* fix(security): char-safe truncation in sanitize_system_prompt Fixes #1721
Replace byte-slice truncation prompt[..MAX_PROMPT_LENGTH] with
prompt.chars().take(MAX_PROMPT_LENGTH).collect() to prevent panic
when MAX_PROMPT_LENGTH falls inside a multi-byte UTF-8 character.
Adds test_sanitize_multibyte_boundary to verify correct behaviour.
* trigger: rebuild after repo cleanup
* fix(clippy): remaining field-reassign-with-default and unnecessary cast Refs #1721
* trigger: rebuild with clean repo
* trigger: rebuild webhook test
* trigger: full-clone pipeline test Refs #1721
* trigger: pipeline test with full clone Refs #1721
* trigger: depth=1 fetch pipeline test Refs #1721
* ci: e2e pipeline test from local Refs #1721
* ci: selective refspec pipeline test Refs #1721
* ci: final pipeline test with webhook ready Refs #1721
* style: cargo fmt for role_llm_api_key test Refs #1721
* fix: remove accidentally committed project.rs Refs #1721
* ci: fresh clone pipeline test Refs #1721
* fix(build-runner): tee output to file and fix BUILD.md parsing
- Redirect all command output through tee to build-output.log
- ADF agent runner truncates stderr at ~8KB, hiding clippy/build/test results
- Fix parse_build_md: was concatenating lines without newlines
- BUILD_LOG set to $ADF_WORKING_DIR/build-output.log per run
Refs #1721
* feat(config): implement project-level config discovery for .terraphim/
- Add project.rs with discover() function that walks up from cwd to find .terraphim/
- Change global_shortcut from String to Option<String> in Config
- Add merge_with() and with_project() methods to ConfigBuilder
- Update TuiService::new to accept no_project_config parameter
- Add merge_project_config() helper that discovers and merges project config
- Update all call sites and tests to use new signatures
Refs #1674
* feat(config): implement project-level config discovery for .terraphim/
- Add project.rs with discover() function that walks up from cwd to find .terraphim/
- Change global_shortcut from String to Option<String> in Config
- Add merge_with() and with_project() methods to ConfigBuilder
- Update TuiService::new to accept no_project_config parameter
- Add merge_project_config() helper that discovers and merges project config
- Update all call sites and tests to use new signatures
Refs #1674
* fix(config): remove needless borrows in project.rs clippy warnings
- cargo clippy -D warnings caught &real.join() where real.join() works
- Affects create_dir_all and canonicalize calls in test
Refs #1721
* docs: update project-level config discovery documentation
- Add project-level config discovery section to terraphim_config summary
- Update main summary.md with new ProjectConfig type and discovery feature
- Add release announcement to .docs/releases/v2026.05.19.md
Refs: project config discovery feature (commits 59cd233b7, 26f5b8728)
* fix(security): char-safe truncation in sanitize_system_prompt and build-runner fixes
- Replace byte-indexed prompt truncation with .chars().take() to prevent
UTF-8 byte-boundary panic in sanitize_system_prompt (Fixes #1721)
- Add test_sanitize_multibyte_boundary test for char-safe truncation
- Implement project-level config discovery for .terraphim/ directories
- Fix build-runner-llm.sh: pipefail for correct exit codes,
tee output to build-output.log (ADF truncates stderr),
fix parse_build_md command extraction
- Fix clippy warnings: needless_borrows_for_generic_args in project.rs,
unnecessary_cast in llm_bridge.rs, field-reassign-with-default in config
- Revert incorrect TuiService::new(None, false) to TuiService::new(None)
- Fix global_shortcut Option<String> consistency across test files
- Mark LLM bridge integration tests as #[ignore] (require live client)
Refs #1721
* docs: add release announcement for v2026.05.19
Refs: release v2026.05.19
* chore: bump version to 1.19.1 for release
* chore: bump version to 1.19.2
---------
Co-authored-by: forge-admin <admin@terraphim-forge.local>
Co-authored-by: Alex <alex@example.com>
