. Full-history routing remains available in CLI help and the MCP descriptor.

Fixed

• Improve GitHits skill discovery - Make the MCP skill describe the OSS and package tasks that should trigger it instead of assuming GitHits was already selected.

[@githits/mcp 0.12.1] - 2026-09-04

Coordinated patch release: adds opt-in dependency issue analysis and expanded package overview evidence.

Added

• Dependency issue analysis - Opt into deprecated, outdated, duplicate, and conflict analysis with MCP include_issues: true, including actionable conflict constraints and importer provenance in text and JSON.
• Clarify package overview evidence - pkg_info separates latest-version affected vulnerabilities from package-wide advisory history, keeps that summary evidence-only, improves URL contrast, and exposes published-version count plus download freshness in verbose text and JSON. Full-history routing remains available in the MCP descriptor.

[githits 0.12.0] - 2026-09-03

Minor release: adds opt-in Agentic Ask and improves repository grep, upgrade-review validation and release context, and Windows token-refresh handoff.

Added

• Experimental Agentic Ask - Add opt-in githits ask CLI and local MCP surfaces with source-cited answers, follow-up threads, directly executable source calls, and original upstream URL sources.

Changed

• Align upgrade-review batch validation - CLI and MCP now advertise and enforce the deployed limit of 30 nonblank package upgrades before sending a request.

Fixed

• Align grep symbol fields - CLI and MCP validation now expose only symbol metadata that repository grep can hydrate.
• Improve upgrade-review release context - Compact output keeps identity-only sampled releases visible and avoids repeating releases across heuristic, sampled, and verbose entries.
• Serialize Windows token refresh handoff - Release file-backed auth locks without racing successor agents against removal of the shared lock path.

[@githits/mcp 0.12.0] - 2026-09-03

Coordinated minor release: aligns @githits/mcp with the CLI 0.12 line and improves repository grep and upgrade-review validation and release context.

Changed

• Align upgrade-review batch validation - CLI and MCP now advertise and enforce the deployed limit of 30 nonblank package upgrades before sending a request.

Fixed

• Align grep symbol fields - CLI and MCP validation now expose only symbol metadata that repository grep can hydrate.
• Improve upgrade-review release context - Compact output keeps identity-only sampled releases visible and avoids repeating releases across heuristic, sampled, and verbose entries.

[githits 0.11.5] - 2026-09-02

Coordinated patch release: improves quick-start discovery and public OSS content safety, fixes Agent Skill discovery and packaging, and expands maintainer eval coverage.

Changed

• Temporarily evaluate every main update - Run the advisory Luna agent-eval workflow on every push to main while maintainers collect Braintrust variance and workload-optimization evidence; daily, manual, and explicitly labeled pull-request runs remain available.

Fixed

• Hide the Braintrust eval skill from public installers - Mark the repository-only operations skill as internal so skill registries do not offer it to end users.
• Improve quick-start discovery - The quick_start catalog sentence now identifies the required first call and the untrusted-content safety rules it loads before plain MCP sessions use evidence tools.
• Keep the MCP skill installable - Quote its YAML frontmatter description so standards-compliant Agent Skill installers parse it successfully.

Security

• Clarify remote OSS content boundaries - Frame retrieved public OSS content as untrusted evidence that cannot override user authorization or host safeguards while preserving prompt-injection protections.

[@githits/mcp 0.11.5] - 2026-09-02

Coordinated patch release: improves quick-start discovery and clarifies the security boundaries for retrieved public OSS content.

Fixed

• Improve quick-start discovery - The quick_start catalog sentence now identifies the required first call and the untrusted-content safety rules it loads before plain MCP sessions use evidence tools.

Security

• Clarify remote OSS content boundaries - Frame retrieved public OSS content as untrusted evidence that cannot override user authorization or host safeguards while preserving prompt-injection protections.

[githits 0.11.4] - 2026-09-01

Patch release: adds definition-aware search evidence, improves MCP session guidance and wrapped source readability, and expands maintainer-facing Braintrust eval persistence.

Added

• Definition-aware search evidence - CLI and MCP search results now preserve focused, indexed, and symbol-definition ranges, lead with focused evidence while annotating qualified enclosing symbols, and generate exact served-revision repository follow-ups. The deployed Phase 1A GraphQL schema is required.

