@liustack/modlens 3.1.0 → 3.1.1

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 3.1.1 - 2026-08-07
+
+Fixes from a deep acceptance review (external audit, reproduced and verified here).
+
+- The isolated workdir now actually isolates. The "isolated copy" of a local image was a hardlink sharing the original's inode, so a provider writing its temp path mutated the user's file: it is now always a real 0600 copy, with a regression test asserting the original survives a provider that overwrites everything in its cwd. A remote image skipped isolation entirely and ran the agent in the caller's directory: it now gets an empty throwaway cwd, and the antigravity fallback is the tmpdir, never `process.cwd()`. `docs/security.md` states plainly that this is exposure reduction, not an OS sandbox, and that untrusted images are better served by an inline API provider.
+- Remote image downloads go through SSRF guards ported from modsearch. The old path called bare `fetch` on the user-supplied URL, so a URL pointing at loopback, RFC-private, link-local, or cloud-metadata addresses was downloaded and its bytes uploaded to the vision provider. Now the hostname is checked against a blocklist, every resolved address must be public, the connection is pinned to the exact validated IP via an undici dispatcher (closing DNS rebinding), and every redirect hop is re-normalized, re-validated, and re-pinned. There is deliberately no allow-private switch: for a genuinely local image the answer is a file path, and the error says so.
+- Schema validation has one source of truth. `missingSchemaFields` checked only that arrays existed, so `[42]` in `ocr.lines`, a string `reading_order`, and numbers in `uncertainty` all passed as evidence, and the runtime check required `visual` while the provider schema did not. The walk is now driven by `VISION_RESULT_SCHEMA` itself (types, array elements, enums, nested requireds, present-but-optional fields), and `visual` joins the schema's required list.
+- The launchers skip npx when node is below the CLI's 22.13 floor: an old node with a working npx used to be selected anyway, a path known to fail at run time. The diagnosis explains an unusable npx and reports `nodeMeetsFloor`, and the no-runtime next step names the actual node version. Doc wording is corrected: `doctor` spends no quota but the npx/bunx paths may download the pinned package on first use, and Bun cannot load `node:sqlite`, so OpenCode paste recovery on a bunx-resolved machine needs a real Node install.
+
 ## 3.1.0 - 2026-08-07
 
 - Windows joins the CI matrix (Node 22 and 24), so the CLI core, config, `doctor`, harness detection, and OpenCode paste recovery run on a real Windows runner rather than being assumed. The POSIX-only cases (subprocess signal handling, permission-bit assertions, and the Claude Code and Pi JSONL home-layout fixtures) are guarded with `describe.skipIf`, and the OpenCode path normalization from #11 now runs end to end on Windows, not only as an injected-path unit test. A `.gitattributes` pins text files to LF so the Windows checkout matches the other platforms and Biome does not fail on line endings.