- Add 'okf restore' command to reinstall vendor bundles from okf.lock
- Allow 'okf pull' without arguments to restore from okf.lock
- Skip already installed bundles during restore unless --force is specified
- Harden 'okf vendor remove' to require exact bundle ID match and index.md
- Prevent deletion of parent namespace directories on prefix remove
- Automatically clean up empty okf.lock when last vendor bundle is uninstalled
- Mitigate G110 (decompression bomb) and G304 (path traversal) in package unpacker
- Fix errcheck and staticcheck lint warnings across CLI and test suites
- Cap MCP tag length to 50 characters in tools.json schemas and handler
- Replace repeated fsPassed FlagSet visits with local passed map in cmdUpdate
- Add upfront non-empty type validation to cmdCreate
- Link requirements/mutation-metadata in root knowledge/index.md
- Document update flags and MCP tag length limit in docs/guides/CLI.md
- Credit Rogelio (@rogeliodh) for issue #38 report and analysis in CONTRIBUTORS.md
- Record knowledge updates in knowledge/log.md
- Extract command router registry and modular subcommand handlers into internal/cli
- Isolate CLI argument parsing and flags from public API surface
- Reduce cmd/okf/main.go to a lean entrypoint delegating to cli.Execute
- Remove monolithic subcommand files and obsolete tests from cmd/okf
