v1.1.0 — Kimi (Moonshot) provider, long-context dream, variable ops TTL, security hardening

Added

• Kimi (Moonshot AI) provider — llm: kimi is now a first-class config option. Set MOONSHOT_API_KEY and the engine auto-configures against api.moonshot.cn/v1. Optionally override the model via llm_options.kimi_model (default: kimi-k2-0711-preview).
• Long-context dream strategy — DreamOptions.strategy: 'long-context' replaces the Phase 4 (Connect) N² pairwise edge discovery with a single LLM call that sees the full memory graph (up to 200 nodes + all existing edges). The model finds transitive patterns, cross-domain contradictions, and causal chains that the sequential approach structurally cannot detect. Works with any large-context model; long_context_memory_limit controls the cap (default: 200).
• Variable TTL for ops entries — ops_append now uses type-based expiry: log 90 days, instruction/handoff 14 days, milestone 180 days, decision 365 days. Previously all entries expired after 30 days.
• Expanded ops schema — ops_append accepts session_type, seed_type, blocked, next, instruction_meta, and handoff_meta fields. ops_query returns these fields. ops_update supports next and blocked.
• Thread creation warnings — thread_create now returns warnings when next_step or project is missing, guiding agents toward higher-quality thread creation.

Security

• Timing-safe authentication — REST server auth comparison uses crypto.timingSafeEqual to prevent timing attacks.
• Plugin path sandboxing — Plugin loader validates import paths against trusted directories, blocking loads from untrusted locations.
• REST tool blocklist — Destructive tools (forget, dream, evolve, resolve, thread_resolve) are blocked from the generic REST /api/tools/:name endpoint. They remain available via MCP (direct agent access).
• SQLite namespace validation — Namespace names must be alphanumeric/underscore only, preventing SQL injection via namespace parameter.
• Parameterized SQLite queries — LIMIT clause in ops queries is now parameterized instead of interpolated.
• API key config warning — config-loader warns when openai_api_key is found in config files instead of environment variables.

Full Changelog: v1.0.0...v1.1.0