GJC 0.19.0

What's Changed

• fix(tmux-self-injection-guard): handle wrapper options and bundled shell flags by @clawdbot in d3a6d030b1
• fix(tmux-self-injection-guard, utils): Address 6 blocking review findings by @clawdbot in a179530577
• fix(#6563): tmux self-pane injection guard - handle wrapper options and bundled shell flags by @Yeachan-Heo in #6564
• fix(tmux-self-injection-guard): correct command boundary check in isCommandLookup by @clawdbot in a2a096ea90
• fix(tmux-self-injection-guard): fix all blocking findings from probepark review by @clawdbot in 5f0ad914a9
• fix(tmux-self-injection-guard): preserve command boundaries in lookup suppression by @clawdbot in 02bc29eded
• fix(tmux-self-injection-guard): handle bash long options in payload detection by GJC Agent in bc21d36325
• chore: add changelog entry for tmux shell payload selection fix (issue #6564-7) by GJC Agent in 263610417b
• fix(tmux-guard): resolve 4 critical blocking findings from PR #6564 review by @clawdbot in 3027a7bac8
• fix(tmux-self-injection-guard): handle quoted payloads and env --split-string format by @clawdbot in dda71bacb7
• fix(tmux-self-injection-guard): add long-option arity specs for timeout, nice, stdbuf by @clawdbot in 26c4c06413
• fix(tmux-self-injection-guard): properly parse env option operands and split-string values by @clawdbot in 8e880067c8
• fix(tmux-self-injection-guard): normalize path-qualified wrapper commands by @clawdbot in 7dc66cd2ab
• fix(tmux-self-injection-guard): improve socket assignment backtracking and prepare for P2 finding by @clawdbot in 7356668a24
• fix(tmux-self-injection-guard): fix env-S context, socket operands, and long-option arities by @clawdbot in 8932d749b5
• fix(tmux-self-injection-guard): address P1 blocking findings from snowykr review by @gaebal-gajae in f21dc3d9c6
• Merge pull request #6647 from Oreochococukie/fix/otel-content-capture-trust by @probepark in ba733ac075
• fix(release): forward-port release/0.18.12-only fixes into dev by @Yeachan-Heo in #7057
• Revert "Merge pull request #6652 from Oreochococukie/fix/launch-worktree-later" by Test Bot in 1851e038fd
• fix(python): recover retained sessions after confirmed process exit by @probepark in #6571
• fix(session): rotate the credential when auto-compaction hits a usage limit by @lifrary in 0f2ab23cbc
• fix(test): restore SDK agent_end publication in message pipeline by GJC Multisession in 12a479a282
• fix(session): restore continuation-decision guard before SDK publication (PR #6668 P1) by GJC Multisession in 110f17df7f
• fix(sdk): lease the promoted follow-up after the deadline is restored by @Oreochococukie in b4fde673fd
• test(sdk): isolate runtime extension broker discovery by @probepark in fce892f689
• fix(session): rotate the credential when auto-compaction hits a usage limit by @lifrary in #6691
• fix(lock): retry Windows session-index publication failures by @Yeachan-Heo in #6699
• fix(file-lock): recover aged empty Windows lock directories by @Yeachan-Heo in #6701
• fix(file-lock): make canonicalLockPathPreservingFinal resilient to fs.realpath failures by clawdbot in 593ecb8320
• revert(file-lock): keep canonicalLockPathPreservingFinal failing closed on non-ENOENT errors by clawdbot in d7f3a7ce60
• fix(file-lock): apply origin/dev fixes including staging suffix length bound and add test hooks by clawdbot in 1b37b6cc63
• Revert "fix(file-lock): apply origin/dev fixes including staging suffix length bound and add test hooks" by clawdbot in 4f4ca8c0a4
• fix(g002): align MCP quarantine gate with exact-config controls by @Yeachan-Heo in #6714
• fix(ai): send project in Antigravity model discovery so tier-gated models appear by GJC Multisession in a6df390e35
• fix(coding-agent): read Google projectId from the stored credential, not the resolved token by GJC Multisession in 34355ed8dc
• fix(ai): use Gemini CLI identity for Antigravity discovery by @Yeachan-Heo in #6734
• feat(migrate): import Claude Code commands and Codex prompts by @Yeachan-Heo in #6791
• fix(coding-agent): close four planning-bash mutation escapes by @Yeachan-Heo in #6895
• fix(coding-agent): filter versioned Lua startup hooks by @clawdbot in e9384c693e
• fix(utils): redact comma-separated cookie pairs by @clawdbot in 26ef86ed8d
• fix(utils): recognize dotted credential keys by @clawdbot in 005e3cceda
• fix(coding-agent): filter Ruby BUNDLER_SETUP startup hook by @clawdbot in b1db44a043
