Release Date: 2026-04-12
Security Fixes
- sync-task.ps1: Fixed UTF-8 encoding corruption that caused complete script failure on Windows
- hook-post-tool-qwen.sh: Added realpath fallback (cd + pwd) for systems without GNU coreutils (macOS, minimal Linux)
- hook-post-tool-qwen.sh: Fixed secret scanner regex — now matches both quoted and unquoted values for secret|token|auth_key patterns
- hook-post-tool-ps1-qwen.ps1: Aligned secret patterns with .sh version — matches both quoted and unquoted values
- hook-pre-command-qwen.sh: Added python3 existence check with JSON fallback — prevents silent hook failure
- hook-session-end-ps1-qwen.ps1: Dynamic shell detection (pwsh preferred, falls back to powershell) — fixes silent failure on pwsh-only systems
- verify-commit.ps1: Added CODERULES.md and OPENCODERULES.md to router file list (was only in .sh version)
- .gitignore: Added .qwen/settings.json, .codex/, opencode.json, opencode.jsonc to prevent accidental commits of local configs
- changelog.yml: Fixed subshell variable scope bug — replaced pipe (echo | while) with process substitution (< <(echo))
- release.yml: Pinned softprops/action-gh-release to commit SHA for supply chain security
- setup.sh: Added --locked to cargo install for reproducible builds
New Features
- repo-map.sh: Zero-dependency code skeleton generator — scans 14 file types for class/function/interface signatures, excludes 11 junk directories. Saves 2,000-5,000 input tokens per read vs reading full
files.
- diff-editing.md: Token-efficient editing rules — forbids outputting full file contents, mandates sed for 1-liners and Python .replace() for multi-line changes.
- context-flush.md: Semantic context reset workflow — triggers on sub-task completion or component switch (not turn counting). Saves 80-90% per turn after flush.
- AGENT.md lazy-loading: Boot sequence now reads only memory-index.md, not full architecture-decisions.md or integration-contracts.md. Saves input tokens on every restart.
Refactoring
- Skills moved to `.agent/skills/`: 9 skills moved from .qwen/skills/ to client-independent location. .qwen/skills/ replaced with symlink.
- Commands moved to `.agent/commands/`: 4 commands moved from .qwen/commands/. .qwen/commands/ replaced with symlink.
- Project no longer appears Qwen-specific — skills and commands are now accessible to all 10 clients.
Documentation
- INSTALL.md: Added release download option as alternative to git clone (tar.gz download path)
- README.md: Updated architecture diagram to include all 16 scripts, updated client matrix to 10 clients, added version badge
- All docs: Updated to reference .agent/skills/ instead of .qwen/skills/
CI
- 21/21 CI steps passing (Run #96)
- Release pipeline: Automated GitHub Releases on v* tag pushes
- Changelog validation: Warns when PRs change code without updating CHANGELOG.md
- bump-version.sh: Helper script for semantic version tagging
Contributors
- AI Toolbox CI (automated)
- Comprehensive audits: 30 security findings, 38 code quality findings, ~65% test coverage
