Destructive Command Guard

v0.4.4 — Dependency modernization + CI unbreak

Why this release

v0.4.1, v0.4.2, and v0.4.3 had dist.yml failing on cargo fmt --check due to nightly rustfmt drift, so no prebuilt binaries shipped for those versions. This release (a) unbreaks CI by bringing the tree into conformance with the current nightly toolchain, and (b) modernizes the dependency stack.

Because GitHub Actions was throttled (dist.yml queued 30+ minutes), this release was cut locally via dsr-assisted cross-compilation. The GH Actions CI run has been cancelled; the binaries below are built from tag v0.4.4 (commit 869c240) with the same Rust 2024 nightly toolchain used in CI.

Dependency bumps (see UPGRADE_LOG.md for full trace)

/dp-developed libraries:

• rich_rust 0.2.0 → 0.2.1
• toon-rust 0.1.3 → tru 0.2.2 (package renamed upstream; API migration)

Third-party majors (API migration required):

• sha2 0.10 → 0.11 (Array no longer implements LowerHex)
• hmac 0.12 → 0.13 (new_from_slice moved to KeyInit trait)
• ast-grep-core / ast-grep-language 0.40 → 0.42
• self_update 0.42 → 0.44 (rustls feature no longer transitively enables reqwest)
• rust-mcp-sdk 0.8.3 → 0.9.0 (ToolInputSchema.properties is now BTreeMap; new message_observer field)

Semver-compatible via cargo update (~60 crates), including tokio 1.49 → 1.52, clap 4.5 → 4.6, toml 1.0 → 1.1, rustls 0.23.36 → 0.23.38.

Other fixes

• cargo fmt drift across the repo reconciled (unblocks dist.yml).
• Clippy lints surfaced by newer nightly: collapsed two if let Some(end) blocks into ? operator in heredoc.rs; merged identical &&/|| branches in packs/mod.rs.
• Regenerated tests/pattern_audit.rs backtracking manifest to track the recent flag-walker bypass-closing pack tightenings.

Assets

All five dist.yml matrix targets shipped. Verified architectures in each archive. No sigstore bundles this release (local release; sigstore keyless signing requires the GH Actions ambient OIDC). sha256 checksums provided.

Full test matrix

cargo test --all-targets: 2210 lib + 39 integration binaries → all green.