feat(v1.1): Anthropic SSE streaming replay, zero-network guard, Go SDK, and TracePort v1.1 interop

.github/ISSUE_TEMPLATE/bug_report.md

@@ -20,5 +20,5 @@ A clear and concise description of what you expected to happen.
 
 **Environment:**
  - OS: [e.g. Ubuntu 24.04, Windows 11, macOS Sequoia]
- - Go Version: [e.g. 1.22.4]
- - AgentFixture Version: [e.g. 1.0.0]
+ - Go Version: [e.g. 1.23]
+ - AgentFixture Version: [e.g. 1.1.0]

.github/workflows/ci.yml

@@ -2,7 +2,7 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [main, 'feat/**']
   pull_request:
     branches: [main]
 
@@ -27,8 +27,11 @@ jobs:
       - name: Run Go Vet
         run: go vet ./...
 
-      - name: Run Tests
+      - name: Run Unit & Determinism Tests
         run: go test -v -count=1 ./...
 
+      - name: Run SSE & Matcher Benchmarks Smoke Check
+        run: go test -bench=Benchmark -benchmem -benchtime=100ms -run=NONE ./pkg/cassette ./pkg/matcher
+
       - name: Compile CLI Binary
-        run: go build -v ./cmd/agentfixture
+        run: go build -v -ldflags="-s -w -X main.Version=v1.1.0" ./cmd/agentfixture

.github/workflows/release.yml

@@ -23,14 +23,23 @@ jobs:
           go-version: '1.23'
           cache: true
 
+      - name: Run Verification Suite
+        run: |
+          go vet ./...
+          go test -count=1 ./...
+
       - name: Build Multi-Platform Binaries
         run: |
           mkdir -p dist
-          VERSION=${GITHUB_REF_NAME:-v1.0.0}
+          VERSION=${GITHUB_REF_NAME:-v1.1.0}
 
           # Windows amd64
-          CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build -ldflags="-s -w -X main.Version=${VERSION}" -o dist/agentfixture-windows-amd64.exe ./cmd/agentfixture
-          cd dist && zip agentfixture-windows-amd64.zip agentfixture-windows-amd64.exe && cd ..
+          CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build -ldflags="-s -w -X main.Version=${VERSION}" -o dist/agentfixture.exe ./cmd/agentfixture
+          cd dist && zip agentfixture-windows-amd64.zip agentfixture.exe && rm agentfixture.exe && cd ..
+
+          # Windows arm64
+          CGO_ENABLED=0 GOOS=windows GOARCH=arm64 go build -ldflags="-s -w -X main.Version=${VERSION}" -o dist/agentfixture.exe ./cmd/agentfixture
+          cd dist && zip agentfixture-windows-arm64.zip agentfixture.exe && rm agentfixture.exe && cd ..
 
           # Linux amd64
           CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X main.Version=${VERSION}" -o dist/agentfixture ./cmd/agentfixture
@@ -58,10 +67,12 @@ jobs:
           cd ..
 
       - name: Publish GitHub Release
+        if: startsWith(github.ref, 'refs/tags/v')
         uses: softprops/action-gh-release@v2
         with:
           files: |
             dist/agentfixture-windows-amd64.zip
+            dist/agentfixture-windows-arm64.zip
             dist/agentfixture-linux-amd64.tar.gz
             dist/agentfixture-linux-arm64.tar.gz
             dist/agentfixture-darwin-amd64.tar.gz

