v1.0.9

What's Changed

• Refactor: extract init-detect into pure module emitting ConfigDraft + per-field confidence by @RapierCraft in #358
• Feat(forgedock-init): upgrade to init-enrich skill backend consuming ConfigDraft by @RapierCraft in #359
• Feat: per-directory state registry module (resolveState / setOptOut) by @RapierCraft in #360
• Feat: annotated review-render screen (source/confidence/why, accept/edit, TODO flags) by @RapierCraft in #361
• Feat: enable/disable/status CLI commands + .forgedock marker handling by @RapierCraft in #362
• Feat(init): wire autopilot init end-to-end with backend-selection ladder by @RapierCraft in #363
• Feat: SessionStart hook - context injection, opt-out, and nudge by @RapierCraft in #368
• feat(validate): self-healing validate with plain-language remediation by @RapierCraft in #369
• Feat: --manual/--verbose escape hatch for the full guided wizard by @RapierCraft in #370
• Feat: BYO-key Anthropic API enrichment backend behind init-enrich interface by @RapierCraft in #372
• Fix: showSources option silently dropped by annotatedReviewScreen by @RapierCraft in #374
• Fix: _parseEnrichedDraft brace-matching for repos with curly braces in field values by @RapierCraft in #375
• Fix: pipe _enrichViaSkill prompt via stdin to avoid ARG_MAX by @RapierCraft in #376
• fix(init): remove false-positive secondary signal from _detectBackend by @RapierCraft in #377
• fix(init): align enrichmentSucceeded with compound meta?.enriched check by @RapierCraft in #378
• Refactor: remove _parseEnrichedDraft duplicate, import from init-enrich-api.mjs by @RapierCraft in #379
• fix(updater): add shell: true to execFileSync in queryNpmRegistry for Windows .cmd shim resolution by @RapierCraft in #391
• fix(init): replace greedy regex with string-aware brace scanner in parseEnrichedDraft by @RapierCraft in #392
• Fix: session-start.mjs registry import inside try/catch (fail-open contract) by @RapierCraft in #393
• Fix: execFileSync("claude") ENOENT on Windows — skill enrichment silently dead by @RapierCraft in #394
• fix(onboarding): sanitize project_board IDs through _sanitizeYamlValue() by @RapierCraft in #395
• fix(prereq): use execFileSync for org label query to fix Windows quoting by @RapierCraft in #397
• fix(hooks): normalize SessionStart hook path to forward slashes on Windows by @RapierCraft in #398
• fix(installer): show platform-correct removal command on command conflict by @RapierCraft in #399
• fix(installer): add Windows FORGE_HOME persistence via setx by @RapierCraft in #400
• chore(polish): fix 4 LOW-severity polish findings from PR #380 review by @RapierCraft in #402
• fix(forgedock): sanitize optionIds key names as YAML keys in _buildOptionIdsBlock() by @RapierCraft in #403
• fix(installer): escape single quotes in FORGE_HOME for PowerShell guidance string by @RapierCraft in #406
• fix(forgedock): add tab stripping to _sanitizeYamlKey() regex by @RapierCraft in #407
• fix(onboarding): normalize spaces in _sanitizeYamlKey() for idiomatic YAML keys by @RapierCraft in #408
• Ship: Intelligent, Idiot-Proof Onboarding by @RapierCraft in #409
• fix(installer): tolerate JSONC in readClaudeSettings() via stripJsonc() by @RapierCraft in #420
• fix(init): log debug warning when enrichment response truncated by max_tokens by @RapierCraft in #421
• fix(registry): normalize drive-letter casing for registry key lookups on Windows by @RapierCraft in #422
• fix(hooks): sanitize forge.yaml values before session context injection by @RapierCraft in #423
• fix(installer): remove FORGE_HOME from Windows user env on uninstall by @RapierCraft in #425