• fix(utils): redact escaped-backtick credentials by @clawdbot in aeb31f209b
• fix(utils): preserve escaped backtick redaction boundaries by @clawdbot in d844f02bd3
• fix(coding-agent): filter project OpenSSL startup config by @clawdbot in 6be3909e63
• fix(utils): redact secret key base fields by @clawdbot in f5afc3ef61
• fix(coding-agent): filter Tcl startup libraries by @clawdbot in 7b04061c88
• fix(utils): redact backtick-quoted credential keys by @clawdbot in 6495310f8a
• fix(coding-agent): filter OpenSSL provider paths by @clawdbot in 45d9bdad5e
• fix(utils): redact credentials in long-scheme URLs by @clawdbot in 259450f288
• fix(coding-agent): anchor relative gh config paths by @clawdbot in 003b3c7a57
• fix(utils): bound quoted credential redaction to lines by @clawdbot in fa4b8aa63d
• fix(utils): redact plural cookie containers by @clawdbot in d0426557f4
• fix(coding-agent): redact credentials in header tuple exports by @clawdbot in 8572b34aa0
• fix(coding-agent): redact flat header credentials by @clawdbot in 5feaed64a9
• fix(utils): redact plural cookie multi-pair values by @clawdbot in e80c8136ef
• fix(coding-agent): filter Julia startup paths from share by @clawdbot in 6adc29bf63
• fix(utils): redact Azure account-key credentials by @clawdbot in e19ea39c25
• fix(coding-agent): redact credential header records by @clawdbot in 0210dc47aa
• fix(coding-agent): secure share OpenSSL environment paths by @clawdbot in 4afc0d463d
• fix(utils): redact whitespace-separated credential labels by @clawdbot in 7a1e4e8dfc
• fix(coding-agent): redact PascalCase header records by @clawdbot in 129d453e71
• fix(redaction): preserve punctuation and diagnostics by @clawdbot in 0bec15ab2a
• fix(coding-agent): anchor relative XDG config home by @clawdbot in 6055a26bb1
• fix(redaction): mask unquoted multiword credentials by @clawdbot in 99fa232a50
• fix(redaction): preserve context around multiword values by @clawdbot in ebac87ef38
• fix(coding-agent): strip project Elixir startup options by @clawdbot in 2eed029132
• fix(coding-agent): redact plural credential headers by @clawdbot in 82a3cf0abf
• fix(redaction): mask YAML credential block scalars by @clawdbot in eabbdba271
• fix(coding-agent): filter project RubyGems paths by @clawdbot in 963ada03bd
• fix(coding-agent): filter RubyGems dependency startup by @clawdbot in 58b18e60c8
• fix(utils): redact password confirmation credentials by @clawdbot in ca35fce453
• fix(coding-agent): filter project Tcl package paths by @clawdbot in 3e8b63a1b8
• fix(coding-agent): filter project Bundler Gemfile by @clawdbot in 37c410c9b4
• fix(coding-agent): filter project Java runtime path by @clawdbot in 5df874fdb0
• fix(utils): enforce credential value boundaries by @clawdbot in 586c6c84f9
• fix(utils): redact Azure shared access keys by @clawdbot in cf3cdef687
• fix(coding-agent): filter project Dotnet runtime roots by @clawdbot in 85999d75d4
• fix(utils): redact YAML sequence credential scalars by @clawdbot in bf4e0c8b1c
• fix(coding-agent): filter project Lua module paths by @clawdbot in 243bc7cd19
• fix(utils): redact Azure shared access signatures by @clawdbot in 580a62d120
• fix(coding-agent): filter project Julia loader paths by @clawdbot in b99fe749d4
• fix(coding-agent): filter project Bun runtime options by @clawdbot in 8af677520b
• fix(utils): redact anchored YAML credential scalars by @clawdbot in c45b02643f
• fix(test): keep bun test filter walks out of Cargo target/ by Yeachan-Heo in 08507de217
• fix(utils): match Bun when a dotenv hash follows a backslash by @Oreochococukie in #6824
• fix(coding-agent): gate the ssh tool on the session permission policy by @Oreochococukie in #6829
• fix(coding-agent): close an early Hindsight memory frame by @Oreochococukie in #6822
• fix(sdk): stop broker after its agent directory is removed by @Yeachan-Heo in #6818
• fix(session): name a refused cleanup receipt in the scope startup error by @cynkai in #6823
• fix(coding-agent): scrub secrets before Hindsight retain upload by @Oreochococukie in #6825
• fix(memories): redact Bearer and Basic assignments before writing memory by @Oreochococukie in #6819
• fix(ai): ignore project-dotenv proxy selectors by @Oreochococukie in #6833
• fix(sdk): restore broker observer streaming and diagnose legacy admission fences by @Heyaaz in #6832
