v0.0.63

[devsuitup]

Version bump for v0.0.63.

What's Changed

Bug Fixes

• Triggers are no longer refused on a session that is merely rendering. The composer is considered free after three quiet seconds, and that clock was being pushed by the terminal's own cursor-position replies — about twice a second while a session draws — so the window never opened on a busy session. Those replies no longer count as typing. (fix(triggers): exclude CPR/DECXCPR from the composer quiet clock #170)
• A trigger is never lost and never replayed, whatever fails. A removal that genuinely fails now leaves a trace instead of a file indistinguishable from one still waiting, and every path through the handler — an unwritable result, a throw from a polling tick, a throw from the logger — ends in a single exit that writes a result and deletes the trigger. (fix(triggers): stop swallowing a failed trigger removal #166)
• Trigger results stop claiming a confirmed submission when only activity was observed. The probe answered on its first tick with no reference sample, so a session already mid-turn confirmed a submission that may never have happened. A new activity level reports what is actually known; confirmed is reserved for a transport that re-reads the effect. Readers testing for confirmed now take their retry branch — strictly more cautious. (fix(triggers): stop reporting observed activity as a confirmed submission #168)
• The transcript viewer sanitises rendered markdown before it reaches the page. Escaping literal tags in the source text could not touch the HTML the markdown renderer builds itself, so a link or image written with a javascript: target survived into the DOM with its href intact. (fix(viewer): sanitize marked output in transcript renderer #169)
• Four IPC handlers that accept a renderer-supplied path or command gained real guards. "Run schedule now" read a file and spawned a process with no validation at all — the target must now resolve on disk to a schedule-*.md inside a known project's .claude/commands/. The sensitive-path and memory-path guards only normalised strings, so a symlinked directory could serve a file from outside an allowed root or hide ~/.ssh behind an innocuous name; both now resolve on disk before deciding, and the memory guard hands back the resolved path so the read or write lands where the check looked. preLaunchCmd, which previously rejected only newlines, is restricted to a closed character allowlist — this refuses bare $VAR expansion and quoted arguments, neither of which belongs to the documented prefix form. (fix(ipc): close path and command guard gaps on 4 handlers #180)

Features

• Triggers accept an optional expectedCwd. A writer declares the working directory it believes the target session runs in, and the transport refuses to write anything if the session disagrees or if its directory cannot be determined, reporting the two cases distinctly. Omit the field and behaviour is unchanged. This guards against a stale or racing session id delivering a command to a session that never asked for it. It does not separate two sessions running in the same folder. (feat(triggers): add an optional expectedCwd target guard #182)

Documentation

• The agent context files under .ai/ were corrected against the repository as it actually is: paths that never existed on this machine, stale file sizes and line numbers, and a trigger-watcher measurement protocol that the same section already disproved. The Linux AppImage warnings are kept and labelled as Linux-specific rather than deleted — they record real incidents whose underlying principle still applies. (docs: fix stale facts across .ai/ and README #179)

CI / Tooling

• The lint gate now actually runs in CI. The workflow invoked npm run coverage, and npm only chains pretest to test, so lint had never executed on a pull request; it is now its own job. The test matrix gains windows-2022 on Node 20 and 22 — the platform the app is developed on was the one platform never exercised. Adding it immediately surfaced a real defect: the activity trace signalled a finished stream on finish (data flushed) rather than close (file descriptor released), and Windows refuses to remove a directory still holding an open handle. Both that and the case of several retired streams closing at once are fixed, and waiting on a close is now bounded so a descriptor that never releases degrades instead of freezing the Diagnostics toggle. (ci(test): fix silent lint gate, add Windows to test matrix, tooling cleanup #181)