• fix(updater): replace unconditional shell:true with platform-conditional flag in queryNpmRegistry by @RapierCraft in #428
• fix(installer): detect setx 1024-char truncation before success message by @RapierCraft in #429
• fix(init): normalize CR/CRLF in review.context before block scalar emit by @RapierCraft in #430
• fix(installer): use REG delete to remove FORGE_HOME on Windows uninstall by @RapierCraft in #431
• fix(hooks): sanitize project.owner and project.repo before session context injection by @RapierCraft in #432
• fix(installer): detect Windows unconditionally for FORGE_HOME cleanup by @RapierCraft in #433
• docs(config): add nudgeSeen to registry schema docs by @RapierCraft in #454
• fix(hooks): use /\r?\n/ split in parseForgeYaml to handle CRLF forge.yaml by @RapierCraft in #455
• docs(init): correct --manual flag description from wizard to annotated review screen by @RapierCraft in #456
• fix(init): rewrite API-mode SYSTEM_PROMPT to remove false codebase/gh-CLI capability claims by @RapierCraft in #457
• Fix: derive lowConfidenceKeys live at every return site in annotatedReviewScreen by @RapierCraft in #459
• fix(scripts): guard empty ROUTE_SEGMENT to prevent false-positive warnings by @RapierCraft in #458
• fix(hooks): strip single backticks in sanitizeContextValue by @RapierCraft in #461
• Fix: registry read-modify-write race loses concurrent updates (#438) by @RapierCraft in #460
• Refactor: hoist OPTIONAL_SECTION_CHOICES and section name map to module scope by @RapierCraft in #463
• Fix: ANSI-aware column padding/truncation in annotated review screen by @RapierCraft in #464
• fix(registry): dereference symlinks in normalizeDir for consistent registry keys by @RapierCraft in #467
• fix(hooks): sanitize process.cwd() before context output interpolation by @RapierCraft in #465
• Fix: strip C0/C1 control chars from review.context block scalar by @RapierCraft in #470
• Fix: writeClaudeSettings() tmp cleanup on renameSync failure by @RapierCraft in #472
• test(bin): add node:test unit tests for 5 onboarding modules by @RapierCraft in #473
• fix(init): add section tracking to _injectTodoComments() to prevent false TODO on project_board.owner by @RapierCraft in #476
• refactor(installer): extract SESSION_START_HOOK_TIMEOUT_SECONDS constant by @RapierCraft in #477
• refactor(onboarding): migrate gh auth login to execFileSync arg array by @RapierCraft in #478
• fix(installer): escape double quotes in sessionStartHookCommand hook path by @RapierCraft in #479
• Refactor: extract _initNonTTY and _collectOptionalSections from init() (#453) by @RapierCraft in #480
• fix(init): route enrich() apiKey-absent warning to stderr by @RapierCraft in #481
• docs(registry): replace misleading Pure JSDoc claim in writeRegistry by @RapierCraft in #483
• fix(sanitize): add C0/C1 control char stripping to _sanitizeYamlValue() by @RapierCraft in #485
• fix(tests): add GIT_CONFIG_GLOBAL guard to makeLocalRepo initial commit by @RapierCraft in #487
• fix(package): exclude bin/tests/ from published npm package by @RapierCraft in #484
• fix(tui): append reset after truncateVisible to prevent color bleed by @RapierCraft in #486
• fix(tui): broaden ANSI strip regex to cover all CSI sequences by @RapierCraft in #488
• fix(init): surface API enrichment error category to stderr unconditionally (#491) by @RapierCraft in #497
• fix(init-detect): exact-match staging branch detection prevents substring false positives by @RapierCraft in #496
• Fix: move forge-utils import inside try/catch — fail-open contract regression (#489) by @RapierCraft in #498
• Deploy: Intelligent, Idiot-Proof Onboarding + staging-review hardening (staging → main) by @RapierCraft in #482

Full Changelog: v1.0.8...v1.0.9