Changed

• Braintrust agent-eval persistence - Add maintainer-facing normalized eval export with stable channel-aware experiment names, explicit latest-main baseline linkage, harness-observed tool lifecycle timing, and native structural Braintrust tool spans. The exporter records source, channel, branch, pull request, and commit identity and reports the actual linked base experiment; the first main run remains a one-time bootstrap, and pull-request or default local exports fail before that baseline exists. This does not change public package behavior.

Fixed

• Make MCP session guidance reliable - MCP servers built from githits or @githits/mcp now require one quick_start call per plain session while agents with the loaded githits-mcp skill skip it for every tool. GitHits MCP and CLI skills now use transport-specific triggers so agents load only the matching workflow.
• Readable wrapped source comments - Compact search output now repeats source comment markers on wrapped continuation lines instead of making comment text look like executable code.

[@githits/mcp 0.11.4] - 2026-09-01

Coordinated patch release: adds definition-aware search evidence and improves MCP session guidance and wrapped source readability.

Added

• Definition-aware search evidence - CLI and MCP search results now preserve focused, indexed, and symbol-definition ranges, lead with focused evidence while annotating qualified enclosing symbols, and generate exact served-revision repository follow-ups. The deployed Phase 1A GraphQL schema is required.

Fixed

• Make MCP session guidance reliable - MCP servers built from githits or @githits/mcp now require one quick_start call per plain session while agents with the loaded githits-mcp skill skip it for every tool. GitHits MCP and CLI skills now use transport-specific triggers so agents load only the matching workflow.
• Readable wrapped source comments - Compact search output now repeats source comment markers on wrapped continuation lines instead of making comment text look like executable code.

[githits 0.11.3] - 2026-08-31

Patch release: improves search, target-resolution, and upgrade-review output; preserves actionable authentication, version, provenance, and keychain errors; and expands local agent-evaluation tooling.

Added

• Local Luna eval suites - Provide repository-local Luna named-suite, paired, and offline comparison tooling with explicit discovery/intent/full scenario cells, schema-v2 suite/comparison artifacts, scenario-aware cohorts, and deterministic schema-v1 compatibility. Defaults keep canary discovery+intent and other named suites intent-only; full is local/manual opt-in. Service export remains unimplemented, and artifacts distinguish tool execution from answer-quality evidence.

Changed

• Group resolved project identities - CLI and local MCP resolution now keep related package, repository, and documentation targets together with compact per-target metric lanes, licenses, security warnings, and relation truncation visible.
• Grouped upgrade review output - CLI and MCP now share compact, outcome-first upgrade evidence text with restrained semantic terminal color while preserving follow-up locators and structured JSON.
• Route broad vulnerability questions to current evidence - pkg_vulns now explicitly covers qualitative package security questions and directs agents away from potentially outdated training data.
• Explain target-resolution evidence - githits resolve and its local experimental MCP counterpart expose backend name similarity in JSON and opt-in verbose text, qualify it as coarse lexical support without reranking, and label positive code evidence as an indexed package or repository snapshot. Default text remains compact, uses a neutral target heading, omits negative availability claims, and does not fetch lexical evidence. Experimental JSON candidates no longer project backend ranking reason text.
• Agent eval isolation - Codex evals and interactive sessions now use disposable acting-agent home/config/temp roots, validate an absolute dedicated CODEX_HOME before use or launch, reject direct home skills other than .system, preserve trusted host auth roots only for the local GitHits MCP child, and persist safe relative isolation metadata. Interactive sessions omit exec-only flags and enforce the dedicated-home skills/config contract.
• Agent eval scenario metrics - Maintainer-facing local eval runs now emit schema-v2 normalized usage, cost, tool-surface, scenario, intent, and agent version metrics. Exact intent fragments are SHA-256 identified, neutral intent records null, valid schema-v1 metrics normalize deterministically, and same-agent comparisons warn on version drift.
• Daily Luna agent eval workflow - Add maintainer-authorized daily, manual, and same-repository labeled-pull-request execution for the Luna discovery and intent suites, bounded concurrency, 14-day raw artifact retention, and concise absolute summaries. Public package behavior is unchanged.

