v0.5.3

Misc

• Harbor Boost gains agentic modules: quickhop and deephop for web research, autocheck for deliverable audits, and diffscope for scoped file-change checks, with caveman and ponytail as response style modules.
• harbor launch --workflow routes coding agents through Boost module chains.
• harbor launch supports the grok CLI as a host tool.
• Faster Hugging Face downloads via hf_transfer.
• harbor hf cache is renamed to harbor hf cachedir, freeing hf cache to pass through to the official HF CLI.
• HF cache scans now rescue models the hub library misses, keep listing models when the cache scan throws, and llamacpp models without a slash in their ID can be removed.
• Boost read_url now validates every redirect hop, closing an SSRF vector in web research modules.
• Boost autocheck keeps failed or spoofed page reads out of its evidence, and the /caveman and /ponytail style commands only trigger in their own module.
• Boost token counting no longer stalls on multi-megabyte pathological inputs.
• harbor pull and other compose-backed commands now fail with a clear error when compose resolution fails, instead of running a bare docker subcommand.
• harbor up a b -t now tails logs for all requested services, not just the first.
• Assorted CLI fixes: doctor --check ordering, up --open target, and ui.main resolution for open/url/tunnel/qr.
• harbor pull handles mixed service/model/flag arguments correctly, routing flags like --no-defaults to the compose resolver instead of misreading them as model names.
• Host Deno runs no longer show update-check nags or send telemetry.
• The container test runner auto-runs the install suite when needed and works on Alpine, Arch, and Rocky; compose files can waive lint rules via x-harbor-lint-ignore.

Breaking: built-in Boost workflow presets and the keel/sightline modules were removed; the former caveman/ponytail research workflows are now quickhop/deephop.

Full Changelog: v0.5.2...v0.5.3