v0.5.0

Compatibility-breaking minor: symlink and Origin/Host hardening, plus numeric
config and SBOM field corrections. Migrations are under Breaking, Security,
and Fixed.

Breaking

• Security hardening changes compatibility for symlinked web UI assets and
  browser requests with mismatched Origin and Host. See Security below for
  the previous behavior and required upgrade steps.
• Numeric config validation now rejects previously accepted fractional integer
  settings and non-finite numbers. SBOM consumers using the old
  relationships field or base64 hashes must adapt to the corrected fields.
  See Fixed below for migrations for both changes.

Security

• Disk-backed web UI plugin assets, themes, and command catalogs no longer
  follow symlinks in files or parent directories. Previously those links could
  serve files outside the asset directory. Upgrade action: replace linked
  assets and linked directories with regular files and directories in their
  expected locations; refused assets return 404, and a linked themes/
  directory produces an empty theme catalog.
• Browser requests carrying Origin now require its authority to match the
  request's Host (case-insensitively), not merely another allowed address.
  For example, an Origin of http://localhost:4173 with Host
  127.0.0.1:4173 is now refused. Upgrade action: use the same hostname and
  port for the page and its API requests; reverse proxies must preserve the
  browser-facing Host and keep that hostname in the configured host allowlist.
  Requests without Origin retain their existing behavior.
• The schedule guest's filesystem grant is state/schedule.json and
  state/schedule/log.jsonl, not the state/schedule/ directory. Other files
  under that directory are no longer reachable from the guest. No migration if
  the tool only used those two paths.
• The skills guest no longer inherits [agent] tools_dir prefixes. It still
  reads skills/, state/skills.json, and [agent] skills_dir. Tools that
  need the tool directories keep their own grant.

Changed

• Successful /api/* responses log at debug, with request id, method, path,
  status, and duration. Info-level serve output is unchanged.

Fixed

• [improve] backlog = false now disables backlog seeding as documented.
  Previously the loader ignored the setting and kept the default true.
  Existing boolean settings need no migration; string values such as
  backlog = "false" must become backlog = false.
• Numeric configuration is validated instead of misparsed: a fractional
  integer setting (request_timeout_ms = 0.5) is refused rather than
  truncated to 0, and nan, inf, and overflowing float literals
  (1e9999) are refused where a number was expected. A config that loaded
  before with one of these values now fails at startup with a diagnostic
  naming the setting and a corrected example. Upgrade action: replace
  request_timeout_ms = 10.9 with request_timeout_ms = 10 to preserve its
  former truncated value, or choose the intended whole-millisecond deadline.
  Integral floats such as 60.0 remain accepted. Replace non-finite values
  with a finite value valid for the setting, or remove the override to use its
  default; see Configuration errors.
• Session replication reports the last committed cursor after rolling back a
  batch containing a sequence gap. Retrying from that cursor now includes the
  rolled-back events instead of skipping them.
• Knowledge search decodes URL-encoded queries and collection filters before
  forwarding them to the tool, so spaces, Unicode, and escaped punctuation
  search for the intended text. The web UI also discards stale search replies
  after the query changes.
• The generated SBOM (scripts/sbom.py, attached to GitHub releases as
  sbom.cdx.json) corrects its CycloneDX hash and dependency fields: hash
  entries carry algorithm names such as SHA-256 instead of sha256, with
  hex digests instead of base64, and the component graph is published under
  dependencies rather than the unrecognized relationships key. Consumers
  of the old fields must read dependencies, decode hashes[].content as hex,
  and accept the hyphenated uppercase algorithm names.
• The web UI configuration editor keeps edits made during an in-flight save
  marked unsaved, rather than treating text that was never submitted as saved.
• goal_update rejects task_add with an empty id or an id already present
  on that goal, instead of appending an unaddressable or duplicate task.
  Omit task_add.id to generate an id, or supply a non-empty id unique within
  the goal. Existing tasks are left unchanged when an add is refused.
• A goal-loop evaluator verdict without a usable reason no longer ends
  the loop: it is treated as continue and the loop keeps working. Only
  verdicts naming why they finished are accepted as achieved/blocked.
• An invalid chat subscribe <room> <value> is a usage error (exit 2) that
  changes nothing, instead of silently turning the subscription off. The
  accepted spellings are on/true/1/yes and off/false/0/no.
  Replace any other value previously used to unsubscribe with off; omitting
  the value still subscribes.
• Command and flag help, and --dump-config, now exit 1 when stdout cannot
  be written instead of reporting success after losing the requested output.
  A broken pipe still exits 0, preserving early-closing pipeline behavior.
• Workspace names, root names, and resolved root paths that are not valid
  UTF-8 are refused and leave state/workspaces.json unchanged.
• A failed or timed-out web UI vendor script load no longer sticks, so a
  retry can fetch the file again.
• Refreshing the system prompt no longer keeps temporary per-turn guidance
  from the previous turn.
• Rate-limit windows expire at the 60-second boundary instead of one second
  later.
• Goal-loop evaluator evidence is escaped and length-bounded before it is
  interpolated into the evaluator prompt.
• A time-seeded sandbox run records a replayable agent.seed value, and
  setting that seed reproduces the guest RNG stream.
• The TUI model picker says "no usable models" when none are configured, and
  points at clanker doctor, instead of treating that the same as a filter
  miss.