v3.18.0

Fixed

• install.sh Windows split-brain (#269): on MINGW/MSYS/CYGWIN the installer now targets %APPDATA%/devin (where the CLI actually reads) instead of ~/.config/devin; audit.py prefers %APPDATA% on Windows and warns when both dirs exist. Previous bash installs had written a shadow config that drift checks validated as "live".
• Exporter secret masking and pre-push gate (#268): export.sh/export.ps1 now mask by key-name (token|secret|api[_-]?key|password|auth|credential|private|pat, e.g. GITHUB_PAT, Authorization, client_secret) and embedded URL userinfo; TOML masking tracks multiline openers ([, """, ''') so continuation lines no longer leak; the pre-push audit.py/pytest gate now runs inside the bundle root (it previously validated the caller's cwd, where audit.py walks ., silently broken); git add -A replaced with export-owned paths; paths passed via sys.argv instead of shell interpolation; bundle-only/stale export entries now reported.
• Installer/skill robustness (#264): unreadable-file guards, ppisp subprocess timeout, empty extension directory skip in install.sh (parity added to install.ps1 in #269).
• comfyui-operator hardening (#263): loopback-only server URL and download path sanitization.
• Typed-error hardening (#262, #255, #254): plan_check, ASR bootstrap, sc_bench, custom presets, laya-compactor pairing/reduction accounting.
• asr Windows discovery (#256): whisper binary/model discovery fixed on Windows.
• Unexpanded placeholders (#272): {{VALIDATED_CLI_VERSION}} in ask-bundle (never substituted by any pipeline) now references validated_cli_version; data/bundle-identity.json filled with real values (Leostruka/devin-bundle, 2026); blender-operator POSIX ps call gained timeout=15 parity.
• Unbounded subprocess calls (#274): timeout=15 added to the PowerShell CIM query in extensions/computer-use/probes/probe_spawnpty.py; timeout=60 added to CLI subprocess calls in extensions/media-tools/tests/{test_cli,test_export}.py.
• Phantom recipe tool (#275): data/recipes.json explore listed glob (premise corrected in #284: glob is a real tool, but recipes should not demand mode-absent tools); it capped the recipe tool score at 0.75 in context-pressure.py. Removed; regression test validates every recipe tool against the canonical CLI tool set.
• False architecture boundary + missing enforcement (#278): .devin/ARCHITECTURE_MANIFEST.md claimed hook scripts never import from extensions/, but laya-guard.py intentionally does (dynamic, fail-open); manifest corrected to "no third-party pip deps" with the laya exception documented; new test_scripts_import_boundary test enforces stdlib/sibling/exception imports across scripts/*.py.
• POSIX reap verification flake (#280): _reap_posix_group group-absence deadline widened 5s -> 15s; SIGKILL-to-launchd-reap latency on loaded macOS CI runners exceeded 5s, producing transient false tree_cleanup results (test_spawn_timeout_cleans_tree failed 3x).
• Phantom tool in skill frontmatter (#282): observability-quality allowed-tools listed glob (premise corrected in #284) corrected to find_file_by_name; new test_skill_allowed_tools_exist enforces canonical tool names across all SKILL.md frontmatter.
• glob tool misclassified as phantom (#284): glob is a real CLI tool (validate-tool-args checker + TOOLS-MAP); the session toolset is mode-dependent and not canonical. #282's premise corrected: observability-quality restored to glob + find_file_by_name; VALID_TOOLS expanded to the canonical 28-tool set; allowed-tools test now covers YAML-list form and agents/ + .devin/agents/ profiles.
• Orphaned extension requirements (#287): playwright (craft-bridge), opencv-python-headless and piexif (image-forensics) were declared but never imported; ppisp-prep gained the missing requirements.txt (numpy, pillow) for its hard deps; new test_extension_declared_deps_used enforces declared->used per extension.
• agent-reach wrapper desync from upstream CLI: wrapper forwarded channels as subcommands (agent-reach youtube ...), a grammar agent-reach 0.1.0 never shipped; every documented call exited 2 and doctor reported degraded probing a nonexistent --version. Wrapper now translates <channel>[.<command>] to get <target> --json, doctor proxies doctor --json per-channel status, whitelist narrowed to the real upstream index (youtube, rss; auth:none), and SKILL.md/manifest purpose synced (previous docs claimed phantom github/bilibili/v2ex/web channels).

Added

• test_extension_used_deps_declared (#288): the reverse direction of the R20 check is now enforced — module-scope third-party imports in extensions/ must be covered by that extension's requirements*.txt; AST-based (function-scope lazy imports exempt), extensions-internal module roots exempt, documented bpy/mathutils host-provided allowlist for Blender's embedded interpreter; the R20 orphan check was upgraded from regex to AST.
• agentic-rag vectorless/tree-index retrieval (#266): architecture selector gained long structured docs -> PageIndex-style with honest costs (LLM call per hop, index build time, stale-tree versioning); gate/escalation unchanged.
• brag portfolio-site beat order (#267): storyboard template for portfolio/personal-site inputs (hero -> work -> recognition -> process -> values -> CTA) from real-site reel re-analysis.
• stuck-detect deterministic advisory (#260): token-economizer subset hook.
• Ponytail minimal-diff checklist (#258): Goldfish zoom-out review step.
• EGM runtime rollout (#253): JEV routing, OpenUI runtime, camera blocking, BitNet/offloading adapters, TPU held-out scaffolding + 12-issue audit hardening.

Changed

• MODEL-GUIDE: Avalon AMD MoE fork evaluated-not-adopted with 4-question benchmark-reading checklist (#265); LFM3 local-audio family entry (#259).
• dispatching-parallel-agents (#277): DeepSeek super-agent eval evidence added; task-queue interruption inverts the sub-delegation bias (neutral prompt 0/5, delegate-first 4/5, median 20.4->13.8 min) plus Cooper Bench co-edit cost (~30% lower success).
• audit.py check 32 (#281): [Unreleased] merge coverage now enforced; merge PRs since the released tag without #NNN refs in [Unreleased] fail the audit (docs(changelog) PRs exempt).
• audit.py pycache check robustness (#285): check 11 git ls-files pathspec replaced by Python-side '__pycache__' in path filter, matching tracked caches at any depth.

Documentation

• Source analyses: NCM coarse-to-fine (#261), FreeMyTv Claude-Code-on-TV (#257), batch sources incl. DeltaDB/TradingAgents/Kimi K3/Openjutsu (#265), TSF Lesson 1 (#271), GG Coder demo (#276), all notes-only, no portable implementation; Nx-style lib boundaries applied internally as a real enforcement fix (#278); R8 issue answers (#270); review-pattern capture and drift reconciliation (#252).