What's Changed

exec: reject heredoc file-write patterns in validate_heredocs (#1196, closes #1194): Implements a pre-scan phase that walks the command byte-by-byte with quote tracking. When a << token is found outside quoted regions, it scans backward to detect file-write patterns (cat > file, tee file, bare > / >> redirects) and returns INVALID_PARAMS immediately -- before any process is spawned. Users should use edit_overwrite for file writes. The existing heredoc structure validation continues unchanged as Phase 2. 11 new integration tests; no false positives on bitshift inside single-quoted awk programs or plain cat to stdout.
exec: extend heredoc FSM to cover subshells, process substitution, and variable commands (#1199, closes #1198): Extends scan_backward_for_file_write in validation.rs to handle the shell construct classes not covered by the initial fix: subshells ((cat > file << EOF)), process substitution (cat > >(proc) << EOF), command substitution (cat > $(echo file) << EOF), variable commands ($cmd > file << EOF), and additional file-write binaries (printf, dd, install, cp, mv). Adds a paren_aware_token inner function that walks backward through paren-grouped constructs to correctly identify file-path tokens, and extends the redirect branches to loop backward through all arguments after the operator. 7 new integration tests; no new dependencies (avoids supply-chain risk of archived crates like conch-parser).

exec_command: prefer JSON output flags in tool description (#1197, closes #1195): Appends one sentence to the exec_command tool description instructing models to prefer machine-readable JSON output flags for build, lint, and test commands. Placed in Tool.description -- the only surface that reaches every connected model and survives both MCP 2025-11-25 and the 2026-07-28-RC (which removes InitializeResult.instructions).

Full Changelog