• fix(session): recover stale v3 cleanup receipts after APFS device renumbering by @Yeachan-Heo in #6831
• fix(release): retry transient GitHub reads during release-note derivation by @Yeachan-Heo in #6821
• fix(bash): keep skill:// expansion inside the skill directory by @Oreochococukie in #6826
• fix: do not import repository hook modules by @Oreochococukie in #6830
• fix(utils): skip home credential files when cwd is that directory by @Oreochococukie in #6834
• fix(pty): reap setsid double-fork descendants on cancel and timeout by @Oreochococukie in f6329d839a
• test(pty): give setsid reap cases time to reparent by @Oreochococukie in d810218cca
• fix(coding-agent): keep external editor drafts off preexisting temp symlinks by @Oreochococukie in 7ad8db3917
• fix(coding-agent): keep external editor drafts off preexisting temp symlinks by @Oreochococukie in #6836
• fix(file-mentions): keep auto-read paths inside the session directory by @Oreochococukie in #6837
• test(file-mentions): record pass lines after the workspace-boundary assertions by @Oreochococukie in 22ed217217
• test(file-mentions): keep the alias case on macOS and record assertion failures by @Oreochococukie in b7d19b1ab9
• fix(coding-agent): escape project context in commit analysis by @Oreochococukie in #6838
• test(pty): compile setsid reap cases with the library tests by @Oreochococukie in c1b08c241b
• fix(ultragoal): do not nudge toward a goal handed off to a successor by @cynkai in #6841
• fix(daemon): bump generations and keep failed process lookups unknown by @Oreochococukie in c67c5b32d0
• fix(ai): ignore project dotenv for GLM ZCode OAuth endpoints by @Oreochococukie in #6840
• fix(utils): keep a frontmatter proto key as data by @Oreochococukie in #6839
• fix(coding-agent): stop archive inflate past fixed caps by @Oreochococukie in #6847
• fix(pty): apply rustfmt and refresh daemon manifest by clawdbot in c79c2d1a0b
• feat(ttsr): port oh-my-pi pre-execution astCondition matching by @najy97 in #6846
• feat(ttsr): wire astCondition checks into tool execution path for write tool by @clawdbot in 01d5cfb4f9
• test(ttsr): replace misleading unit tests with real beforeToolCall integration tests by @clawdbot in 9087cb694a
• fix(session): restore tool_execution event branch and import readEditFileText from edit/read-file by @gaebal-gajae in 6da5cb2a3d
• fix: ttsr ast condition checks - import auth/model registry, fix stopReason, complete assistant messages by @clawdbot in 33d37e9493
• fix: TTSR beforeToolCall integration - fix agent streaming mock to return follow-up responses by @clawdbot in 800e981040
• fix(daemon): bump generation for process authority by clawdbot in 1099f037fd
• fix(daemon): sync manifest with pinned parser by clawdbot in 7966c17c0c
• fix(mcp): frame untrusted tool descriptions and schema prose by @Oreochococukie in #6848
• test(acp): tolerate replay timeout budget drift by @probepark in #6845
• fix(ttsr): resolve astMatch extensions like paths; digest creates as written by @najy97 in 9633f6bab1
• fix(edit): guard a patch rename destination against auto-generated files by @Oreochococukie in #6850
• fix(edit): check every patch rename destination before the request writes by @Oreochococukie in 1a53a38255
• fix(coordinator): keep webhook error diagnostics on one line by @Oreochococukie in #6739
• fix(session): frame inbound IRC text as untrusted data by @Oreochococukie in #6851
• docs(agent): describe matcher hooks as finalized pre-execution projections by @najy97 in e2107b51f5
• chore(ttsr): correct matcher hook docs and name the test stub type by @najy97 in #6854
• Merge remote-tracking branch 'origin/dev' into fix-6844-native-observer by @probepark in #6855
• fix(ttsr): report invalid astCondition patterns by @Yeachan-Heo in #6856
• fix(session): deliver background IRC exchanges at the next step boundary by @Heyaaz in #6859
• fix(sdk): follow session id changes in the direct CLI broker registration by @Heyaaz in 07cbf40699
• fix(sdk): retain a superseded session registration until its release succeeds by @Heyaaz in 1594e7d052
• fix(coding-agent): gate debug program launch on approval by @Oreochococukie in #6858
• fix(sdk): reap a broker nobody is left to use by @Heyaaz in d0808c5368
• fix: encode tool metadata in the system prompt inventory by @Oreochococukie in #6864
• fix(session): keep a re-armed exchange cohort together after an interrupt by @Heyaaz in 3bad28b5b1