Fixed

• Search recovery and target guidance - Correct terminal target recovery and canonical package addressing, and unify CLI/MCP text around compact target-state output with inline recovery and concrete documentation provenance.
• Recognize backend authentication-required errors - Package/source tools now refresh or return the standard authentication guidance when GraphQL uses its documented AUTHENTICATION_REQUIRED code.
• Preserve CodeDiff version alternatives - Keep backend-ranked package versions and their proven source refs in CLI/MCP error details, and show actionable alternatives in CLI text.
• Surface keychain access failures - Update @napi-rs/keyring so unavailable or inaccessible credential stores report an error instead of appearing to contain no credentials.

[@githits/mcp 0.11.3] - 2026-08-31

Coordinated patch release: improves shared search and upgrade-review output, tool routing, authentication guidance, and CodeDiff recovery evidence.

Changed

• Grouped upgrade review output - CLI and MCP now share compact, outcome-first upgrade evidence text while preserving follow-up locators and structured JSON.
• Route broad vulnerability questions to current evidence - pkg_vulns now explicitly covers qualitative package security questions and directs agents away from potentially outdated training data.

Fixed

• Search recovery and target guidance - Correct terminal target recovery and canonical package addressing, and unify CLI/MCP text around compact target-state output with inline recovery and concrete documentation provenance.
• Recognize backend authentication-required errors - Package/source tools now refresh or return the standard authentication guidance when GraphQL uses its documented AUTHENTICATION_REQUIRED code.
• Preserve CodeDiff version alternatives - Keep backend-ranked package versions and their proven source refs in CLI/MCP error details so callers can offer actionable alternatives.

[githits 0.11.2] - 2026-08-28

Patch release: unifies search output across CLI and MCP, recognizes standalone documentation sites during target resolution, recovers init sign-in after stale refresh failures, and makes the packaged MCP skill self-contained.

Changed

• Agent eval metrics - Maintainer-facing local eval runs now persist normalized usage, cost, tool-surface, and report metrics; public package artifacts are unchanged.
• Keep MCP release lockfiles aligned - Coordinated release preparation now updates the @githits/mcp workspace version in bun.lock alongside the package manifest so later dependency changes do not inherit release-only lockfile churn.
• Clarify unified search output - Add exact partial-result truth to JSON and route githits and @githits/mcp search/search-status through one outcome-first formatter with compact completed-result headlines, numbered locator-first human hits that retain docs page IDs for docs_read, ASCII formatter-authored punctuation, source provenance, target-grouped readiness when trust facts require it, terminal-aware CLI wrapping, concise session/action rows, bounded provenance, ANSI hierarchy, and surface-native continuation guidance while preserving Unicode backend payload text.
• Recognize standalone-site resolve candidates - resolve labels backend site candidates as site instead of the unknown-kind target fallback, and a site preferred kind is accepted by both the CLI --prefer-kind option and the experimental resolve_target tool. Experimental CLI/MCP guidance advertises site resolution and routes selected site targets into docs search. Stable MCP guidance now distinguishes package-only docs_list from the standalone-site search and docs_read flow.

Fixed

• Recover init sign-in after stale refresh failures - Interactive init now proceeds to browser OAuth when retained expired credentials cannot refresh, and its runnable authentication guidance consistently uses npx githits@latest.
• Self-contained MCP skill - The loaded githits-mcp skill now includes the stable quick-start guidance without a redundant bootstrap call, while plain MCP clients retain the quick_start fallback.

[@githits/mcp 0.11.2] - 2026-08-28

Coordinated patch release: unifies search output and recognizes standalone documentation sites during target resolution.

Changed

• Clarify unified search output - Add exact partial-result truth to JSON and route githits and @githits/mcp search/search-status through one outcome-first formatter with compact completed-result headlines, numbered locator-first human hits that retain docs page IDs for docs_read, ASCII formatter-authored punctuation, source provenance, target-grouped readiness when trust facts require it, terminal-aware CLI wrapping, concise session/action rows, bounded provenance, ANSI hierarchy, and surface-native continuation guidance while preserving Unicode backend payload text.
• Recognize standalone-site resolve candidates - resolve labels backend site candidates as site instead of the unknown-kind target fallback, and a site preferred kind is accepted by both the CLI --prefer-kind option and the experimental resolve_target tool. Experimental CLI/MCP guidance advertises site resolution and routes selected site targets into docs search. Stable MCP guidance now distinguishes package-only docs_list from the standalone-site search and docs_read flow.

[githits 0.11.1] - 2026-08-27

Patch release: reduces agent context round trips, improves package-tool selection, and makes selected uninstall cleanup and diagnostics ownership more predictable.

