v0.2.17

What's Changed

• docs: audit-driven cleanup (DEBT refresh, STATUS pointer, archive stale plans) by @Jiahui-Gu in #1408
• build(webpack): add production bundle-size budget (warn at 1.6MiB) by @Jiahui-Gu in #1410
• docs(debt): refresh audit register (2026-05-29) by @Jiahui-Gu in #1414
• security(csp): set Content-Security-Policy response header (dev/prod aware) by @Jiahui-Gu in #1413
• fix(deps): audit-fix prod vulnerabilities; add audit scripts by @Jiahui-Gu in #1412
• refactor(sidebar): extract SidebarActionsContext, drop 5 prop-drilled callbacks by @Jiahui-Gu in #1411
• docs(debt): mark #7/#11/#17/#18 DONE after paydown batch by @Jiahui-Gu in #1415
• docs(project): add root AGENTS.md + CLAUDE.md orientation (debt #8) by @Jiahui-Gu in #1416
• perf(renderer): lazy-load Settings/Command/Import dialogs (debt #3) by @Jiahui-Gu in #1417
• refactor(terminal): break terminal↔store circular dependency (debt #6) by @Jiahui-Gu in #1418
• docs(debt): close out #3 — lazy-load DONE, vendor splitChunks WONTFIX by @Jiahui-Gu in #1419
• docs(debt): refresh ledger — god-file LOC, dev-only audit (verification pass) by @Jiahui-Gu in #1420
• chore(deps): upgrade @anthropic-ai/claude-agent-sdk 0.2 → 0.3.156 (DEBT #2) by @Jiahui-Gu in #1421
• fix(mobile-remote): isolate pty.data per subscribed session + harden token compare by @Jiahui-Gu in #1425
• fix(ptyHost): guard JSONL watcher teardown behind session-identity check by @Jiahui-Gu in #1423
• fix(ipc): expand tilde cwd before persisting in app:userCwds:push by @Jiahui-Gu in #1426
• fix(drafts): flush pending composer draft on beforeunload by @Jiahui-Gu in #1424
• refactor(window): split createWindow.ts god-file (DEBT #4) by @Jiahui-Gu in #1428
• refactor(terminal): split shellRegistry.ts god-file (DEBT #4) by @Jiahui-Gu in #1429
• refactor(log): split log.ts god-file (DEBT #4) by @Jiahui-Gu in #1430
• fix(db): checkpoint WAL on every saveState to survive OS restart by @Jiahui-Gu in #1427
• refactor(remote): split mobileRemoteServer.ts god-file (DEBT #4) by @Jiahui-Gu in #1432
• refactor(stores): split sessionCrudSlice.ts god-file (DEBT #4) by @Jiahui-Gu in #1431
• ci: unblock doc-only PRs + record DEBT #1/#2/#4/#20 by @Jiahui-Gu in #1433
• feat(mobile-remote): make the mobile client genuinely phone-usable by @Jiahui-Gu in #1422
• feat: local voice input (mic -> Whisper -> inject) by @Jiahui-Gu in #1434
• feat(mobile-remote): real-device polish — keyboard, orientation, PWA by @Jiahui-Gu in #1436
• fix(notify): idle-confirmation window — stop notifying on mid-task pauses by @Jiahui-Gu in #1437
• feat(mobile-remote): WS heartbeat ping + half-open client reap (Track B) by @Jiahui-Gu in #1438
• test(e2e): mock Anthropic API in all CLI-spawning harnesses by @Jiahui-Gu in #1435
• fix(ipc): cap unbounded IPC arrays (DEBT #12) by @Jiahui-Gu in #1439
• feat(terminal): self-drawn scrollbar from xterm buffer (single source of truth) by @Jiahui-Gu in #1442
• feat(voice): AVX2 whisper-cli subprocess backend (13s -> sub-second) by @Jiahui-Gu in #1443
• feat(ui): reposition scroll-to-bottom and mic buttons by @Jiahui-Gu in #1445
• feat(voice): warm whisper exe/model into page cache on startup by @Jiahui-Gu in #1446
• docs(ptyHost): correct reload tail-loss root-cause comments by @Jiahui-Gu in #1449
• feat(voice): toast feedback, recording timer + a11y for dictation by @Jiahui-Gu in #1452
• fix(ui): align scroll-to-bottom button center Y with Settings button by @Jiahui-Gu in #1454
• feat(mobile-remote): public-internet phone client (OAuth phone-flow + PWA from Worker) by @Jiahui-Gu in #1462
• fix(terminal): native viewport scrollbar reconcile on shell reveal (#82) by @Jiahui-Gu in #1471

Full Changelog: v0.2.16...v0.2.17