v2.0.1 — Security Hardening + npm as arch-agent

What's New

Package renamed to arch-agent

npm rejected "architor" (too similar to "archiver"). The package is now published as arch-agent:

npx arch-agent init --name "My Project"

Security Hardening (9 zero-impact fixes)

All fixes block adversarial/malformed input only. Normal workflow is 100% identical.

Critical

• Closed Write+Execute chain: scripts are now read-only

High

• Reopen limit bypass: reopens.max read from trusted on-disk state
• Unknown phase bypass: phase name allowlist blocks unrecognized phases
• Dynamic all_accepted: finalization gate computes from actual component statuses

Medium

• Schema type validation enforced
• Log sanitization for markdown-active characters

Low

• stdin limited to 1MB in validation hook
• Backup failures logged to stderr

Other

• Security Constraints section added to CLAUDE.md
• Symlink safety in CLI walkDir
• 10 new security tests (40 total)

Install

npx arch-agent init