v1.89.17

v1.89.17

Fixed

• Host/LLM 4xx client errors no longer ban innocent Genes (#571). When the host Agent's LLM provider rejects requests with a 4xx — malformed request (field MaxTokens invalid), auth (401), or a hard quota / rate-limit denial — the failure-loop detector now classifies it as a non-Gene-attributable host_llm_client_error and excludes it from the consecutive-failure streak and the ban_gene / failure_loop_detected / force_innovation_after_repair_loop path. A shared classifier keeps issue-filing suppression and ban/streak suppression in lockstep. (Follow-up to #534.)

Security / housekeeping

• gitleaks: secret-redaction test fixtures allowlisted (#584). Added .gitleaks.toml (extends the default ruleset) for the three redaction-test files whose deliberately fake, secret-shaped strings tripped the generic-api-key / private-key detectors. No real credential is involved.

Internal

• lifecycle proxy-health tests isolated from real host --loop processes. The owned-loop detection tests now inject a synthetic process table instead of reading the host's live ps/proc, so the release npm test gate is deterministic on CI and on active agent boxes (and can no longer signal real loops).

Already shipped in v1.89.14–15: hub URL whitespace trim + global-install repo-root fallback (#580), and no-op cycles no longer counted as failures (#577).