• fix(pty): verify descendant identity and reap adopted processes by clawdbot in 014332b329
• feat(ai): gzip Anthropic request bodies by @Yeachan-Heo in #6865
• fix(sdk): give a restarted broker its own abandonment clock by @Heyaaz in fea9e8a94c
• test(natives): capture original parent before observing reparenting by clawdbot in db420c06d3
• fix(sdk): never replay a retired release against a reactivated session by @Heyaaz in b5ca71a11c
• test(session): read the framed inbound IRC payload in the delivery schedule by @Heyaaz in 6c51ca0344
• fix(coding-agent): recheck patch rename destinations under the mutation lock by @Oreochococukie in 11f4dd16de
• fix(system-prompt): keep the untrusted-content fence on repeated descriptions by @Oreochococukie in c94d90b9e3
• feat(notify): notify when a foreground bash command waits for browser sign-in by @yazzang-homelab in #6867
• fix(tui): keep welcome model pills in sync with live model switches by @GoBeromsu in #6861
• fix(sdk): keep supervised broker services alive and pause an undecided clock by @Heyaaz in a0e4e7dc17
• test(bash): add regression tests and property tests for awaiting-input detection by GJC Multisession in 49949c954c
• fix(sdk): follow the adopted manager and retry a failed successor registration by @Heyaaz in a614ac5fc6
• fix(session): persist an accepted exchange when its run ends before the boundary by @Heyaaz in 778dcd82b3
• fix(update): reclaim binary install artifacts by @Yeachan-Heo in #6866
• fix(sdk): read the live session manager in the identity-sync handler by @Heyaaz in da3bc70599
• fix(session): publish the committed branch identity when integrations fail by @Heyaaz in 15bfabd986
• fix(notify): deliver awaiting_input live-only and hold it through provisional policy by @yazzang-homelab in eaa6302e14
• feat(ai): add Claude Haiku 5.5 on the direct Anthropic API (split of #6849) by @cadpro-solutions-llc in #6872
• fix(local-protocol): adopt a recreated managed root with a settled marker by @Dayoooun in #6871
• fix(tools): regenerate catalog after IRC prompt change by @Yeachan-Heo in #6876
• feat(ai): add Claude Haiku 5.5 on Amazon Bedrock (stacked on #6872) by @cadpro-solutions-llc in #6874
• test(ai): property-test Bedrock Haiku 5.5 pricing across all six profiles by @cadpro-solutions-llc in a84f7ea3dd
• fix(ai): restore selected Bedrock reasoning when a forced tool choice is dropped by @cadpro-solutions-llc in 1d26dca846
• test(model-registry): align haiku latest canonical expectation by @Yeachan-Heo in #6880
• fix(re-review): request reviewers through the standard endpoint by @Yeachan-Heo in #6882
• fix(sdk): decide host presence with the tri-state process observer by @Heyaaz in 97ba206c77
• fix(session): keep failed profile activation out of role materialization by @najy97 in #6881
• feat(tool-discovery): preserve provider cache prefix for mid-session tool activation by @clawdbot in 8ea176c752
• fix(test): align profile activation inventory expectations by clawdbot in 0dee24f2d7
• fix(tui): transmit the Gajae Pet sprite as a single-escape kitty PNG by @Yeachan-Heo in #6888
• fix(cron,monitor): make fired tasks executable instead of notifiable by @Yeachan-Heo in #6889
• Revert unreviewed direct push 8ea176c (tool-discovery cache prefix) by @Yeachan-Heo in #6884
• fix(git): keep project-dotenv hook variables out of GJC's own git and gh invocations by @10kH in 4546bf813a
• fix(sdk): classify session-identity seams as internal exclusions by @Yeachan-Heo in #6891
• fix(sdk): make broker discovery and blocked-renewal outcomes deterministic by Yeachan-Heo in ad10c9e165
• test(sdk): stop the isolated host wiring suite from racing real broker startup by Yeachan-Heo in a5506aa428
• docs(mcp): document the project-stdio opt-in for the Sem example by @Yeachan-Heo in #6894
• docs(mcp): keep the exact-config /mcp exception and reset, not disable, the opt-in by Yeachan-Heo in 383562b533
• fix(model-selector): rank search results by match quality by @Yeachan-Heo in #6898
• fix(ai): readable OpenAI Codex token refresh errors by @Yeachan-Heo in #6857
• fix(sdk): preserve proven lifecycle terminal transitions by @Heyaaz in b929fb3f56
• test(fixtures): align internal fixtures with runtime contracts by @probepark in #6897
• fix(sdk): replay proven errors without rerunning cleanup by @Heyaaz in 686b085bc8
