v5.5.7

Auto-released from merge of PR #941 (trigger: pull_request).

• Perf: skip the orchestration-tag scrub on message blocks that can't contain a tag. sanitizeMessages runs on every request (including byte-faithful CC traffic), and sanitizeContent applied all ~28 orchestration-tag regexes to every text block unconditionally. Every one of those patterns is anchored on a literal <, so a block with none — the common case: prose user turns, command/tool output — cannot match any of them. sanitizeContent now guards the loop with a single indexOf('<') check and skips straight to the trailing whitespace normalization when there's no <. On a realistic message mix this cuts the scrub's CPU ~80% (measured 5.85× on the loop) while producing byte-identical output — the loop is skipped only when it provably cannot change the string, and the whitespace-collapse/trim still runs for every block exactly as before. test/sanitize-messages.mjs adds a parity check asserting the guarded path matches the unconditional loop across tag-free and tag-bearing inputs, plus a guard that tag-free code containing a bare < comparison is preserved verbatim.

---

Built + tested + npm-published inline by cc-drift-auto-release.yml on this run — tokenless via OIDC trusted publishing, provenance-attested. See the workflow log for the publish output.