v1.18.53

Fixes

• Preserve quoted Bash command arguments on Windows by passing the working-directory wrapper as one script to the process supervisor.
• Validate and normalize inputs before parallel and streaming-early tool execution, failing closed on invalid or context-sensitive inputs.
• Bound unterminated MCP SSE lines and event metadata before buffering.

Validation

• composer validate --strict
• composer audit --format=plain
• composer run lint
• composer test
• php scripts/sdk-bc-check.php --verify
• GitHub Actions main and tag tests (including Windows compatibility)