v0.1.34

Highlights

• 🛡️ Outside content is data, not orders. Every tool now declares whether it reads third-party content (web pages, searches, transcripts, GitHub, most MCP servers) and whether it is sensitive (sends, writes, runs code, remembers, generates paid media). What comes back from a page reaches the model wrapped in "this is data" markers, and agents are told to report any instruction found there instead of obeying it. Each task records when it took in outside content and every sensitive call made after — visible at GET /api/security/events. This stage observes; holding those calls for your approval comes next.
• 💸 One paid image or video per task. A page saying "make 8 variations" can no longer make an agent spend 8. Image agents make one image per task (with a retry if the engine fails), video agents one render. Models firing tool calls in parallel cannot slip past the limit.
• 🧼 Everything the chat renders is sanitized. Markdown replies, What's new and the manual go through DOMPurify: no scripts, forms, iframes, overlays or javascript: links, and images only from the app's own storage — a remote image becomes a plain link, so a reply cannot phone home. Links between manual pages work again.
• ⏱️ Honest times in the chat and Stats. Opening a conversation no longer changes when its replies "finished": the reply keeps its real time and Stats durations are measured from creation to completion.
• 🔬 A prompt-injection battery ships in tools/injection-battery: canned attacks run against a real model through the real pipeline, on an isolated stack.

What's Changed

• ui: sanitize everything the markdown pipe renders; restore the manual's page links by @TraX22 in #74
• tasks: reading a chat no longer rewrites when its replies finished by @TraX22 in #73
• security: know where text came from — tool risk, outside content marked as data, sensitive calls logged by @TraX22 in #75

Full Changelog: v0.1.33...v0.1.34