chore(release): 0.7.11

[krassx]

Release 0.7.11 — one release for the whole batch of source-map work (#45, #47, #49, #50) rather than four in a row.

Added

• sourcemaps inject refuses a build that pins its own script hashes (Subresource Integrity), exit 20, --allow-sri to override. Measured on a real webpack + webpack-subresource-integrity build in Chromium 151: after stamping, the entry script was blocked and the page executed nothing. The guard refuses only over files the run would actually rewrite, so re-running stays a no-op. [feat(sourcemaps): refuse to inject into an SRI build (re-targeted to main) #49]
• sourcemaps inject --exclude <glob> (repeatable) — leave part of a build output alone (vendored code inside a server bundle, a polyfill file). An unparseable or empty pattern is exit 20, never a silent "matches nothing". [feat(sourcemaps): inject --exclude (and why unmapped bundles stay stamped) #45]
• debug-files upload --strip-sources-content — upload maps without their embedded source, including the copies an indexed map keeps in sections[].map. The map on disk is never modified and the declared hash describes the stripped bytes. 253 → 181 bytes on a real esbuild bundle. [feat(debug-files): --strip-sources-content #48 → feat(debug-files): --strip-sources-content (re-targeted to main) #50]

Fixed

• --dry-run no longer fails on a map with no debug-id. A dry run sends nothing, so an un-keyed map cannot register an unfindable symbol — but it exited 11 on the first one, which made the documented safe diagnostic unusable on a freshly built directory. A real run still exits 11. [fix(debug-files): a dry run must not fail on a map with no debug-id #47]

Changed

• The test suite now runs on Windows — x64 and native ARM64, not just a release build. It had never executed there, and the first run found three real defects, all in the tests: cargo test did not compile at all; env_clear() strips SystemRoot, without which WinSock cannot initialise, so every request from a child process failed; and the updater's e2e harness only ever built the Unix release artifact. [feat(debug-files): --strip-sources-content (re-targeted to main) #50]

Version bumped in Cargo.toml + Cargo.lock, CHANGELOG section cut with PR links. --version verified as bugsee-cli 0.7.11 from the release build.

What this batch closed

Items §1, §2, §3, §4, §7 and §8's option from the CLI-in-JS-flows audit. What remains there needs a backend or product decision: §5 (the commit SHA has no field in the upload wire), §6 (whether a web build should register at all).

🤖 Generated with Claude Code

[claude]

Code review

Pure release-metadata PR: cuts the 0.7.11 CHANGELOG section with links back to #45/#47/#48/#49/#50, and bumps the version in Cargo.toml + Cargo.lock. No source files are touched.

Findings: None.

The version bump is consistent across Cargo.toml, Cargo.lock, and CHANGELOG.md, and nothing else in the repo hardcodes the version string. Since no code changed, none of the contract areas (help text, stdout purity, exit codes, wire shapes, Cargo.toml table ordering, MSRV, daemonizing, cross-platform, release.yml) are implicated. Safe to merge as is.