🎩 You're Invited:Meet the Socket team at Black Hat in Las Vegas, August 3-6.RSVP →
Sign In

gitpin

Package Overview
Dependencies
Maintainers
1
Versions
5
Alerts
File Explorer

Advanced tools

License
Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

gitpin - npm Package Compare versions

Comparing version
0.6.1
 to
0.6.2
+164
docs/release-v0.6.2-sdd-report.md
# GitPin v0.6.2 forward-patch SDD report
Date: 2026-08-01 (America/Chicago)
## Scope and outcome
This focused forward patch prepares GitPin 0.6.2 from exact base
`a9c6dc7ce3518cba7d10aea39e44f30e56072f25`. It changes only the website analytics privacy boundary, its
request-level tests, the version-coherence surfaces required for a release, and this evidence report.
The CLI, stdio MCP server, HTTP MCP server, package verifier, and container remain telemetry-free. No PostHog
project setting was changed, and this branch was not pushed, tagged, published, or deployed.
## Specification
The website must:
- expose a prominent native opt-out button on the homepage and privacy page;
- persist the opt-out when browser storage is available;
- avoid loading the PostHog SDK when an opt-out is already stored;
- stop subsequent capture immediately when opt-out is activated at runtime;
- fail closed without loading analytics when preference storage cannot be read, written, or cleaned up;
- inject the same configured PostHog project and API host into every analytics-enabled built page while leaving the
repository source telemetry-free;
- add `$geoip_disable: true` to every permitted outbound event;
- prevent feature-flag and remote-configuration requests outside the explicit event transport;
- preserve the strict event/property/transport allowlist, `traffic_class`, autoplay silence, and removal of
URL/referrer/browser/device and canary-shaped enrichment;
- distinguish the active browser controls from the still-unverified PostHog project-level raw-IP discard setting.
## TDD evidence
### Red
Command:
```powershell
pnpm exec playwright test tests/browser/analytics-privacy.spec.mjs --project=chromium --workers=1
```
Observed before implementation: 6 tests ran; 5 failed for the intended missing behaviors and the pre-existing hero
autoplay-silence behavior passed. The failures proved that the controls did not exist, a stored opt-out and unavailable
storage still loaded the SDK, runtime capture continued, and `$geoip_disable` was absent.
### Green
The same command passed 6/6 after the minimal implementation. The combined focused regression command then passed
11/11:
```powershell
pnpm exec playwright test tests/browser/site.spec.mjs tests/browser/analytics-privacy.spec.mjs --project=chromium --workers=1 --grep "analytics|autoplay|opt-out|storage|geo-IP|canary"
```
The request-level harness executes the real `site/analytics.js`, substitutes only the external PostHog SDK, and
inspects browser requests to the capture and feature-flag endpoints. It proves the SDK-load boundary, exact outbound
JSON, runtime stop, autoplay silence, canary absence, storage failure behavior, and absence of feature-flag requests.
Independent review then identified that PostHog could make an initialization-time `/flags` request outside
`before_send`. The strengthened request harness reproduced the issue: the focused geo-IP test failed with a canary in
that unexpected request. Adding `advanced_disable_flags: true` closed the bypass; the strengthened test and complete
suite were rerun before the remediation commit.
Hosted review initially raised six findings. The one-way opt-out control incorrectly exposed toggle-style
`aria-pressed` state even though activation leaves the one-way control disabled; the attribute was removed and the
keyboard, disabled-state, persistence, and status coverage now explicitly assert the resulting button semantics. The
three findings proposing replacement of `advanced_disable_flags` with `advanced_disable_decide` were rejected
against the current official PostHog type contract at commit
`57f371e540968afaa8a0fe9aec8a53ef1db6b654`: `advanced_disable_flags` is the current option, while
`advanced_disable_decide` is explicitly deprecated in favor of it. The production option, request harness, and earlier
report statement therefore remain unchanged.
The remaining two findings were valid. A browser could allow storage reads but reject writes, which allowed analytics
to initialize even though a runtime opt-out could not persist across navigation. A fixed, non-identifying storage
writability probe now verifies read, write, and removal before initialization without changing the existing opt-out
key; any failure disables analytics before SDK load. Red coverage observed three SDK loads across the original page,
reload, and navigation when `setItem` failed, plus one SDK load when probe cleanup failed. Both cases now produce zero
SDK or capture requests and preserve the pre-existing opt-out-key value.
The configured site build also injected the PostHog project only into `index.html`, leaving the analytics-enabled
privacy page unconfigured. The new build regression failed for both source/API-host emptiness and missing privacy-page
configuration. The builder now discovers every HTML page that loads `analytics.js`, requires empty configuration
placeholders, and injects the same project key and API host into each output page. Repository source and unconfigured
build output remain empty.
After both later remediations, the combined focused privacy/site command passed 13/13 and the configured-site build
