v0.15.0

Changelog

• debe4ad: ci: bump the github-actions group with 3 updates (#336) (@dependabot[bot])
• a1de167: ci: bump the github-actions group with 6 updates (#371) (@dependabot[bot])
• e4d5272: feat(compare): compare multiple offline runs with HTML and Markdown reports (#353) (@zpzjzj)
• cef9da3: feat(evaluator): expose task variant to runtime environment (#352) (@zpzjzj)
• 7e1cf69: feat(judge): add opt-in JSON file result delivery (#379) (@zpzjzj)
• 4234ca2: fix(action): restore temporary home permissions on exit (#373) (@zpzjzj)
• 9020c7c: fix(agent): reject API keys in custom engine local paths (#381) (@zpzjzj)
• 6f5ec5b: fix(agent): reject unfinished Qoder results and model fallbacks (#382) (@zpzjzj)
• 6fec8e9: fix(ci): reuse local CI caches and separate release caches (#344) (@zpzjzj)
• ca276f5: fix(cli): read evals.json files from the Skill root (#372) (@karanb192)
• 2405922: fix(codex): approve installed MCP servers under the local sandbox (#362) (@karanb192)
• e4a41d7: fix(codex): keep code-tool calls in session transcripts (#361) (@karanb192)
• f2d726e: fix(codex): look up session files under CODEX_HOME (#364) (@karanb192)
• 2143d2d: fix(config): reject whitespace-only prompt and turn content (#338) (@BiBoyang)
• 9da02ce: fix(config): strictly decode eval and selected case YAML (#375) (@karanb192)
• 45f15f9: fix(deps): align Go 1.26 and DSH dependency upgrades (#331) (@zpzjzj)
• b71d706: fix(e2e): avoid SIGPIPE in mock prompt matching (#356) (@zpzjzj)
• bd99815: fix(evaluator): isolate uploaded patches between cases (#376) (@karanb192)
• 45e9c72: fix(mcp): normalize bare environment references for adapters (#374) (@karanb192)
• ad5f533: fix(report): disclose recovered agent judge calls (#332) (@huong8373tt-beep)
• b3c8f3f: fix(security): resolve dependency and code scanning alerts (#355) (@zpzjzj)
• 1cc9f0e: fix(skill-upper): bound scaffolding and accept preservation checksums (#330) (@zpzjzj)