v4.8.0

Minor. The security pass an agent self-invokes — design → scan → remediate in the same session, zero tokens. Closes the trio of controls born from field convergence with how a payments processor operates AI agents.

Added

• kj audit --security — the security pass an agent self-invokes (KJC-TSK-0695): a focused deterministic audit (zero tokens) that runs the prompt-injection scan + OSV + Semgrep + Sonar and skips everything else (basal-cost, webperf, madge, knip, ai-slop, harness, LLM). The injection scan now covers the agent-context surface — CLAUDE.md/AGENTS.md/GEMINI.md, .cursorrules, .github/copilot-instructions.md, templates/, .rulesync/ — on top of .karajan/**: whatever lands in the host agent's context every session is the real injection vector. The playbook and kj brief security now order the agent to run it and remediate BEFORE requesting review whenever a task touches auth, user input, secrets, network or deps. Closes the Akua trio (self-invocable continuous pentest). Fix ride-along: a bare boolean --security no longer collides with the global --security <provider> role override (provider overrides must be strings).

Minor. Least privilege for agents — a subprocess gets what its function requires and nothing more, and every new tool is a conscious access. Two controls born from convergence with how a payments processor operates AI agents safely.

Added

• Env allowlist for agent subprocesses (KJC-TSK-0693): spawned agents (coder/reviewer/tester CLIs) no longer inherit the user's whole environment — only system essentials, the CLI's own auth/config families, and KJ_* lane vars. Cloud keys, registry tokens and DB URLs never reach the child, so a compromised agent or injected prompt cannot exfiltrate what it never received. Per-agent extras (GITHUB_*/GH_* only for copilot); escapes: security.env_passthrough (names or trailing-* globs) and security.env_allowlist: false. Inspired by Akua's "temporary credentials, never a shared master key" control.
• AI-surface inventory in kj check (KJC-TSK-0694): the project's reachable MCPs (project .mcp.json, ~/.claude.json scoped to this project, codex and gemini configs) are inventoried on every check; the first run records a baseline silently, later runs flag what APPEARED — NEW since last check: x — approved by you? — and what is gone. A nudge, never a gate: every new tool an agent gains is one more access, and an inventory nobody reconciles is the feeling of control without the control.