Changed

• Reduce agent context round trips - Allow deliberate 300-line source and documentation reads while keeping 150-line defaults, align grep per-file limits with requested totals, clarify served indexing snapshots, and improve public-repository discovery and source safety guidance.
• Clarify packaged ownership guidance - Agent guidance now assigns diagnostics lifecycle and output destinations to the CLI host while core and MCP remain host-neutral; MCP error classifiers no longer emit CLI debug lines, while core service diagnostics can still emit when the CLI container injects them.
• Improve package-tool selection - Package MCP descriptions now lead with compact user-intent phrases so truncated tool catalogs distinguish health, vulnerability, dependency, changelog, and upgrade questions.

Fixed

• Respect uninstall selection for guidance - Interactive user uninstall now removes guidance only for selected tools whose MCP is absent after cleanup and preserves shared guidance usable by any detected tool that was kept.

[@githits/mcp 0.11.1] - 2026-08-27

Coordinated patch release: adds the browser-callable tool entry, propagates host execution context, reduces agent context round trips, and tightens the public client boundary.

Added

• Add browser-callable tools entry - @githits/mcp/tools exposes the validated get_example callable surface for frontend WebMCP integration; only this selected runtime graph is browser-safe, while the installed package and other entries remain Node-oriented.

Changed

• Reduce agent context round trips - Allow deliberate 300-line source and documentation reads while keeping 150-line defaults, align grep per-file limits with requested totals, clarify served indexing snapshots, and improve public-repository discovery and source safety guidance.
• Add host-aware terms remediation and cancellation - Hosted and browser-callable defaults now use canonical acceptance-URL guidance, while local CLI and stdio hosts preserve the CLI command override; explicit caller cancellation propagates through execution context so trace hooks observe rejection and cancelled work cannot refresh or retry.
• Improve package-tool selection - Package MCP descriptions now lead with compact user-intent phrases so truncated tool catalogs distinguish health, vulnerability, dependency, changelog, and upgrade questions.

Removed

• Remove client telemetry lifecycle globals - The pre-1.0 @githits/mcp/client telemetry lifecycle exports are removed; remote hosts inject ServiceDiagnostics when they need operation or debug diagnostics.

[githits 0.11.0] - 2026-08-26

Minor release: adds portable MCP quick-start guidance, makes onboarding setup and removal predictable, and tightens local request validation and changelog range semantics.

Changed

• Improve remote MCP tool routing - Make tool catalogs benefit-first with explicit workflow handoffs, replace inconsistently surfaced server instructions with a one-call quick_start guide, and compact the packaged Agent Skill to point at that guide. Deploy the hosted endpoint with @githits/mcp 0.11.0 before relying on quick_start from remote plugins and extensions.

Fixed

• Make onboarding setup and removal predictable - init now targets selected agents and repairs all packaged guidance with transport-aware readiness output; the canonical githits uninstall command removes GitHits setup while retaining the nested compatibility alias.
• Correct changelog range semantics - Document and expose from as an exclusive lower bound, so exact-release and range requests use the backend contract consistently. Returned entries preserve backend/source order; consumers must not assume newest-first ordering.
• Reject canonical resolve inputs locally - The opt-in experimental githits resolve command and local resolve_target tool now direct already-canonical package and GitHub repository targets to the next GitHits tool without calling the resolver backend.

[@githits/mcp 0.11.0] - 2026-08-26

Coordinated minor release: adds portable one-call MCP guidance, improves tool routing, and aligns changelog range semantics with the backend contract.

Changed

• Improve remote MCP tool routing - Make tool catalogs benefit-first with explicit workflow handoffs and replace inconsistently surfaced default server instructions with a one-call quick_start guide. createMcpServer() now leaves initialize instructions caller-owned; use quickStartOptions instead of the deprecated instructionOptions to configure the guide. buildMcpInstructions() remains a deprecated alias for buildMcpQuickStart(), and the public smoke helper now requires and checks quick_start in the stable tool inventory.

Fixed

• Correct changelog range semantics - Document and expose from as an exclusive lower bound, so exact-release and range requests use the backend contract consistently. Returned entries preserve backend/source order; consumers must not assume newest-first ordering.

[githits 0.10.2] - 2026-08-25

Patch release: fine-tunes opt-in experimental target resolution for safer partial-readiness handling and makes targeted init reliability improvements.