• fix(finalize): refuse validation commands that inject into this tmux pane by @Oreochococukie in 096c169390
• fix(model-registry): preserve discovery for unscoped callers and per-session refreshes by Yeachan-Heo in ddbe3d15ff
• fix(test): keep bun test filter walks out of Cargo target/ by Yeachan-Heo in 1d4fe3ade9
• fix(sdk): return the ledger's proven terminal result on cleanup replays by Yeachan-Heo in 6982749a01
• fix(natives): keep native build output inside the package native directory by @Oreochococukie in f12d363028
• fix(natives): keep native build output inside the package native directory by @Oreochococukie in #6911
• test(sdk): supply C52 dispatcher editor chrome callback by @probepark in #6907
• fix(config): fence validation across active session transitions by @probepark in #6904
• fix(model-selector): rank multi-token searches by token quality and keep default ties by Yeachan-Heo in dba6c37c36
• fix(coding-agent): frame subagent snapshot text as untrusted content by @Oreochococukie in #6914
• fix(tui): emit file:// URIs for local OSC 8 links by @sskys18 in #6908
• fix(coding-agent): correct Aside session resume by @sskys18 in #6910
• fix(natives): classify denied no-replace publication opens as access_denied by @thegreatesthoneybee in 75aafc631f
• docs(doctor): hand off lease expiry observation limits by @probepark in #6918
• test(sdk): repair three red dev test surfaces by @Yeachan-Heo in #6915
• fix(skill-state): detect regex-addressed sed e and control-prefixed interpreters by Yeachan-Heo in 7c0f596756
• Merge origin/dev into fix/bunfig-ignore-cargo-target by Yeachan-Heo in a033d7f4c1
• fix(coding-agent): frame browser page text as untrusted content by @Oreochococukie in #6921
• fix(coding-agent): bind restricted workflow bash to the resolved executable by @Oreochococukie in e20ef37dec
• fix(coding-agent): skip the workflow shell snapshot and keep git helper flags first by @Oreochococukie in 77f57e3c76
• chore(repo): drop stray filesystem-watch probe artifact by @Yeachan-Heo in #6923
• fix(agent): encode compaction and branch summaries on reinsertion by @Oreochococukie in #6924
• fix(ai/anthropic): anchor the last system block in automatic cache mode by @toranalytics in #6913
• test(ai/anthropic): property test for automatic-mode cache marker allocation by @toranalytics in 1fff5ccc4c
• test(sdk): pin the damaged read-back contract to monotonic terminal rows by @Yeachan-Heo in #6926
• fix(tools): frame search and ast-grep results as untrusted content by @Oreochococukie in #6906
• fix(ai/anthropic): don't add the automatic root marker past the four-breakpoint cap by @toranalytics in 67812c6e01
• fix(ai/anthropic): don't add the automatic root marker past the four-breakpoint cap by @toranalytics in #6919
• test(ai/anthropic): root-marker property test accounts for the system-block anchor from #6913 by @toranalytics in 5474917477
• style(skill-state): format the sed e-command matcher by @Yeachan-Heo in #6927
• fix(tools): frame GitHub issue and pull request text as untrusted content by @Oreochococukie in e25ce80bea
• fix(utils): drop project-dotenv tool-config and sibling injection variables from the bash spawn env by @10kH in 44d577aaba
• fix(utils): match npm node-options/script-shell in any spelling and refuse non-identifier dotenv keys by @10kH in f82ee319db
• test(bench): give the two-workload runner test a real budget by @Yeachan-Heo in #6929
• test(sdk): accept both settled turn.abort finalizations by @Yeachan-Heo in #6930
• docs(readme): align English guidance with current dev behavior by @snowykr in #6931
• docs(readme): align Korean guidance with current dev behavior by @snowykr in #6932
• docs(readme): align Japanese guidance with current dev behavior by @snowykr in #6933
• docs(readme): correct Simplified Chinese onboarding and capability claims by @snowykr in 27faaf2641
• fix(ultragoal): baseline an unborn repository on the empty tree by @Yeachan-Heo in #6936
• fix(bash): stop injecting CI=1 into the non-interactive environment by @Yeachan-Heo in #6937
• fix(open): refuse non-http schemes and control characters in the OS opener by @Oreochococukie in af431663e9
• fix(open): pass only http(s) URLs and local paths to the OS opener by @Oreochococukie in #6939
• docs(ko): qualify Telegram private-chat fallback by @snowykr in #6938
• fix(coding-agent): encode rulebook fields in the system prompt by @Oreochococukie in #6935
