chore(master): release 3.4.0

[release-please]

🤖 I have created a release beep boop

3.4.0 (2026-06-08)

Features

• implement PKCE support in OAuth flows (#1142) (1a1665e)

Bug Fixes

• auth: remove hardcoded OAuth client secret from published npm package (CWE-798) (#1139) (a678e92)
• create-script: accept --type webapp and --type api as standalone aliases (#1155) (34a468e), closes #1154
• mcp: validate projectDir against permitted base paths (CWE-22 path traversal) (#1141) (1e8132c)
• prevent OAuth CSRF via missing state parameter in authorization flow (#1135) (8dac6c2)
• Print help instead of throwing error on unknown commands (#1157) (39a9c12)
• security: prevent path traversal via srcDir in .clasp.json (#1140) (408448e)
• security: validate sourceDir MCP parameter and use realpath in WriteFiles (#1144) (4eb9dca)

---

This PR was generated with Release Please. See documentation.