caveman v2.4.0

Caveman 2.4.0 closes the full weekly issue and PR queue with adversarial review, targeted fixes, and release-grade validation.

Highlights:

• Hardened proxy redirect, authentication, cancellation, and TLS behavior.
• Request-scoped MCP recovery and per-session native-runtime locking.
• Safer Windows hooks and lifecycle handling.
• Stronger compression masking, isolation, accounting, and semantic doctor checks.
• Integrated accepted contributor work with explicit attribution and closure messages.
• Restored documented caveman --version behavior.

Artifacts:

• CLI: npm install -g @caveman-ai/cli@1.3.1
• Signed binaries: bin-v1.1.4

Validation:

• Full CLI suite: 665 tests, 647 passed, 18 skipped, 0 failed.
• Required Linux, macOS, Windows, Go, TypeScript, Python, extension, and root CI passed.
• Clean npm install, signed-binary checksum verification, direct wrap, compression, and byte-exact retrieval smoke passed.

What's Changed

• fix(proxy): scope repo intelligence to project source and require direct evidence by @JuliusBrussee in https://github.com/JuliusBrussee/caveman/pull/901
• fix: harden weekly integrations and prepare v2.4.0 by @JuliusBrussee in https://github.com/JuliusBrussee/caveman/pull/929
• fix(hooks): handle stdout/stderr 'error' in UserPromptSubmit hook by @AmirF194 in https://github.com/JuliusBrussee/caveman/pull/795
• fix(cli): honour HTTP_PROXY/HTTPS_PROXY for outbound requests by @dylanneve1 in https://github.com/JuliusBrussee/caveman/pull/889
• fix(compress): block sensitive directory names by @CooperSheroy in https://github.com/JuliusBrussee/caveman/pull/891
• chore(skills): shorten skill descriptions to fit the listing budget by @smoochy in https://github.com/JuliusBrussee/caveman/pull/898
• fix(stats): add Claude 5 model output pricing by @SomSamantray in https://github.com/JuliusBrussee/caveman/pull/900
• fix: scope caveman mode to the session by @pavel-collab in https://github.com/JuliusBrussee/caveman/pull/904
• fix(codex): remove deprecated hooks alias by @cuddy-five in https://github.com/JuliusBrussee/caveman/pull/927
• fix(installer): avoid CLI bin collision by @pttydou in https://github.com/JuliusBrussee/caveman/pull/928
• fix(compress): serialize concurrent compress runs with a cross-session lock by @hunleyd in https://github.com/JuliusBrussee/caveman/pull/798
• fix(cli): support documented version flag by @JuliusBrussee in https://github.com/JuliusBrussee/caveman/pull/930

New Contributors

• @dylanneve1 made their first contribution in https://github.com/JuliusBrussee/caveman/pull/889
• @CooperSheroy made their first contribution in https://github.com/JuliusBrussee/caveman/pull/891
• @smoochy made their first contribution in https://github.com/JuliusBrussee/caveman/pull/898
• @SomSamantray made their first contribution in https://github.com/JuliusBrussee/caveman/pull/900
• @pavel-collab made their first contribution in https://github.com/JuliusBrussee/caveman/pull/904
• @cuddy-five made their first contribution in https://github.com/JuliusBrussee/caveman/pull/927
• @pttydou made their first contribution in https://github.com/JuliusBrussee/caveman/pull/928
• @hunleyd made their first contribution in https://github.com/JuliusBrussee/caveman/pull/798

Full Changelog: https://github.com/JuliusBrussee/caveman/compare/v2.3.1...v2.4.0