v1.17.0

Added

• --ignore-unknown-config — a global flag that downgrades an unknown configuration key from a hard failure to a warning for one run. Every ignored key is still named on stderr, and it still has no effect — this is a stopgap for “my config broke on upgrade and I need to run something now”, not a permanent silencer. See “Config strictness” in the README.
• README’s provider and MCP tool-argument tables are now generated from the running code (internal/meta) instead of hand-maintained — the MCP table in particular grew from 8 listed arguments to the real 19 as a direct result.

Changed

• Unknown configuration keys are now a hard error instead of a silent no-op. A typo like regexp: for regex: in config.yml used to parse successfully and simply do nothing — the credential pattern it was meant to add never ran, with no warning. It now fails loudly, naming the file, the exact key, the allowed keys at that level, and a “did you mean” suggestion when one is close. A top-level key that exists only to hold a YAML anchor (for <<: merging) is exempt under an x- prefix. See --ignore-unknown-config above for the escape hatch.

Fixed

• config set / providers use no longer silently disable the secret scanner — or anything else your config file doesn’t explicitly mention. In every previously shipped version, writing to a config file that was missing some fields — a very common shape, since setup only seeds the fields it touches — decoded that file into a full config struct and re-marshalled the whole thing. Every field the file didn’t mention round-tripped through its zero value instead of its documented default, not only the ones checked here: booleans to false, numbers to 0, strings to "". A single commitbrief config set provider openai run against a minimal config could silently turn off the secret scanner, the signal-control baseline, and architecture-aware review all at once, with no indication anything had changed.

  This is not a guaranteed complete inventory for every config shape — if you’ve run config set or providers use against a hand-trimmed or partial config file on an older version, don’t just check the fields mentioned in the full CHANGELOG entry: run commitbrief config show and review every value, or run commitbrief setup again to get a config that states every field explicitly. config set and providers use now patch the existing YAML document in place instead of decoding-and-re-marshalling it, so a write only ever touches the one key it was asked to change — comments, key order, YAML anchors/aliases, and any key the schema doesn’t know about all survive untouched.

• make check failed on a maintainer’s Mac before scanning a single file (macOS ships bash 3.2, and a supporting script used a bash-4-only builtin); CI runs on Ubuntu and never saw it. Developer tooling only — no user-facing behavior changed.

• CLI integration tests no longer leak a developer’s real API keys or local config into the test run, which previously made some tests pass in CI and fail (or silently misbehave) locally depending on the machine.