Fixed

• Reliable init install and uninstall - Use structured Claude user MCP inspection and best-effort guidance cleanup so absent state is safe, failures remain visible, and guidance reporting stays separate from agent counts.

Security

• Fail closed on malicious package candidates - The opt-in experimental resolver now preserves latest-version malicious-content decisions and bounded OSV evidence, links affected or uncertain advisories in warnings, and withholds normal CLI/MCP continuation for affected, unknown, or unrecognized states.

[githits 0.10.1] - 2026-08-24

Patch release: hardens concurrent CLI authentication and preserves queryable search evidence while indexing and backend session statuses evolve.

Changed

• Expose provisional search evidence - Accept and render queryable PROVISIONAL repository and documentation freshness while preserving exact served identity, indexing guidance, hits, and searchRef continuation only for active sessions.

Fixed

• Reliable concurrent CLI authentication - Preserve live per-user auth locks when process or lock-owner metadata inspection is temporarily unavailable, and serialize stale-owner cleanup so parallel local CLI and MCP processes cannot reuse rotating refresh tokens. Restart long-running local MCP processes after upgrading so every process uses the hardened lock protocol.
• Evolving search-session statuses - CLI search accepts terminal DEFERRED and future status values without discarding available evidence. Only known active sessions and explicit completed-result follow-ups direct callers to search-status; stopped or unknown sessions preserve current evidence and provide a new-search action without further polling.

[@githits/mcp 0.10.1] - 2026-08-24

Patch release: preserves queryable search evidence while indexing and keeps follow-up guidance aligned as backend session statuses evolve.

Changed

• Expose provisional search evidence - Accept and render queryable PROVISIONAL repository and documentation freshness while preserving exact served identity, indexing guidance, hits, and searchRef continuation only for active sessions.

Fixed

• Evolving search-session statuses - MCP search accepts terminal DEFERRED and future status values without discarding available evidence. Only known active sessions and explicit completed-result follow-ups direct agents to search_status; stopped or unknown sessions preserve current evidence and provide a new-search action without further polling.

[githits 0.10.0] - 2026-08-19

Minor release: introduces opt-in local experimental tools for target resolution and exact source diffs while keeping the default CLI, hosted MCP, plugins, and extensions on the stable tool inventory.

Added

• Local experimental tools - adds config-gated resolve_target and code_diff to the local stdio MCP server alongside the matching githits resolve and githits code diff commands. Enable the hidden-by-default suite with [experimental] tools = true; hosted MCP, plugins, extensions, and the public MCP API remain unchanged.
• Documentation source evidence - search and search-status now identify the repository and published-site documentation behind results. Healthy sources render as compact references, while stale, incomplete, pending, or unavailable sources explain what was searched and what the published evidence covers.

Changed

• Experimental CLI defaults - resolve and code diff are hidden and disabled unless the experimental suite is enabled. Optional report_tool_issues = "experimental" or "all" adds redacted local agent feedback guidance without sending feedback automatically.
• Authoritative documentation site identities - discovery search and status now carry canonical docpack URLs and show their host and path even when no hits are returned.
• Human release merge gate - release preparation now stops at an open PR; merging requires separate explicit human approval after that PR exists.

Fixed

• Confident target resolution - Resolve guidance now emits direct canonical next actions only for non-ambiguous exact or high-confidence matches; weaker and empty results require explicit correction or selection.
• Repository-wide code diff guidance - CLI help, legacy-scope diagnostics, and public client documentation now explain that package targets resolve repository and commit identity while raw diffs remain repository-wide and bounded results may contain only sibling paths.
• Diff terminal output - CodeDiff now aligns wide Unicode paths by terminal cell width and colors patches, stat bars, summary markers, and change statuses when supported; verbose code-file rows use the same alignment.

[@githits/mcp 0.10.0] - 2026-08-19

Coordinated minor release: aligns the public MCP package with the CLI 0.10 line while improving stable documentation-source and code-diff evidence. The experimental resolve_target and code_diff tools remain local to githits and are not exported by the public MCP server API.

Added

• Documentation source evidence - search and search-status now identify the repository and published-site documentation behind results. Healthy sources render as compact references, while stale, incomplete, pending, or unavailable sources explain what was searched and what the published evidence covers.

