# Changelog — Quality Gate installer & hook

Versions here refer to the client you install (`install.sh`, `quality_gate_hook.py`,
`qg_render.py`). The review service itself is deployed continuously and is not versioned.

Verify what you downloaded against `/checksums.txt`, published from the same build.

## 1.1.0 — 2026-08-16

**Fixed — the advertised install command was broken.**
`curl … | bash` made the script its own stdin, so the credential prompts consumed the
script's remaining source instead of your typing. It captured a line of shell as the API
key, wrote it to `config.json`, printed "Installation complete!" and exited 0. The failure
was invisible: the hook fails open on a bad key, so you got no reviews and no error.
Prompts now read from `/dev/tty`; with no terminal the installer aborts and tells you how
to supply credentials via environment variables.

**Fixed — uninstall could delete your own hooks.**
`--uninstall` filtered at the settings *entry* level, so an entry containing our hook was
removed whole. Any hook of yours sharing that entry went with it, silently. It now strips
only our hook and leaves yours in place.

**Fixed — a piped install with no `QG_URL` crashed** with `BASH_SOURCE[0]: unbound variable`
instead of an actionable message.

**Fixed — the printed uninstall command didn't work.** It named a local `install.sh` that a
piped install never leaves behind. It now prints the piped form.

**Added — API keys are shape-checked before being written.** A value containing whitespace
is refused outright; anything that isn't 64 hex characters warns.

**Added — version stamping.** `QG_VERSION` in both shipped scripts, printed on install.

**Added — plain-language disclosure at install time** of what the hook reads and where that
text is sent, including which providers and that one is China-based.

**Added — published SHA-256 checksums** for every shipped file at `/checksums.txt`.

## 1.0.0

Initial public release: five-reviewer consensus panel, Stop-hook integration, credit packs.