v0.2.3

Safety invariant: sandbox escalations to danger-full-access are NEVER auto-granted — even with Auto Mode ON they fall through to the interactive answerer, so the user is always asked before any full-access upgrade. The model-facing prompt states the same rule (do not self-escalate; state the need and wait for approval). READMEs (EN/ZH) updated.

v0.2.2

v0.2.2 — /auto command removed entirely. The composer status chip is now both the indicator and the toggle: click it to switch Auto Mode on/off, zero chat messages. Endpoint pair /api/auto-mode/state + /api/auto-mode/toggle, 3s polling with focus refresh. READMEs (EN/ZH) updated.