Changed

• Authoritative documentation site identities - discovery search and status now carry canonical docpack URLs and show their host and path even when no hits are returned.

Fixed

• Repository-wide code diff guidance - public client documentation now explains that package targets resolve repository and commit identity while raw diffs remain repository-wide and bounded results may contain only sibling paths.

[githits 0.9.3] - 2026-08-18

Patch release: adds an unpromoted CodeDiff CLI dogfood surface and improves CLI recovery, validation guidance, and search diagnostics.

Added

• Silent CodeDiff CLI dogfooding - adds githits code diff with bounded Git-like views, repository-relative glob filtering, reversible path quoting, apply-safe patch handling, structured completeness diagnostics, and JSON output without exposing an MCP tool or agent guidance yet.

Changed

• Independent changelog fragments - notable changes now record release notes and per-artifact SemVer impact in independently owned files, avoiding conflicts in CHANGELOG.md during normal development.

Fixed

• Code validation guidance - client-side INVALID_ARGUMENT errors from shared code-read and grep request builders now name CLI commands, positionals, and options on the CLI while MCP keeps MCP-native tool and argument syntax.
• Remove obsolete ref suggestions - waited searches no longer recommend an older ref after reaching the requested commit.
• Explain unavailable exact paths - CLI and MCP now return FILE_PATH_EXCLUDED for excluded files and SOURCE_FILE_INVENTORY_UNKNOWN when the index cannot verify a path, with actionable path and resolution details.
• Standalone-site search recovery - CLI and MCP search now preserve ordered backend site suggestions, distinguish truncated candidate lists, and direct active crawls through search status without guessing or rewriting targets. Help text also distinguishes atomic interim evidence from opted-in partial target/source subsets.

[@githits/mcp 0.9.2] - 2026-08-18

Patch release: adds an opt-in CodeDiff client capability and improves search and exact-path recovery without exposing a new remote MCP tool.

Added

• CodeDiff client support - adds the transport-neutral package and repository diff adapter as an additive CodeDiffService capability without exposing a remote MCP tool.

Fixed

• Remove obsolete ref suggestions - waited searches no longer recommend an older ref after reaching the requested commit.
• Explain unavailable exact paths - MCP tools now return FILE_PATH_EXCLUDED for excluded files and SOURCE_FILE_INVENTORY_UNKNOWN when the index cannot verify a path, with actionable path and resolution details.
• Standalone-site search recovery - MCP search now preserves ordered backend site suggestions, distinguishes truncated candidate lists, and directs active crawls through search status without guessing or rewriting targets. Help text also distinguishes atomic interim evidence from opted-in partial target/source subsets.

[githits 0.9.2] - 2026-08-14

Patch release: improves CLI exact-path recovery and makes Claude Code and Codex CLI initialization checks more reliable.

Fixed

• Exact-path recovery - typed FILE_NOT_FOUND responses from CLI code read and grep commands now name githits code files, githits code grep, and githits code read in path-discovery guidance. Extensionless exact files use their containing directory, and generic NOT_FOUND errors do not receive file-path guidance.
• Claude Code and Codex CLI init setup - user-scoped MCP checks now run outside project configuration, use targeted server probes with host-specific timeouts, distinguish missing, non-canonical, disabled, and failed checks, preserve enabled customized Codex entries, and avoid reporting cleanup no-ops as successful setup when a later command fails.

[@githits/mcp 0.9.1] - 2026-08-14

Patch release: improves surface-native recovery from exact-path read and grep failures.

Fixed

• Exact-path recovery - typed FILE_NOT_FOUND responses from code_read and code_grep now name code_files, code_grep, and code_read in path-discovery guidance. Extensionless exact files use their containing directory, and generic NOT_FOUND errors do not receive file-path guidance.

[githits 0.9.1] - 2026-08-13

Patch release: silently launches a CLI-only target-resolution dogfood surface, corrects packaged Agent Skill syntax, and improves release visibility. @githits/mcp remains at 0.9.0 because this release adds no MCP tool or public MCP package surface.

Added

• Target resolution CLI dogfood surface - githits resolve ranks canonical package and GitHub repository targets with compact terminal and diagnostic JSON output, discoverable registry help, and terminal-safe text errors. This silent launch is CLI-only and is not promoted through Agent Skills or an MCP tool.