regression passed 2/2.
A later independent review raised two more findings. The homepage's claim that analytics could be turned off
“permanently” overstated browser storage durability; a regression failed on that wording, and the homepage, privacy,
website, changelog, and launch surfaces now state that the browser-stored choice lasts until site data is cleared. The
second finding requested runtime-only storage-failure coverage. The new characterization test passed before any runtime
logic changed: after the SDK had loaded, a failed opt-out write stopped current-page capture immediately, reported that
persistence was unavailable, and caused both reload and navigation to fail closed without another SDK or capture
request while writes remained blocked. No product-code change was required for that already-correct behavior. The
complete Chromium privacy/site boundary passed 31/31 after the copy correction and added regression.
## Full validation evidence
- `pnpm validate` — passed after the remediations: 16 Vitest files, 90 tests, lint, format check, typecheck, client/CI/env/MCP/tag
verifiers, site build, and deterministic demo verification.
- `pnpm build` — passed.
- `pnpm verify:package` — passed for `gitpin-0.6.2.tgz`; clean install, initialization, doctor, context brief,
first answer, PR evidence gate, and public docs were verified.
- `pnpm site:test` — passed 124/124 across Chromium, Firefox, WebKit, and mobile Chromium.
- Focused release truth — 34/34 tests passed across `launch-readiness-task3`, `launch-readiness-truth`,
`gate-action`, and `onboarding`.
- `pnpm verify:release-tag` — matched `v0.6.2`, package `0.6.2`, MCP runtime `0.6.2`, release date `2026-08-01`.
- `pnpm verify:mcp-registry` — matched `io.github.shmindmaster/gitpin` package `gitpin` version `0.6.2`, stdio,
manual OIDC publication.
- `pnpm verify:artifact-gate-demo` — verified deterministic fail/pass fixture and artifact SHA-256
`c81709e1438a998473132ee212b09cb83812ffc7e6d5aa13f84fb5821dad8a69`.
The first `pnpm validate` attempt had one unrelated 5-second timeout in the onboarding test named “returns a cited first
result from any non-empty exposed document”; 87/88 tests passed. The exact timed-out test then passed alone in 2.18
seconds, and the complete `pnpm validate` rerun passed 88/88. No product change was made for that non-reproducing timing
failure.
Two later full-validation attempts after evidence-only edits encountered unrelated Windows fixture contention. The first
had three 5-second Git-heavy timeouts followed by five `EPERM` cleanup failures on one temporary wiki directory; the
second had two 5-second onboarding timeouts. The affected gate test passed alone in 2.74 seconds, and the two affected
onboarding tests passed together in 6.98 seconds. No product change was made for these non-reproducing timing failures;
the exact pull-request head still requires the remote CI gate.
## Version surface inventory
The current release version is 0.6.2 in:
- package and Action metadata: `package.json`, `action.yml`;
- MCP and runtime metadata: `server.json`, `src/server.ts`;
- onboarding/runtime guidance: `src/onboarding.ts`, `src/registry.ts`, `templates/client-rules.md`;
- matching source and browser regression tests;
- current repository truth: `AGENTS.md`, `README.md`, `ROADMAP.md`, and `CHANGELOG.md`;
- setup and operational documentation: `docs/ci.md`, `docs/clients.md`, `docs/migration-gitpin.md`,
`docs/pr-evidence-gate.md`, `docs/troubleshooting.md`, and `docs/website.md`;
- canonical launch copy: `docs/launch.md`;
- homepage Action snippet: `site/index.html`;
- deterministic demo generator and all three generated outputs: artifact JSON, Markdown, and SVG.
The dated 0.6.1 and 0.6.0 changelog history and links remain unchanged. `ROADMAP.md` retains its historical
“completed before the 0.6.1 candidate” heading.
## Release workflow expectations
The repository self-gate intentionally remains pinned to the already-published `shmindmaster/gitpin@v0.6.1` during
the 0.6.2 candidate PR. Its explicit bootstrap comment and regression test require a separate post-publication PR to
advance the self-gate to `v0.6.2`. Pointing the candidate PR at a not-yet-existent immutable Action tag would prevent
the required check from materializing.
When separately authorized, the release sequence is:
1. Push the focused candidate and open a PR; require exact-head `evidence` and all Validate jobs plus independent
review.
2. Merge only after those gates pass and the evidence manifest covers the complete final diff.
3. Create immutable tag `v0.6.2` on the merged main commit. The `Publish package` workflow validates, builds, verifies
the packed artifact, publishes or verifies the exact npm `gitHead`, and creates the GitHub Release.
4. Dispatch `Publish to MCP Registry` with `release_ref=v0.6.2` only after npm exposes the exact tag commit.
5. Dispatch `Deploy website`; independently verify the deployed SHA/content, opt-out behavior, capture payload, and
PostHog project destination.
6. Independently inspect the PostHog project-level raw-IP discard setting. Until that is verified, public copy must
not claim server-side raw-IP discard.
7. Open the post-publication self-gate PR advancing `.github/workflows/evidence-gate.yml` to
`shmindmaster/gitpin@v0.6.2`, then validate it against the released Action.
None of these external publication or configuration actions is performed by this patch.
+1
-1
action.yml

