chore(release): cut 0.4.10

CHANGELOG.md

@@ -1,14 +1,15 @@
 # Changelog
 
-## Unreleased
+## 0.4.10 - 2026-09-13
+
+**Highlights:** Security: cross-origin API redirects are refused and API keys are redacted from errors; routing across the date line is fixed.
 
 - Security: reject cross-origin API redirects and redact API keys echoed in errors while preserving typed error causes.
-- CLI: sanitize parser diagnostics so invalid arguments cannot emit terminal control sequences.
 - Route: sample correctly across the international date line, keep antipodal distances finite, and reject malformed upstream polylines before searching.
 - Client: reject non-finite coordinates, radii, and ratings before API calls, with normal validation errors and CLI exit code 2.
+- CLI: sanitize parser diagnostics so invalid arguments cannot emit terminal control sequences.
 - Build: require Go 1.26.8 for upstream compiler and runtime fixes; update GoReleaser to 2.18.1, Node to 26.8.2, deadcode to 0.50.0, and govulncheck to 1.8.0 with matching release-verifier pins.
 - CI: pin Actions by commit, test Windows with Go 1.27.1 and macOS with the race detector, verify documentation metadata, reject formatting drift, and avoid duplicate branch-push audits.
-
 - CI: update the reviewed GitHub CLI pin to 2.100.0 so release contract tests accept the current Homebrew version installed by CI.
 - Build: update Kong to 1.16.1, golangci-lint to 2.13.2, deadcode to 0.49.0, gosec to 2.29.0, govulncheck to 1.7.0, and setup-go to v7.
 

docs/releasing.md

@@ -36,7 +36,7 @@ Run the full local proof set before requesting either serialized gate:
 - formatting and clean-diff checks;
 - autoreview to no accepted or actionable findings.
 
-Run `scripts/release-local --check` for the aggregated preflight. It must reject ambient Go build controls, the wrong native Go version, a dirty or stale checkout, a non-default branch, and any mismatch with current protected `main`. The check builds pinned govulncheck v1.8.0 with the pinned Go 1.26.8 producer into its private audit directory, verifies the reviewed module checksum, then disables Go module resolution while querying the exact official vulnerability database URL. It never trusts a user-level `go/bin` lookup.
+Run `scripts/release-local --check` for the aggregated preflight. The release process prefers Homebrew `go@1.26` when installed, so the pinned producer can coexist with a newer default Go installation; the canonical executable path and exact version remain mandatory. It must reject ambient Go build controls, the wrong native Go version, a dirty or stale checkout, a non-default branch, and any mismatch with current protected `main`. The check builds pinned govulncheck v1.8.0 with the pinned Go 1.26.8 producer into its private audit directory, verifies the reviewed module checksum, then disables Go module resolution while querying the exact official vulnerability database URL. It never trusts a user-level `go/bin` lookup.
 
 For a gated pilot or draft, copy `.mac-release.env.example` to the ignored `.mac-release.env`, keep mode `0400` or `0600`, and set the two direct runtime locators shown there: `MAC_RELEASE_CODESIGN_KEYCHAIN` and exported `NOTARYTOOL_KEYCHAIN_PROFILE`. The file is strictly parsed and frozen before `release-mac-app` reads it. Package-secret and 1Password lookup fields are rejected in this lane so the helper and producer can execute with pinned, system-only tool paths. `scripts/release-local` also pins the reviewed SHA-256 of both the external `mac-release` entrypoint and its library before either can enter the secret-bearing process; any helper update requires an explicit local review and pin update.
 

scripts/release-local

@@ -22,8 +22,8 @@ readonly HOMEBREW_REPOSITORY="Homebrew/brew"
 readonly EXPECTED_HOMEBREW_ORIGIN_HTTPS="https://github.com/${HOMEBREW_REPOSITORY}"
 readonly RELEASE_MAC_APP_DEFAULT="/Users/steipete/Projects/agent-scripts/skills/release-mac-app/scripts/mac-release"
 readonly RELEASE_MAC_APP_EXPECTED_SHA256="e65e06ef89ec90ebfc537d28748a3c4de8ce89bd09b51e4d67ba4bdd95427255"
-readonly RELEASE_MAC_APP_LIB_EXPECTED_SHA256="c29d3c46506c2d0bd2db7ab688bd3108d54e8824074a4fe800de6e3fe17284c9"
-readonly CLEAN_SYSTEM_PATH="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin"
+readonly RELEASE_MAC_APP_LIB_EXPECTED_SHA256="170b05a794e5ade32a603a01c7942f8170d44ccc13b678c5285076510a008baf"
+readonly CLEAN_SYSTEM_PATH="/opt/homebrew/opt/go@1.26/bin:/usr/local/opt/go@1.26/bin:/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin"
 readonly SECRET_SCOPE_SYSTEM_PATH="/usr/bin:/bin:/usr/sbin:/sbin"
 readonly SSH_KEYGEN_BIN="/usr/bin/ssh-keygen"
 readonly SYSTEM_GIT_BIN="/usr/bin/git"

scripts/test-release-local.sh

@@ -198,7 +198,7 @@ EOF
     die "exact tap predispatch recheck is not immediately before the workflow POST"
   grep -Fq 'readonly RELEASE_MAC_APP_DEFAULT="/Users/steipete/Projects/agent-scripts/skills/release-mac-app/scripts/mac-release"' "$release_script" || die "release-mac-app is not pinned independently of HOME"
   grep -Fq 'readonly RELEASE_MAC_APP_EXPECTED_SHA256="e65e06ef89ec90ebfc537d28748a3c4de8ce89bd09b51e4d67ba4bdd95427255"' "$release_script" || die "release-mac-app entrypoint digest is not pinned"
-  grep -Fq 'readonly RELEASE_MAC_APP_LIB_EXPECTED_SHA256="c29d3c46506c2d0bd2db7ab688bd3108d54e8824074a4fe800de6e3fe17284c9"' "$release_script" || die "release-mac-app library digest is not pinned"
+  grep -Fq 'readonly RELEASE_MAC_APP_LIB_EXPECTED_SHA256="170b05a794e5ade32a603a01c7942f8170d44ccc13b678c5285076510a008baf"' "$release_script" || die "release-mac-app library digest is not pinned"
   grep -Fq '[[ "$source_digest" == "$RELEASE_MAC_APP_EXPECTED_SHA256" ]]' "$release_script" || die "release-mac-app entrypoint is not checked against reviewed bytes"
   grep -Fq '[[ "$source_lib_digest" == "$RELEASE_MAC_APP_LIB_EXPECTED_SHA256" ]]' "$release_script" || die "release-mac-app library is not checked against reviewed bytes"
   ! grep -Fq 'RELEASE_MAC_APP_DEFAULT="${HOME}' "$release_script" || die "release-mac-app still trusts ambient HOME"