Changed

• Continuous release visibility (repository) - notable changes now update this unreleased section as they land, with explicit SemVer impact for every public artifact, immutable historical release sections, and version-boundary validation during release preparation.

Fixed

• Search-status skill syntax (githits) - agent guidance now presents --wait <seconds> as a placeholder with the valid 0-60 integer range instead of resembling a literal --wait 0-60 invocation.
• Cross-platform changelog validation (repository) - release-boundary tests accept both LF and CRLF Markdown while enforcing identical package-version content.

[githits 0.9.0] - 2026-08-11

Minor release: adds canonical account settings and Terms of Service commands, improves bounded search recovery, and fixes browser login completion in proxied or sandboxed environments. @githits/mcp is released alongside the CLI at 0.9.0 for the shared terms-remediation and search-recovery behavior.

Added

• Account settings commands - githits settings now supports showing, reading, updating, and clearing canonical account preferences with aligned terminal and JSON output.
• Terms acceptance flow - githits settings terms reports acceptance state, while githits settings terms accept performs explicit confirmation and refreshes OAuth credentials after acceptance.

Fixed

• Search and grep recovery - terminal search sessions use bounded status waits, deferred work provides an explicit continuation, and empty results no longer encourage identical retry loops across CLI text and JSON output.
• OAuth callback completion - browser login completes when a sandbox or proxy retains or closes the callback connection, without waiting for temporary listener teardown before token exchange and credential storage.
• Forward-compatible settings - newer account APIs can add fields without breaking older CLI settings parsing.

Security

• HTTP client advisories - updated the bundled HTTP client to a patched release while retaining the supported Node.js 20 runtime boundary.

[@githits/mcp 0.9.0] - 2026-08-11

Minor release: adds shared Terms of Service remediation and bounded, agent-oriented search recovery while preserving structured errors.

Added

• Terms remediation - shared REST and GraphQL failures preserve structured authentication errors and direct callers to the canonical terms-acceptance flow for both OAuth and static API-token authentication.
• Bounded search status waits - search status exposes backend progress waiting through the shared bounded default and reports explicit deferred continuations.

Fixed

• Agent retry guidance - search, search status, and grep responses stop suggesting futile identical retries, retain backend diagnostics, and provide accurate case-sensitive and truncation-aware pivots.
• Public declarations - error metadata constructors remain usable from the standalone published declarations without changing runtime behavior.

[githits 0.8.0] - 2026-08-07

Minor release: adds portable Agent Plugins support and improves local auth storage reliability. @githits/mcp remains at 0.6.4 because this release does not change its public package surface.

Added

• Portable Agent Plugins support - the repository root can be installed as an Agent Plugins 1.0.0 package while retaining native Claude, Codex, Cursor, Gemini, Antigravity, and VS Code/GitHub Copilot adapters.
• File-storage guidance - authentication documentation now explains system keychain prompts, the explicit file-storage alternative, and its plaintext credential trade-off.

Fixed

• Auth lock identity reuse - repeated credential operations in one process reuse the verified process identity instead of resolving it for every lock acquisition.

[githits 0.7.0] - 2026-08-05

Minor release: consolidates the cross-host plugin packages around one canonical skill and guidance surface. @githits/mcp remains at 0.6.4 because the reusable MCP package surface is unchanged.

Added

• Codex and Cursor plugin packages - generated host manifests add native package entry points for Codex and Cursor alongside the existing Claude, Gemini, and VS Code/GitHub Copilot surfaces.
• Antigravity package - the repository root includes the native plugin and remote MCP configuration required by Google Antigravity.

Changed

• Canonical plugin assets - root skills/ and AGENTS.md now drive every host package through deterministic generation, replacing duplicated Claude skills, commands, and payload metadata.
• Transport boundaries - plugin and extension installs use the hosted remote MCP. Direct githits init setup remains local stdio except for Cursor, which uses the hosted remote MCP.
• MCP directory discoverability - added repository ownership metadata and a README link for the Glama MCP server listing.

[@githits/mcp 0.6.4] - 2026-08-04

Patch release: improves site-targeted search and agent-facing recovery guidance.

Added

• Explicit site search targets - search requests can target supported documentation sites directly and render site results through the shared response surface.

Fixed

• Partial documentation coverage - documentation reads report incomplete coverage instead of presenting partial results as complete.
• Agent tool guidance - MCP instructions better direct agents between search, documentation, and source-navigation tools.