Release v1.7.5 · BourbonDog/amicus

What's Changed

Long prompts no longer truncate on Windows: The amicus_start and amicus_continue MCP handlers passed prompts inline via command-line arguments, which silently truncated once exceeding Windows's ~32 KB limit. Both now write prompts to a briefing.md file in the session directory and pass --prompt-file instead, preventing data loss on Windows systems.
SDK error responses are now visible: The getMessages function masked error-shaped responses that lacked a data array, making them indistinguishable from "zero messages" in the poll loop. It now logs warnings with session ID and error details while still returning an empty array as expected.
Path traversal attacks on session IDs are blocked: getSessionDir now validates task IDs to ensure they cannot escape the sessions directory, adding a defense-in-depth containment check consistent with other parts of the codebase.
Cross-platform OpenCode key discovery: The auth.json import path was previously hardcoded to the Unix XDG location. It now probes $XDG_DATA_HOME, ~/.local/share, and %APPDATA% (Windows) in order, using the first path that exists.

Fold-completion marker is harder to spoof: A bare [SIDECAR_FOLD] marker appearing mid-output (e.g. when a model reproduces instructions or summarizes a prior session) no longer forces a premature fold. The marker now only completes a run when it is the final non-empty line of output, with existing idle and timeout fallbacks preventing hangs.
Conversation mirror buffer is bounded: The in-memory tool-call buffer is now capped at 2000 entries with a separate dedup set, preventing unbounded growth in long tool-heavy sessions.
Unknown --no-* flags are safer: They are now treated as boolean flags and no longer consume the following positional argument, preventing accidental command corruption. Inline syntax like --no-x=value still works as expected.
Prompt file validation is order-independent: validateStartArgs now resolves the prompt source itself, eliminating dependency on resolution order and making the validation logic self-contained.

Clarified token estimation approach: Corrected documentation noting that tiktoken is declared but currently unused, with token sizing relying on a simple length/4 heuristic. Added caveat comments at both estimators documenting the intentional floor vs. ceil difference.

Full Changelog: v1.7.4...v1.7.5