@@ -26,3 +26,3 @@ name: GitPin Evidence Gate

required: false
default: 0.6.1
default: 0.6.2

@@ -29,0 +29,0 @@ outputs:

+14
-1
CHANGELOG.md

@@ -7,2 +7,14 @@ # Changelog

## [0.6.2] - 2026-08-01
### Changed
- Align package, MCP, Action, documentation, website, and generated demo release surfaces on the 0.6.2 candidate.
- Send `$geoip_disable: true` on every permitted website analytics event, disable feature-flag and remote-configuration requests, and preserve the strict event and property allowlist.
### Fixed
- Add a keyboard-operable website analytics opt-out to the homepage and privacy page that persists until site data is cleared; a stored opt-out prevents SDK loading, runtime activation stops subsequent capture, and unavailable browser storage fails closed.
- Clarify that browser GeoIP suppression is active while independent verification of PostHog's project-level raw-IP discard setting remains pending.
## [0.6.1] - 2026-08-01

@@ -189,3 +201,4 @@

[Unreleased]: https://github.com/shmindmaster/gitpin/compare/v0.6.1...HEAD
[Unreleased]: https://github.com/shmindmaster/gitpin/compare/v0.6.2...HEAD
[0.6.2]: https://github.com/shmindmaster/gitpin/releases/tag/v0.6.2
[0.6.1]: https://github.com/shmindmaster/gitpin/releases/tag/v0.6.1

@@ -192,0 +205,0 @@ [0.6.0]: https://github.com/shmindmaster/gitpin/releases/tag/v0.6.0

+2
-2
dist/onboarding.js

@@ -180,3 +180,3 @@ "use strict";

const command = process.platform === 'win32' ? 'npx.cmd' : 'npx';
const packageSpec = 'gitpin@0.6.1';
const packageSpec = 'gitpin@0.6.2';
const server = {

@@ -198,3 +198,3 @@ command,

name: 'GitPin',
version: '0.6.1',
version: '0.6.2',
schema: 'v1',

@@ -201,0 +201,0 @@ mcpServers: [{ name: 'GitPin', type: 'stdio', ...server }],

+1
-1
dist/registry.js

@@ -41,3 +41,3 @@ "use strict";

return c;
throw new Error('No GitPin registry found. Set GITPIN_REGISTRY or run: npx -y gitpin@0.6.1 init --client codex');
throw new Error('No GitPin registry found. Set GITPIN_REGISTRY or run: npx -y gitpin@0.6.2 init --client codex');
}

@@ -44,0 +44,0 @@ function loadRegistry() {

+1
-1
dist/server.js

@@ -13,3 +13,3 @@ #!/usr/bin/env node

function createServer() {
const server = new mcp_js_1.McpServer({ name: 'gitpin', version: '0.6.1' });
const server = new mcp_js_1.McpServer({ name: 'gitpin', version: '0.6.2' });
(0, pin_tools_1.registerPinTools)(server);

