v0.7.18

What's Changed

• docs(meta-skill): complete convert-marketplace agents/hooks/sync guidance by @aaronbassett in #528
• fix(provider): cap HTTP response body read at 16 MiB to prevent OOM by @aaronbassett in #531
• fix(harness): bound hook-dispatcher stdin read at 1 MiB to prevent OOM by @aaronbassett in #530
• fix(workspace): global-config guard on macOS + no-panic on best-effort path (#519) by @aaronbassett in #532
• fix(index): make embedder-identity meta writes atomic (issue #516) by @aaronbassett in #533
• fix(catalog): scope advisory lock to refresh_one span only (issue #512) by @aaronbassett in #534
• fix(harness): add symlink guard before read_manifest in reconcile_dispatch_manifest write branch (#517) by @aaronbassett in #535
• fix(harness): write Claude Code MCP config to .mcp.json (issue #496) by @aaronbassett in #536
• docs(harness): document TOCTOU bound in remove_tome_op and merge_decisions reason policy by @aaronbassett in #537
• docs(index): document exact-scan design decision in build_knn_sql by @aaronbassett in #538
• fix(build): anchor frontmatter key match, skip symlinks in collect_files, wrap check-doc-drift reads by @aaronbassett in #540
• refactor(mcp): dedupe bounded truncation helper; resolve Paths once in main by @aaronbassett in #541
• fix(authoring): normalize wrapped hooks.json on convert/sync (closes #522) by @aaronbassett in #539
• feat(authoring): dry-run file inventory + create scaffold for commands/agents/hooks/MCP by @aaronbassett in #542
• fix(authoring): warn on unrecognised plugin-root dirs (closes #523) by @aaronbassett in #543
• fix(lint): close blind spots vs harness sync — mcp.json, agent-spec, HooksSpec (closes #526) by @aaronbassett in #544
• fix(authoring): add missing mcp_json field to scaffold initialisers; regenerate CLI surface contract (closes #545) by @aaronbassett in #546
• fix(site): skip description continuation lines in CLI surface generator (closes #547) by @aaronbassett in #548
• fix(authoring): preserve agent frontmatter through convert + warn on unresolved tokens (closes #525) by @aaronbassett in #549
• fix(authoring): flatten CC nested command/agent subdirs + honour componentPaths overrides (closes #524) by @aaronbassett in #550
• chore: release v0.7.18 by @aaronbassett in #529

Full Changelog: v0.7.17...v0.7.18