• fix(coding-agent): keep repository SYSTEM.md out of the customization block by @Oreochococukie in 86fb9f7b3a
• fix(bash): remove the remaining default CI injection from shell config by @Yeachan-Heo in #6953
• fix(ultragoal): derive empty tree ID from repository format for SHA-256 support by clawdbot in 89397fbff6
• fix(coding-agent): keep subagent role text inside the host role block by @Oreochococukie in #6940
• fix(docs): address review findings from #6894 by @Yeachan-Heo in #6946
• test(coding-agent): add regression tests for 4 planning bash escape findings by clawdbot in e5e60037a6
• fix(coding-agent): address review findings from #6895 by @Yeachan-Heo in #6947
• fix(utils): keep project-dotenv tool-config and sibling injection variables out of the bash tool by @10kH in #6920
• fix(coding-agent): strip terminal controls from tool tree and error lines by @Oreochococukie in 47e5d703e9
• fix(coding-agent): skip repository APPEND_SYSTEM.md at startup by @Oreochococukie in #6949
• test(coding-agent): fail startup prompt checks if session setup did not run by @Oreochococukie in f3b6469319
• fix(coding-agent): escape Hindsight mental-model frame delimiters by @Oreochococukie in #6950
• fix(coding-agent): keep escaped mental-model blocks inside the render budget by @Oreochococukie in c19237a925
• test(coding-agent): cover mental-model frame expansion through the loader by @Oreochococukie in 75cc53518c
• fix(ultragoal): recognize develop integration bases by @probepark in #6945
• chore(repo): retire obsolete plans and generated QA reports by @snowykr in #6951
• test(sdk): budget the deadline-start correlation race test by @Yeachan-Heo in #6952
• chore(tests): add reporting-only cleanup inventory (Phase 0) by @snowykr in #6954
• fix(coding-agent): reset the shell-config cache in the CI regression test by Yeachan-Heo in 3d1fdee8ac
• docs(utils): correct the spawn-environment comment after dropping the CI injection by Yeachan-Heo in 85d28b27cc
• fix(ultragoal): fall back to the checked-out branch as the integration base by Yeachan-Heo in 78d6395295
• test(coding-agent): drop the unused afterAll import from the bash CI regression by GJC in b69be72007
• fix(coding-agent): gate the Terax turn marker on the Terax host marker by @Yeachan-Heo in #6959
• fix(coding-agent): ignore project-dotenv session ids in native hook logs by @Oreochococukie in #6961
• test(ai): fold transport and context regressions into owning suites by @snowykr in #6960
• test(coding-agent): release the credential store when a session build is aborted by Yeachan-Heo in cdaa11018d
• fix(ultragoal): type stdin support for git text commands by @probepark in #6956
• fix(coding-agent): ignore a project compaction remote endpoint by @Oreochococukie in #6964
• feat(migrate): import Claude Code subagents by @Yeachan-Heo in #6963
• feat(sdk): per-session env and unsetEnv for broker-hosted sessions (#6735) by @cynkai in #6958
• fix(coding-agent): do not load project rules through an outside symlink by @Oreochococukie in #6965
• fix(coding-agent): keep contained discovery reads out of the shared cache by @Oreochococukie in 755a604e18
• fix(ai): scope usage-limit backoff to the model the limit names by @Yeachan-Heo in #6966
• feat(migrate): report source settings that cannot be imported by @Yeachan-Heo in #6967
• fix(tui): make host status markers opt-in for the host that reads them by @Yeachan-Heo in #6968
• fix(coding-agent): ignore a project receipt spool directory by @Oreochococukie in #6969
• fix(coding-agent): drop an untrusted receipt spool dir before owner handoff by @Oreochococukie in 8bac51a4d9
• fix(coding-agent): ignore project dotenv pins for tmux session identity by @Oreochococukie in #6972
• fix(ultragoal): admit the current-final ralplan approval ask by @Yeachan-Heo in #6970
• fix(sdk): withhold content frames from event replay while redaction is on by @Oreochococukie in 2de6470074
• fix(sdk): withhold content frames from event replay while redaction is on by @Oreochococukie in #6971
• feat(migrate): import Claude Code hooks as a runnable module by @Yeachan-Heo in #6973
• fix(session): keep resident text blobs out of Git worktrees by @Oreochococukie in #6974
• fix(natives): retry a denied exact-replace open within the bounded budget by Yeachan-Heo in b2d5e98897
• fix(web-search): prefer current GPT-6 Codex search models by @snowykr in #6979