CHANGELOG.md

@@ -5,6 +5,36 @@ All notable changes to **AgentFixture** will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.1.0] - 2026-11-10
+
+### Added
+- **Anthropic Messages API & OpenAI SSE Streaming Engine (`pkg/cassette/sse.go`)**: Implemented RFC #1 with full recording, wire encoding/decoding (`bufio.Reader` with zero 64KB line limit), live proxy chunk flushing, configurable replay pacing (`instant`, `scaled`, `exact`), and `ReconstructStreamSummary` supporting `message_start`, `content_block_start`, `content_block_delta` (`text_delta`, `thinking_delta`, `signature_delta`, `input_json_delta`, `citations_delta`), `content_block_stop`, `message_delta`, `message_stop`, `ping`, `error`, and OpenAI `[DONE]` streams.
+- **Zero-Outbound-Network Replay Enforcement (`pkg/proxy/offline.go`)**: Added `proxy.NewOfflineHTTPClient(proxyURL)` blocking non-loopback TCP dials (`127.0.0.1`, `::1`, `localhost`), rejected `HTTP CONNECT` tunnels with `403 Forbidden`, and injected `NO_PROXY` plus fallback offline API keys in `runner.Run`.
+- **Go Testing SDK (`pkg/agenttest` & `pkg/proxy/testing.go`)**: Added `agenttest.NewTestServer(tb, cassettePath, opts...)` with `URL()`, zero-network `HTTPClient()`, `WithRecordMode`, `WithStrictExhaustive`, and automatic `tb.Cleanup` verification.
+- **MCP Stdio Upgrades & Recorder (`pkg/proxy/stdio_proxy.go`)**: Added 16MB frame support, dual NDJSON and `Content-Length` framing, JSON-RPC 2.0 notification handling, automatic `ping`/`initialize`/`tools/list` synthesis when unrecorded, and `StdioRecorder` (`agentfixture record -mcp`).
+- **CLI Subcommands & Flags (`cmd/agentfixture`)**: Added `agentfixture inspect [-json]`, `agentfixture redact [-out]`, `agentfixture diff -exit-code` with semantic SSE stream diffing, `-timing` / `-delay-scale` / `-max-delay` flags on `replay`, `-mcp` mode on `record`/`replay`, and `windows/arm64` release artifacts.
+
+### Fixed
+- Fixed `agentfixture record -- <cmd>` spawning an isolated replay proxy instead of routing subprocess calls through the active `ModeRecord` server.
+- Fixed upstream gzip response corruption by stripping `Accept-Encoding` and `Content-Length` on outbound proxy requests and stripping `Content-Encoding` / `Content-Length` from stored headers.
+- Replaced fixed 30s `http.Client.Timeout` on upstream recording requests with `Transport{ResponseHeaderTimeout: 30s}` so multi-minute LLM streams do not abort mid-response.
+- Fixed upstream URL base path joining so prefixes (e.g. `/api/v1`) are preserved rather than overwritten.
+- Released `Server` mutex before simulated latency sleeps, HTTP response writes, and SSE chunk streaming; cloned cassettes during `ToYAML`/`ToJSON` to prevent concurrent mutation races.
+- Fixed multi-turn stateful HTTP and MCP stdio replay to prefer unconsumed cassette interactions in sequence order before falling back to idempotent retries.
+- Fixed 64-bit integer precision truncation in `StrictMatcher` using `json.Decoder.UseNumber()`, canonicalized JSON `RawBody` payloads, and normalized full URLs vs relative paths with sorted query parameters.
+- Fixed `FuzzyMatcher` UTF-8 rune length calculation, recursive slice filtering in `filterDynamicKeys`, structured JSON HTTP matching, and preserved bare `"id"` arguments.
+- Fixed `ComputeMetrics()` to sum `InputTokens + OutputTokens` (+ prompt cache tokens) when `TotalTokens == 0` (Anthropic usage format) with accurate input/output pricing.
+- Preserved `EventError` frames in `ImportTracePortSession` instead of dropping them.
+- Fixed `runner.Run` timeout cancellation via `exec.CommandContext`, Windows case-insensitive environment variable deduplication, and populated `UnmatchedExpected` and `DriftDetails`.
+- Fixed `-ldflags` version injection (`var Version`) and stripped duplicate leading `v` prefixes.
+
+### Performance
+- Reduced 100KB prompt `FuzzyMatcher` latency from ~15s (`O(N*M)` rune Levenshtein) to `<1ms` via zero-copy prefix/suffix stripping, a 4,096-rune exact DP cap, and zero-allocation 4-gram Sørensen-Dice hashing.
+
+### Security
+- Expanded redaction and secret detection across Google (`AIza*`), GitHub (`ghp_*`, `gho_*`, `ghu_*`, `ghs_*`, `ghr_*`, `github_pat_*`), AWS (`AKIA*`, `ASIA*`), Slack (`xox*-*`), HuggingFace (`hf_*`), PEM private keys, URL `user:pass@` credentials, `Cookie`/`Set-Cookie`, `X-Api-Key`, `x-goog-api-key`, endpoints, tags, interaction metadata, and SSE event frames.
+- Redacted secrets prior to `StrictHash` computation to eliminate secret hash oracles, and masked matched credential previews in `CheckForUnredactedSecrets`.
+
 ## [1.0.0] - 2026-11-05
 
 ### Added

CONTRIBUTING.md

@@ -1,11 +1,11 @@
 # Contributing to AgentFixture
 
-Thank you for your interest in contributing to **AgentFixture**! We welcome bug reports, feature suggestions, and pull requests.
+Thank you for your interest in contributing to **AgentFixture**. Bug reports, RFC proposals, and pull requests are welcome.
 
 ## Development Workflow
 
 ### Prerequisites
-- **Go 1.22+**
+- **Go 1.23+**
 - Git
 
 ### Setup
@@ -20,14 +20,16 @@ Thank you for your interest in contributing to **AgentFixture**! We welcome bug
    git checkout -b feat/your-feature
    ```
 
-### Running Tests & Verification
+### Running Tests, Benchmarks & Verification
 ```bash
-go test -v ./...
 go vet ./...
+go test -v -count=1 ./...
+go test -bench=. -benchmem ./pkg/cassette ./pkg/matcher
 gofmt -s -w .
 ```
 
 ### Pull Requests
-- Keep PRs focused.
-- Ensure all CI tests pass.
+- Keep pull requests focused and atomic.
+- Maintain zero external runtime dependencies beyond `gopkg.in/yaml.v3`.
+- Ensure all CI checks pass across Linux, Windows, and macOS.
 - Fill out the PR template.