@@ -16,0 +16,0 @@ (0, pin_prompt_1.registerProvePrompt)(server);

+1
-1
docs/ci.md

@@ -26,3 +26,3 @@ # CI EvidenceBrief

node-version: 22
- run: npm install --global gitpin@0.6.1
- run: npm install --global gitpin@0.6.2
- name: Build registry

@@ -29,0 +29,0 @@ shell: bash

+2
-2
docs/clients.md

@@ -6,3 +6,3 @@ # MCP client setup (GitPin)

```bash
npx -y gitpin@0.6.1 init --client codex
npx -y gitpin@0.6.2 init --client codex
```

@@ -89,3 +89,3 @@

name: GitPin
version: 0.6.1
version: 0.6.2
schema: v1

@@ -92,0 +92,0 @@ mcpServers:

+4
-4
docs/demos/pr-gate-fail-to-pass.artifact.json
{
"artifactId": "pr-gate-fail-to-pass",
"name": "GitPin PR evidence gate fail-to-pass sample",
"version": "0.6.1",
"version": "0.6.2",
"scenario": "Deterministic synthetic PR gate fail-to-pass validation.",

@@ -14,5 +14,5 @@ "reducedMotionSafe": true,

"npm": "https://www.npmjs.com/package/gitpin",
"github_release": "https://github.com/shmindmaster/gitpin/releases/tag/v0.6.1",
"github_release": "https://github.com/shmindmaster/gitpin/releases/tag/v0.6.2",
"github_action": "https://github.com/shmindmaster/gitpin/actions/workflows/evidence-gate.yml",
"github_action_snippet": "uses: shmindmaster/gitpin@v0.6.1",
"github_action_snippet": "uses: shmindmaster/gitpin@v0.6.2",
"mcp_registry": "https://registry.modelcontextprotocol.io/v0.1/servers?search=io.github.shmindmaster/gitpin&limit=20",

@@ -81,4 +81,4 @@ "pages": "https://shmindmaster.github.io/gitpin/"

},
"artifactSha256": "d18bcaa7dd3f0e5a9de6d499565e664232069a4a3f6c766d3476249675b88ae9"
"artifactSha256": "c81709e1438a998473132ee212b09cb83812ffc7e6d5aa13f84fb5821dad8a69"
}
}
+1
-1
docs/demos/pr-gate-fail-to-pass.md

@@ -5,3 +5,3 @@ # Synthetic PR evidence gate demo artifact

Deterministic, synthetic, fail-to-pass artifact for the GitPin v0.6.1 PR evidence gate.
Deterministic, synthetic, fail-to-pass artifact for the GitPin v0.6.2 PR evidence gate.

@@ -8,0 +8,0 @@ ## Accessibility

+1
-1
docs/demos/pr-gate-fail-to-pass.svg

@@ -23,3 +23,3 @@ <?xml version="1.0" encoding="UTF-8"?>

<rect width="1120" height="732" class="bg"/>
<text x="36" y="48" class="title">GitPin 0.6.1: synthetic fail-to-pass</text>
<text x="36" y="48" class="title">GitPin 0.6.2: synthetic fail-to-pass</text>
<text x="36" y="72" class="title">PR evidence gate artifact</text>

@@ -26,0 +26,0 @@ 

+14
-14
docs/launch.md

@@ -34,3 +34,3 @@ # GitPin Tuesday announcement package

After publication, use `npx -y gitpin@0.6.1 init --client codex` when an agent needs local, index-free evidence across repositories. Search results are candidates; `pin.prove` and `pin.verify` produce path, line, line hash, and full-SHA evidence for the PR manifest. This MCP workflow supports the gate but is not required to use it.
After publication, use `npx -y gitpin@0.6.2 init --client codex` when an agent needs local, index-free evidence across repositories. Search results are candidates; `pin.prove` and `pin.verify` produce path, line, line hash, and full-SHA evidence for the PR manifest. This MCP workflow supports the gate but is not required to use it.

