v0.5.1 — TOML configuration parsing correction

Correct malformed Codex configuration handling

session-peer@0.5.1 pins smol-toml 1.9.1. Malformed exponent signs such as numeric_setting = 3e++20 are rejected instead of being accepted as a number. Doctor reports unknown / codex_config_unreadable; Codex dry-run/send refuse before queue submission when the configuration cannot be parsed. Valid exponent signs and explicit relocated-storage refusal are preserved.

This is a reproduced dependency correctness fix, not a claimed CVE remediation or demonstrated storage-relocation bypass. Other production, transitive and development dependencies are unchanged.

Compatibility

• SSH endpoints must use exactly the same TypeScript version: update both ends to 0.5.1 with their existing manager.
• The finite 0.5.1 metadata row accepts the same four skill profiles as 0.5.0; separate skill installation pins are unchanged.
• Linux/Windows native observation, Windows handoff storage/client jump and automated receipt ACK remain unsupported. Draft experiments, the deferred deployment harness and repository-only reporter are excluded.
• Queued/submitted/posted do not prove consumption or ACK. Unknown outcomes do not permit automatic resend.

Verification and publication

Source: 90481b148584926ea328ed956327f3050d9be9cb, from PR #164 / issue #163.

Two new regression tests fail with parser 1.9.0 and pass with 1.9.1. Full OS/Node checks, exact-source reproducible packing, isolated installation/config checks/removal, 77-member archive selection and all 18 packaged Markdown/source comparisons are verified in the release record. No new live-agent/native/model/ACK experiments or fleet/global upgrades are performed.

Reviewed/Actions/staged/public artifact SHA-256: 09ad128c3ced31fa263008abd8683f6b60d7593183b36b72b334c1463192221c.
Registry integrity: sha512-m+bXuJ0UpPYZQIwh9g9b11S2EqjquE1J0D2WYM3yOIGKk7s68AG05O1ARgKH5nK3QKidfHXgANmHAJQWJzkTrw==.

npm0.5.1 is public with latest=0.5.1; preview=0.1.0-preview.1 is preserved. Stage-only run40430300541 used this exact source. Protected GitHub npm environment approval and final user npm stage2FA approval were completed for stage 498574f9-5ea9-442c-b609-2ffec44867e5; no second upload occurred.

Public raw tarball SHA-256 and registry SHA-512 integrity match the reviewed local, retained Actions and staged archives. Pinned npm11.15.0 signature/provenance audit and a fresh isolated public install/version/empty discovery/removal passed. SLSA subject digest, repository/main, publish.yml, source SHA and invocation run linkage match the publication record. Exact-main CLI40429686245 and CodeQL40429686223 completed successfully.

The browser-only package publish-MFA settings read was explicitly skipped by the user for 0.5.1, so that setting was not freshly audited. Authenticated ownership, no pending stage and stage-only Trusted Publisher permissions were separately checked. Required protected-environment and actual final npm stage approvals remain independent human gates.