release: 0.10.4

[askalf]

What this changes

Bumps version to 0.10.4. When this merges, auto-release.yml tags v0.10.4, cuts the GitHub release from the new CHANGELOG section and dispatches publish.yml to npm.

• package.json / package-lock.json: 0.10.3 to 0.10.4
• CHANGELOG.md: [Unreleased] cut as [0.10.4] - 2026-09-25 (the Windows lock fix under Fixed, plus a Changed note for the README)
• Pinned version bumped in docs/claude-code.md (hook snippet), docs/commands.md (pinned install) and the bug / false-positive issue-template placeholders
• README watch figure refreshed to the 2026-09-25 run: 314 plugins · 2,442 skills · 0 under review · 475 advisories

docker/ stays on 0.10.3 on purpose. It installs from npm, so it can't move until 0.10.4 is published, and dependabot's /docker npm entry will bump it from there.

Why

npm is still on 0.10.3 (2026-08-05), 47 commits behind master:

• The Windows EPERM lock-guard fix (lock: a guard mid-release reads as EPERM on Windows — treat it as contention #197) is the only change to shipped code since then, and it only reaches users in a release.
• npm and Glama show the README from the published package, so the restructured README (docs(readme): lead with the proof, move reference to docs/ #198), the hero art (docs: hero art at the top of the README #205) and the current security trio (docs: fold in agent-security-stack and strongroom #199) haven't reached either one.

How it was verified

• npm test: 270 tests, 269 pass, 0 fail, 1 skipped
• The same regex auto-release.yml uses finds the [0.10.4] CHANGELOG section (1,262 chars)
• grep -rn 0.10.3 finds no leftover references outside CHANGELOG.md and docker/ (explained above)
• Detection change? N/A
• Acceptance change? N/A

Replaces #208 with the same change as one commit.

[sprayberry-secondread]

Automated review from the Sprayberry Labs fleet code reviewer.

Reviewed by the Claude second-opinion lane (independent second read; the gating review is posted separately).

Verdict: no blocking issues. The release bump is consistent, and the CHANGELOG section will be picked up by auto-release.yml.

What I checked (head 69e6e3f)

• Version is consistent. package.json:3 and both version fields in package-lock.json (root and packages[""]) go from 0.10.3 to 0.10.4. The redstamp dependency pin is unchanged.
• No stray 0.10.3 references. On a clone of the head, grep -rn 0.10.3 outside .git/ and CHANGELOG.md finds only docker/package.json:8 and docker/package-lock.json:12,35-36. The body says why those stay: the image installs @askalf/truecopy from npm, and .github/dependabot.yml:13-14 has an npm entry on directory: /docker that will pick up 0.10.4 once it's published.
• Release notes will extract. I ran the regex from auto-release.yml (the "Extract release notes from CHANGELOG" step) against the head CHANGELOG.md with VERSION=0.10.4. It matches the new ## [0.10.4] - 2026-09-25 section and returns about 1.26k chars. The lookahead stops at ## [0.10.3], so older entries don't leak in. ## [Unreleased] stays in place, empty, above the new section.
• "Only shipped-code change since 0.10.3" is accurate. Comparing v0.10.3...69e6e3f shows 48 commits ahead (47 plus this one). The only file changed under src/ (the package's files list is ["src"]) is src/lock.mjs, from #197. That matches the single Fixed entry, and that entry sits under the new heading as expected.
• The watch figure matches the source. WATCH.md on the watch branch reads "2026-09-25 — 314 plugins · 2442 skills scanned · 0 under review · 475 advisories". That matches the README.md:75 edit and the Changed bullet.
• Pinned install strings are updated. docs/claude-code.md:21 (github:askalf/truecopy#v0.10.4) and docs/commands.md:7 (@0.10.4) both point at the tag and version this merge will create. The two issue-template placeholders are updated too.
• CI: at this head, test on ubuntu/macos/windows × Node 20/22, verify pinned skills, analyze and triage are all green.

One heads-up (not a defect): until auto-release.yml pushes the v0.10.4 tag and publish.yml publishes to npm, the docs/claude-code.md hook snippet (#v0.10.4) and the docs/commands.md pin point at a tag and version that don't exist yet. That window runs from merge to the release job finishing, and it's normal for a release PR. If the release job fails, those two lines are the first place users will hit it.

What's good: one commit (replacing #208), a short diff, and the docker/ exception explained up front instead of left for a reviewer to find.

[sprayberry-redline]

Automated review from the Sprayberry Labs fleet code reviewer.

Reviewed by the GPT gating lane (gating review).

Approve: no blocking issues found at 69e6e3fb0badca08aed77b3c4e2165b5236515a9.

Reviewed all eight changed files, the PR description and the release commit. The package and lockfile versions agree on 0.10.4, the documented pins and issue-template placeholders match, and the new CHANGELOG section retains the existing Windows fix entry. The README snapshot figures match the published 2026-09-25 watch report. I also checked the existing auto-release workflow's version trigger and release-note section selection against this change.

Required CI is green, including CodeQL and Node 20/22 tests on Linux, macOS and Windows. No tests were run locally, and npm publication itself was not exercised.

The change is limited to release metadata and documentation; leaving the Docker npm pin for the post-publication update avoids referencing an unpublished package.