v3.16.0

• dsh: whether a paste is taken over is now the host's call, made from real model metadata. The browser half used to guess with a name regex, which read every vision model it did not recognize (Qwen2.5-VL, GPT-4o, ...) as text-only and hijacked its native paste. And turning pasteToPath off only removed the host route while the client kept capturing pastes into a 404. The client now asks GET /modlens/paste?model=<selector label> and the host answers from the provider registry's declared inputModalities, with every unknown answered conservatively: the label carries no provider id, so EVERY model whose name or id appears in it must be confirmed text-only. One image-capable match anywhere vetoes, an unreadable provider catalog vetoes (the vision twin could live there), and missing modality metadata counts as unknown, never as text-only. Verdicts are re-asked on every composer focus and every paste, the host empties its own cache on every provider-topology change (a same-named vision route mounting mid-session is seen within one round-trip), a 60-second hard age bound backstops both, and a route that vanishes mid-session costs only the pastes inside the one round-trip it takes the failure to come back, after which the client forgets its verdicts and stands down. Until a model is positively confirmed text-only, pastes stay native. The paste route's magic-byte table now matches the CLI's signature for signature (a plain ftypmp42 video is refused instead of saved as paste.heic, real heic/heif brands pass), and the browser half gained its first test suite, loaded straight from dsh/client.js.
• A provider that ignores SIGTERM no longer outlives the CLI. The SIGKILL escalation timer was unref'd, so in a standalone run it died with the event loop and a stubborn provider process survived its parent indefinitely, found by independent review with a live repro. The timer is now ref'd and cleared by the child's own exit (normal runs pay nothing, the stubborn case at most the 2s grace), pinned by a test that drives the real spawn path from a genuinely independent parent process, because inside the test runner its own timers had been masking exactly this.
• config show and error text stop leaking proxy credentials. A proxy URL's userinfo (http://alice:s3cr3t@proxy) rendered verbatim in the one command whose contract is being safe to paste into an issue. It is now masked everywhere config show renders a proxy, and the shared redactor handles URL userinfo through the same WHATWG parser the runtime connects with, instead of a regex approximation: backslash authorities, slash runs, tabs inside the authority, and passwords containing @ all get their credentials removed in normalized form, while scheme-less //text@ prose and ordinary query @s stay verbatim.
• The release pipeline can no longer publish first and fail later. The tag workflow validated the CHANGELOG section only after npm publish. The notes are now extracted and verified before anything irreversible runs. And the release script's git push --follow-tags could deliver the tag while a stale main was rejected, triggering a release from a tree the remote branch never contained. It now syncs with origin first, refuses a behind or diverged main and an already-existing remote tag, and pushes branch and tag atomically, together or not at all.
• The gates got honest. pnpm lint always claimed to check dsh while the Biome config silently excluded it (now covered, with the plugin's own style rules); CI ran "Node 22" as latest-22.x while calling it the 22.19 floor (the matrix now runs the exact floor); and an Electron-runtime argv test pins the #25 fix against regression. Docs corrections ride along: both READMEs present the two paste flows as they actually ship, an empty provider is documented as the failover chain rather than a hardcoded antigravity pin, and the skill front matter carries the real 22.19 floor.