• fix(coding-agent): keep git patch text off preexisting temp symlinks by @Oreochococukie in #6982
• test(coding-agent): assert a bounded project settings read is fresh by @Yeachan-Heo in #6980
• fix(ralplan): scrub credential shapes before hashing plan artifacts by @Oreochococukie in #6983
• fix(coding-agent): strip controls from commit-agent stdout by @Oreochococukie in #6984
• fix: mark tool-result images as untrusted before the provider request by @Oreochococukie in #6985
• fix(ai): escape orphan stale-tool-result notes by @Oreochococukie in #6986
• fix(coding-agent): keep generated images off preexisting temp symlinks by @Oreochococukie in #6987
• fix(update): refuse to replace a project dependency install by @Yeachan-Heo in #6988
• fix(coding-agent): keep browser screenshots off preexisting temp symlinks by @Oreochococukie in 5e1f2411f2
• test(coding-agent): accept either source-binding refusal for a swapped leaf by Yeachan-Heo in d5c935a12b
• fix(debug): refuse a symlink crash-diagnostics directory by @Oreochococukie in #6991
• fix(debug): chmod an unreadable diagnostics directory without following it by @Oreochococukie in 0a491edef7
• fix(debug): state the linux limit for an unreadable diagnostics directory by @Oreochococukie in d14d9ffa73
• fix(coding-agent): keep debug transcripts off preexisting temp symlinks by @Oreochococukie in #6999
• fix(coding-agent): encode git metadata in the commit analysis prompt by @Oreochococukie in #7004
• fix(coding-agent): escape whitespace in untrusted-content end tags by @Oreochococukie in #7006
• fix(coding-agent): keep the speech recorder script off preexisting temp symlinks by @Oreochococukie in e7a99cef95
• fix(coding-agent): keep the speech recorder script off preexisting temp symlinks by @Oreochococukie in #7007
• fix(session): prefer an equal id when resolving --resume by @Oreochococukie in #7008
• feat(sdk): add bounded private image staging with settlement-owned quotas by @snowykr in #6941
• fix(tui): reject non-base64 payloads in kitty and iTerm2 image escapes by @Oreochococukie in #7009
• fix(coding-agent): strip terminal escapes from MCP display names by @Oreochococukie in #7010
• fix(recipe): encode repository metadata in the tool description by @Oreochococukie in #7011
• fix(coding-agent): obfuscate secrets in session title prompts by @Oreochococukie in #7003
• fix(coding-agent): refuse eval when bash is restricted by @Oreochococukie in #7012
• fix(workflow): refuse planning writes through hardlink aliases by @Oreochococukie in #7020
• fix(coding-agent): frame SSH remote command output by @Oreochococukie in #7021
• test(coding-agent): satisfy ssh tool parameter types in the remote-output test by @Oreochococukie in c22790d7fc
• fix(coding-agent): keep full SSH output when the inline window is shorter by @Oreochococukie in 39ece9ff8f
• fix(test): synchronize startup continuation abort on stream consumption by @Yeachan-Heo in #7022
• fix(ci): stabilize bench-multisession-runner test with fixed project context time by @Yeachan-Heo in #7016
• fix(state): open workflow appends as owner-only files by @Oreochococukie in #7023
• fix(coding-agent): open token logs and harness state as owner-only files by @Oreochococukie in #7024
• fix(debug): write report bundles as mode 0600 and refuse a symlink by @Oreochococukie in #7025
• fix(customization): bind skill and hook import writes to the destination directory by @Oreochococukie in #7013
• fix(coding-agent): migrate models.yml as mode 0600 by @Oreochococukie in #7026
• fix(coding-agent): keep keybindings migration from widening file mode by @Oreochococukie in #7028
• test(python): intercept owner-only transcript writes by @Yeachan-Heo in #7029
• fix(coding-agent): publish explicit GitHub and read-url artifacts as mode 0600 by @Oreochococukie in #7031
• fix(monitor): escape stdout in untrusted notification frame by @snowykr in #7030
• test(coordinator): drop the dead journal spy in the wake masking test by @cynkai in #7033
• fix(sdk): ignore project dotenv for session-host cwd test seams by @Oreochococukie in #7034
• fix(utils): create rotating logs as owner-only by @Oreochococukie in #7036
• fix(session): open history database files as owner-only by @Oreochococukie in #7038
• fix(coding-agent): start MCP, LSP, linter, and DAP servers without project-dotenv hook variables by @10kH in 47e3727da0
