v1.5.18 — hardened local runtime

v1.5.18 — hardened local runtime

Security

• Escape model and file content inside fenced markdown code blocks in the frontend renderer, closing a stored XSS path in the chat transcript and artifact previews.
• Randomize temporary file names for secret-store and session-data writes so symlink attacks cannot target predictable temp paths.
• Replace O_TRUNC with O_EXCL on temp file opens and add failure cleanup so partial writes cannot silently corrupt the data store.
• Back up corrupted data.json and credentials.json to timestamped .bak files before resetting, instead of silently dropping all sessions and settings.
• Fail-closed on platforms without fs.constants.O_NOFOLLOW instead of silently disabling symlink protection.
• Preserve existing temp-file safety patterns already used by the MCP config writer as the model for all other local-file writes.

Reliability

• Validate Uniswap V3 addresses at startup and in prepareSwap so misconfigured or stale contract pins fail fast with a clear error.
• Add NFC normalization to intent regexes in safety.js so Unicode homoglyphs cannot bypass authorization boundaries.

Frontend

• Replace the agent status spinner with Claude-style animated thinking dots in lightblue.
• Ensure the model delivers finished work as real workspace files with download cards instead of pasting long content into chat.

Tests

• Add test/web-ui.test.js covering renderMarkdown XSS regression, inline code safety, link rendering, esc edge cases, and safeExternalHref security boundaries.
• Expand test/store.test.js with corruption-handling and UUID temp-file naming coverage.