Quick Chat 1.0.3

Fixed

• Prevent assistant Markdown and provider model metadata from loading local or remote resources in QML.
• Render dynamic QML text explicitly and allow only http, https, and mailto links to open externally.
• Bound process and ACP lines, queues, events, response text, diagnostics, bridge records, and provider probe output.
• Make cancellation idempotent, preserve early cancellation, deny queued approvals after cancellation, and kill full provider process groups.
• Bound live transcripts, retry metadata, persisted messages, conversation count, history files, and quarantine storage.
• Enforce Pi's 4 MiB session limit before provider execution and prune Pi sessions by count and total size.
• Preserve first-party bridge schemas while rejecting oversized serialized events instead of silently truncating them.

Verification

• ./test/all (151 Python tests plus QML model and static checks)
• omarchy plugin validate .
• qmllint
• Python compile checks
• Secret and dangerous-process-pattern scan