• fix(session): clear checkpoint state when switching session files by @Oreochococukie in #7052
• fix(sdk): ignore project dotenv for the broker signal directory by @Oreochococukie in #7037
• fix(session): drop pending resolve when switching session files by @Oreochococukie in #7053
• test(ai): fold Xiaomi token-plan regressions into owning suite by @snowykr in #7054
• feat(mcp): add mcp.discoveryDeferAutoload to keep autoload tools behind tool search by @Dayoooun in #7002
• test(ai): fold Ollama context regressions into owning suite by @snowykr in #7056
• fix(daemon): bump Slack generation for forward-ported root publication wait by Yeachan-Heo in 737b5e35e8
• test(ai): fold DeepSeek replay regressions into owning suite by @snowykr in #7055
• fix(shell): quote the snapshot rc path before sourcing it by @Oreochococukie in #7059
• test(ai): fold MiniMax coding-plan payload repro into owner by @snowykr in #7062
• fix(coding-agent): do not run a repository Python from .venv by @Oreochococukie in #7064
• fix(coding-agent): reject workspace Python interpreters inside the workspace by @Oreochococukie in 74fd38d768
• test(ai): fold Gemini string prompt repro into alignment suite by @snowykr in #7065
• test(ai): fold Kimi expiry repro into refresh skew suite by @snowykr in #7066
• test(ai): fold custom xhigh repro into compatibility suite by @snowykr in #7063
• test(ai): fold MiniMax catalog repro into provider suite by @snowykr in #7068
• fix(runtime-mcp): withhold host env from approved project stdio servers by @Oreochococukie in #7071
• test(ai): fold tool-choice repros into compatibility suite by @snowykr in #7070
• fix(utils): strip HTML comments in one forward scan by @Oreochococukie in #7073
• test(ai): fold Go routing repro into catalog parity suite by @snowykr in #7074
• test(ai): fold MiniMax CN stream repro into thinking suite by @snowykr in #7075
• fix(session): name a managed directory that moved volumes (#6750) by @cynkai in #7076
• fix(sdk): preserve active Deep Interview identity after agent_end by @Yeachan-Heo in #7051
• test(ai): fold Anthropic proxy repro into request suite by @snowykr in #7072
• fix(extensions): ignore a project dotenv ooo executable by @Oreochococukie in #7077
• fix(runtime-mcp): default a missing MCP server type to stdio before the project env guard by @Oreochococukie in 93d465f554
• test(ai): consolidate Google thinking signature replay coverage by @snowykr in #7078
• test(ai): consolidate Vertex global endpoint coverage by @snowykr in #7079
• test(ai): consolidate empty tool choice serialization coverage by @snowykr in #7081
• test(ai): fold DeepSeek compatibility regressions by @snowykr in #7083
• fix(coding-agent): skip agent_end workflow refresh when no durable workflow is cached by @Yeachan-Heo in #7084
• test(ai): fold typed content parts into compatibility coverage by @snowykr in #7088
• fix(session): recover failed workflow hydration on ordinary turns by @snowykr in #7090
• fix(sdk): reclaim dead same-host session-index locks on broker startup by @Heyaaz in #7094
• fix(slack): reclaim the daemon's own expired root publication lease by Yeachan-Heo in 98cb96aaa7
• fix(test): abort startup continuation only after the stream read is pending by Yeachan-Heo in b08f8ff09c
• fix(runtime-mcp): drop shell values from every project MCP provider by @Oreochococukie in #7098
• test(sdk): avoid registry lookup in Linux session-index test by @Yeachan-Heo in #7097
• fix(session): drop deferred bash and python results on session switch by @Oreochococukie in #7100
• test(ai): colocate DeepInfra service-tier wire coverage by @snowykr in #7093
• fix(session): restore discovered models on resume by @Yeachan-Heo in #7104
• fix(sdk): frame MCP prompt text before it becomes the user prompt by @Oreochococukie in #7106
• fix(sdk): prevent concurrent deadline re-arming during agent_end processing by GJC Multisession in 1ba76a2e37
• test(sdk): deflake stale deadline callback capture (attribute by arming site) by @Yeachan-Heo in #7105
• refactor(cli): remove dead --smol/--slow role overrides and stale smol wording by @najy97 in #7109
• fix(utils): keep standalone redaction placeholders under credential labels by Yeachan-Heo in c875bb4301

New Contributors

• @cadpro-solutions-llc made their first contribution in #6872
• @toranalytics made their first contribution in #6913

Full Changelog: v0.18.12...v0.19.0