@@ -61,3 +61,3 @@ ## Positioning

## Canonical announcement candidate (v0.6.1)
## Canonical announcement candidate (v0.6.2)

@@ -67,3 +67,3 @@ These are the canonical targets for the release package. Do not announce until the release gate above verifies every destination:

- npm: https://www.npmjs.com/package/gitpin
- GitHub release target: https://github.com/shmindmaster/gitpin/releases/tag/v0.6.1
- GitHub release target: https://github.com/shmindmaster/gitpin/releases/tag/v0.6.2
- GitHub Actions evidence gate workflow: https://github.com/shmindmaster/gitpin/actions/workflows/evidence-gate.yml

@@ -73,8 +73,8 @@ - MCP Registry entry search (live): https://registry.modelcontextprotocol.io/v0.1/servers?search=io.github.shmindmaster/gitpin&limit=20

- GitHub Action setup:
- `uses: shmindmaster/gitpin@v0.6.1` in workflow YAML
- CLI bootstrap after publication: `npx -y gitpin@0.6.1 init --client codex`
- `uses: shmindmaster/gitpin@v0.6.2` in workflow YAML
- CLI bootstrap after publication: `npx -y gitpin@0.6.2 init --client codex`
## Show HN draft
**GitPin 0.6.1: commit-level PR evidence for agent-authored changes**
**GitPin 0.6.2: commit-level PR evidence with a browser analytics opt-out**

@@ -88,5 +88,5 @@ GitPin is a base-trusted PR gate that compares the merge-base diff and validates evidence claims against exact file, line, and full-SHA locations. It is designed so reviewers can independently re-check every accepted locator with `git show`.

```bash
npx -y gitpin@0.6.1 init --client codex
npx -y gitpin@0.6.2 init --client codex
gitpin gate --base <full-base-sha> --head <full-head-sha>
uses: shmindmaster/gitpin@v0.6.1
uses: shmindmaster/gitpin@v0.6.2
```

@@ -102,3 +102,3 @@

After the release gate is complete, this draft may state: GitPin 0.6.1 is the shipped PR evidence gate for agent-authored changes. It enforces material-path coverage and validates locators at exact commit SHAs using canonical handle or cite formats from the mini-spec, for example:
After the release gate is complete, this draft may state: GitPin 0.6.2 is the shipped PR evidence gate for agent-authored changes with a browser-stored website analytics opt-out that lasts until site data is cleared. It enforces material-path coverage and validates locators at exact commit SHAs using canonical handle or cite formats from the mini-spec, for example:

@@ -115,6 +115,6 @@ - canonical cite: `task-2-synthetic-pr-fixture/docs/protocol.md:5 @ 57bce1a312f6153e171b515c41727ff81e77fb3c`

After the release gate is complete, this draft may state: GitPin 0.6.1 ships a required PR gate path-coverage loop for agent-authored changes. If a material file is changed without evidence, merge is blocked. If evidence is complete, the proof includes the canonical cite `task-2-synthetic-pr-fixture/docs/protocol.md:5 @ 57bce1a312f6153e171b515c41727ff81e77fb3c` and durable handle `gitpin:task-2-synthetic-pr-fixture@57bce1a312f6153e171b515c41727ff81e77fb3c:docs/protocol.md:5`; both can be re-checked via `git show`.
After the release gate is complete, this draft may state: GitPin 0.6.2 ships a required PR gate path-coverage loop for agent-authored changes and a browser-level website analytics opt-out. If a material file is changed without evidence, merge is blocked. If evidence is complete, the proof includes the canonical cite `task-2-synthetic-pr-fixture/docs/protocol.md:5 @ 57bce1a312f6153e171b515c41727ff81e77fb3c` and durable handle `gitpin:task-2-synthetic-pr-fixture@57bce1a312f6153e171b515c41727ff81e77fb3c:docs/protocol.md:5`; both can be re-checked via `git show`.
Signals to use this as infrastructure:
- `uses: shmindmaster/gitpin@v0.6.1`
- `uses: shmindmaster/gitpin@v0.6.2`
- https://registry.modelcontextprotocol.io/v0.1/servers?search=io.github.shmindmaster/gitpin&limit=20

