Ninety fixes in one wave
- Enforcement guards /freeze, /careful, and team-init required mode now block requests
- /careful asks on IFS/base64 obfuscation and fails closed on unreadable input
- Pre-push scanning implements --no-ext-diff/--no-textconv flags
- pair-agent walks through ngrok auth in user terminal
- /careful now parses tool payload with real JSON parser and handles quoted arguments
- Specialist review agents run with run_in_background: false
- Pre-push scanning improved with line-aligned chunked scans and real push-base resolution
- Pre-push scanning uses byte-exact stdin for chained hooks
- Pre-push scanning uses hunk-aware header parsing and fail-closed ref parsing
- diff upgraded to 9.0.0
- design/test/ joins free suite and sharded runner
- Investigate scope lock resolves check-freeze via $HOME
- Injection-denylist and phone-pattern false positives calibrated
- All delayed process.exit teardown bombs removed with static no-suicide tripwire
- Orphaned sidebar chat-queue suites removed
- Fork PRs skip eval jobs deterministically
- memory-ingest imports gitignored staging and reconciles counts
- Extension denies token/port reads to content scripts and foreign extensions
- OpenAI key file written 0600-at-create
Enforcement guards /freeze, /careful, and team-init required mode now actually block. /careful parses tool payload with real JSON parser, handles quoted arguments, asks on IFS/base64 obfuscation, fails closed on unreadable input. Investigate scope lock resolves check-freeze via $HOME. Specialist review agents run with run_in_background: false. Pre-push scanning improved with line-aligned chunked scans, real push-base resolution, byte-exact stdin for chained hooks, --no-ext-diff/--no-textconv, hunk-aware header parsing, fail-closed ref parsing. pair-agent walks through ngrok auth in user terminal. Extension denies token/port reads to content scripts and foreign extensions. diff upgraded to 9.0.0. OpenAI key file written 0600-at-create. Injection-denylist and phone-pattern false positives calibrated. All delayed process.exit teardown bombs removed with static no-suicide tripwire. design/test/ joins free suite and sharded runner. Orphaned sidebar chat-queue suites removed. Fork PRs skip eval jobs deterministically. memory-ingest imports gitignored staging and reconciles counts. lib/ ships beside bin/ on every host install. Native AskUserQuestion answers parse correctly with (Recommended) suffix support. Autoplan task aggregator returns real tasks. Auto-upgrade pulls with --autostash over locally-patched installs. gstack-slug resolves project root by marker walk-up and canonicalizes slash branches. Design image generation fixed with honest timeout reporting. Windows icacls grants by SID. windowsHide forwarded through every spawn shim. All plan-tune hooks spawn bins through shared Windows-aware helper. mktemp templates keep X-run trailing for /codex on macOS. codex review receives explicit diff args with timeouts. Review mode runs sandboxed read-only. Artifacts Sync and telemetry-finalize un-deadened in 49 skills. update_check:false silences preamble prose. Codex hosts read AGENTS.md. setup --help prints help. Model overlays for current Claude generation. Plus ~20 more small fixes for deploy-config, artifacts-init, keychain auth, catalog description, tracked-file tests, update-check, Ubuntu detection, CRLF generation, telemetry errors, server-lock diagnostics, shell-quoted paths, benchmark validation.