@@ -125,9 +125,9 @@ - https://www.npmjs.com/package/gitpin

After the release gate is complete, this draft may state: GitPin 0.6.1 enforces commit-pinned PR evidence for material diff paths. The gate requires coverage for changed files and checks exact file-line evidence against full SHA sources at merge time. It is intended as a trust-boundary control for review, not as a rollout claim or replacement for human code review.
After the release gate is complete, this draft may state: GitPin 0.6.2 enforces commit-pinned PR evidence for material diff paths and adds a browser-stored website analytics opt-out that lasts until site data is cleared. The gate requires coverage for changed files and checks exact file-line evidence against full SHA sources at merge time. It is intended as a trust-boundary control for review, not as a rollout claim or replacement for human code review.
Quick rollout setup:
1) Install: `npx -y gitpin@0.6.1 init --client codex`
1) Install: `npx -y gitpin@0.6.2 init --client codex`
2) Configure `.gitpin/gate.yml` on the trusted base commit
3) Add `.gitpin/change-evidence.json` in PR heads
4) Enable `uses: shmindmaster/gitpin@v0.6.1` on PR checks
4) Enable `uses: shmindmaster/gitpin@v0.6.2` on PR checks
5) Verify in CI with deterministic pass/fail outputs before merge

@@ -134,0 +134,0 @@ 

+2
-2
docs/migration-gitpin.md

@@ -31,3 +31,3 @@ # Migration: RepoContext to GitPin (0.5.3)

```bash
npx -y gitpin@0.6.1 init --client codex
npx -y gitpin@0.6.2 init --client codex
```

@@ -42,3 +42,3 @@

"command": "npx",
"args": ["-y", "gitpin@0.6.1"],
"args": ["-y", "gitpin@0.6.2"],
"env": {

@@ -45,0 +45,0 @@ "GITPIN_REGISTRY": "/absolute/path/to/repositories.yaml"

+1
-1
docs/pr-evidence-gate.md

@@ -48,3 +48,3 @@ # PR evidence gate

ref: ${{ github.event.pull_request.head.sha }}
- uses: shmindmaster/gitpin@v0.6.1
- uses: shmindmaster/gitpin@v0.6.2
with:

@@ -51,0 +51,0 @@ base-sha: ${{ github.event.pull_request.base.sha }}

+2
-2
docs/troubleshooting.md

@@ -7,3 +7,3 @@ # Troubleshooting

| --- | --- | --- |
| `npx` fails on Node | Node older than 20 | Install Node 20+ and retry `npx -y gitpin@0.6.1 init --client codex` |
| `npx` fails on Node | Node older than 20 | Install Node 20+ and retry `npx -y gitpin@0.6.2 init --client codex` |
| Init says path is not a Git root | Directory has no `.git` | Run from a repository root or pass `--repository` to a real root |

@@ -45,4 +45,4 @@ | Init refuses to write the registry | Destination already has different content | Choose `--registry <other-path>` or remove the conflicting file deliberately |

1. Run `npx -y gitpin@0.6.1 doctor` with `GITPIN_REGISTRY` set.
1. Run `npx -y gitpin@0.6.2 doctor` with `GITPIN_REGISTRY` set.
2. Run `pnpm verify:package` from a source checkout to compare a clean packed install.
3. Open a [GitHub issue](https://github.com/shmindmaster/gitpin/issues) with the doctor JSON (redact private paths if needed) and client name.
+25
-3
docs/website.md

@@ -5,3 +5,3 @@ # Website and analytics

The source in this repository is the GitPin 0.6.1 website release candidate. A local build or browser pass does not establish that Pages has deployed this version; deployment and production verification remain release gates.
The source in this repository is the GitPin 0.6.2 website release candidate. The previous immutable release remains published until Pages deployment and production verification establish 0.6.2.

@@ -30,3 +30,5 @@ The deployable surface includes a privacy page, canonical and social metadata, `robots.txt`, and a sitemap for the GitHub Pages URL. These are static release artifacts; they do not change the MCP server's read-only boundary.

The build succeeds with analytics disabled when the variable is absent.
The build succeeds with analytics disabled when the variable is absent. Repository source and unconfigured build
output keep both analytics meta values empty. When the variable is present, the builder injects the same dedicated
project key and API host into every HTML page that loads the analytics script, including the homepage and privacy page.

@@ -49,3 +51,5 @@ ## Analytics boundary

Autocapture, pageview/pageleave capture, and session replay are disabled, person profiles are never created, and the site uses cookieless mode.
Autocapture, pageview/pageleave capture, feature flags and remote configuration, and session replay are disabled,
person profiles are never created, and the site uses cookieless mode. Disabling feature flags prevents the SDK from
making an initialization-time `/flags` request outside the explicit launch-funnel event transport.

@@ -59,2 +63,3 @@ Launch-funnel transport fields are explicit and constrained before `before_send` strips SDK enrichment:

- optional `$process_person_profile` (SDK-required process-person flag only),
- `$geoip_disable: true` to instruct PostHog not to enrich the event through GeoIP,
- optional `traffic_class`, constrained to `production` or `synthetic_qa`,

@@ -66,2 +71,19 @@ - event timestamp,

The browser-level `$geoip_disable: true` control is active in every permitted event. The separate PostHog
project-level setting that discards raw IP addresses is still pending independent verification, so GitPin does not
claim server-side raw-IP discard yet.
## Browser opt-out
The homepage and privacy page expose a native, keyboard-operable **Turn off website analytics** control. Its
preference is stored in the browser until site data is cleared. A stored opt-out prevents the PostHog SDK from loading
on later visits; activating the control also stops subsequent capture immediately in the current page. If browser
preference storage cannot be read, written, or cleaned up, the site fails closed and does not load analytics. The
startup check uses a fixed, non-identifying probe key and never changes the stored opt-out value. If storage later becomes
unavailable during the button action, capture still stops for the current page and the status reports that persistence
was unavailable.
This browser control does not alter the PostHog project configuration. Clearing site storage clears the browser
choice, so the control does not promise a permanent opt-out.
Test-traffic suppression is explicitly bounded to:

@@ -68,0 +90,0 @@ 

+1
-1
package.json
{
"name": "gitpin",
"version": "0.6.1",
"version": "0.6.2",
"mcpName": "io.github.shmindmaster/gitpin",

@@ -5,0 +5,0 @@ "type": "commonjs",

+3
-3
README.md

@@ -39,3 +39,3 @@ # GitPin

> **Release candidate:** GitPin 0.6.1 is prepared for npm, MCP Registry, GitHub Release, and Pages. Publication and production verification are still pending. After publication, install with `npx -y gitpin@0.6.1`. Node 20+.
> **Release candidate:** GitPin 0.6.2 is prepared for npm, MCP Registry, GitHub Release, and Pages. The previous immutable release remains published until 0.6.2 completes publication and production verification. After publication, install with `npx -y gitpin@0.6.2`. Node 20+.

@@ -48,3 +48,3 @@ GitPin is maintained by **Sarosh Hussain**, who leads the project's technical direction. **Pendoah** is his company and operating context; GitPin remains the product and repository.

# From a committed Git repository
npx -y gitpin@0.6.1 init --client codex
npx -y gitpin@0.6.2 init --client codex
```

@@ -56,3 +56,3 @@

# Independently verify any claim (same contract as pin.verify)
npx -y gitpin@0.6.1 verify \
npx -y gitpin@0.6.2 verify \
--repository my-service \

@@ -59,0 +59,0 @@ --path docs/architecture.md \

+1
-1
ROADMAP.md

@@ -11,3 +11,3 @@ # Roadmap

- Git `HEAD` pinning with path, line, content hash, and full commit provenance.
- 0.6.1 release candidate prepared across source, package metadata, MCP metadata, Action/install snippets, deterministic demos, and launch materials; publication and production verification remain pending.
- 0.6.2 release candidate prepared across source, package metadata, MCP metadata, Action/install snippets, deterministic demos, launch materials, and the website analytics privacy correction; the previous immutable release remains published until the release gates complete.
- Exposure policies that fail closed and sensitive-path blocking.

@@ -14,0 +14,0 @@ - Local stdio and bearer-authenticated, documentation-only HTTP transports.

+2
-2
server.json

@@ -10,3 +10,3 @@ {

},
"version": "0.6.1",
"version": "0.6.2",
"packages": [

@@ -16,3 +16,3 @@ {

"identifier": "gitpin",
"version": "0.6.1",
"version": "0.6.2",
"transport": {

@@ -19,0 +19,0 @@ "type": "stdio"

+1
-1
templates/client-rules.md

@@ -13,2 +13,2 @@ # GitPin client rules (paste into AGENTS.md / Cursor rules / Claude project)

Install: `npx -y gitpin@0.6.1` and set `GITPIN_REGISTRY`.
Install: `npx -y gitpin@0.6.2` and set `GITPIN_REGISTRY`.