@nathapp/nax 0.28.0 → 0.29.0

package/docs/hook-lifecycle-test-plan.md

@@ -1,149 +0,0 @@
-# Hook Lifecycle Integration Test Plan
-
-## Audit Summary (2026-02-19)
-
-### Wiring Status
-
-| Hook Event | Wired | Fire Points |
-|:---|:---|:---|
-| `on-start` | ✅ | Run begins (runner.ts:97) |
-| `on-story-start` | ✅ | Before each story (runner.ts:252, 602) |
-| `on-story-complete` | ✅ | After story passes (completion.ts:71) |
-| `on-story-fail` | ✅ | After story fails/exhausts retries (runner.ts:358, 413, 434) |
-| `on-pause` | ✅ | Cost limit, max iterations, user pause (runner.ts:236, 327, 455, 511, 526) |
-| `on-resume` | ❌ | **Not wired** — no resume flow exists yet |
-| `on-session-end` | ❌ | **Not wired** — no agent session lifecycle tracking |
-| `on-complete` | ✅ | All stories done (runner.ts:167) |
-| `on-error` | ❌ | **Not wired** — no global error handler fires it |
-
-### Bugs / Issues Found
-
-1. **BUG-13: `on-resume` never fires** — no resume mechanism exists in headless mode
-2. **BUG-14: `on-session-end` never fires** — agent session completion not tracked at hook level
-3. **BUG-15: `on-error` never fires** — unhandled errors crash without hook notification
-4. **ISSUE: `on-pause` fires for 5 different reasons** — should context distinguish pause types?
-
----
-
-## Integration Test Plan
-
-### Test File: `test/hooks-integration.test.ts`
-
-### Setup
-- Create a mock hook script that logs events to a temp file
-- Use minimal PRD with 2 stories (1 pass, 1 fail)
-- Mock Claude agent to return controlled output
-- Verify hook fire order and context by reading the log file
-
-### Test Cases
-
-#### 1. Happy Path — Full Lifecycle
-```
-Expected hook order:
-  on-start (feature=test-feature)
-  on-story-start (storyId=US-001)
-  on-story-complete (storyId=US-001, status=pass)
-  on-story-start (storyId=US-002)
-  on-story-complete (storyId=US-002, status=pass)
-  on-complete (status=complete, cost>0)
-```
-
-#### 2. Story Failure — Escalation Path
-```
-Expected hook order:
-  on-start
-  on-story-start (storyId=US-001)
-  on-story-fail (storyId=US-001, status=fail, reason=tests_failed)
-  on-story-start (storyId=US-001)  // retry
-  on-story-fail (storyId=US-001)   // exhausted
-  on-complete (status=complete)
-```
-
-#### 3. Cost Limit Pause
-```
-Expected hook order:
-  on-start
-  on-story-start
-  on-story-complete
-  on-pause (status=paused, reason=cost_limit)
-```
-
-#### 4. Max Iterations Pause
-```
-Expected:
-  on-start
-  on-story-start (repeated)
-  on-pause (reason=max_iterations)
-```
-
-#### 5. Hook Failure Doesn’t Block Pipeline
-```
-Given: on-story-start hook exits with code 1
-Expected: Pipeline continues, warning logged, story still executes
-```
-
-#### 6. Hook Timeout Doesn’t Block Pipeline
-```
-Given: on-story-start hook hangs for >5s
-Expected: Hook killed after timeout, pipeline continues
-```
-
-#### 7. Context Data Accuracy
-```
-Verify for each hook:
-  - feature name matches
-  - storyId matches current story
-  - cost is accumulated (not per-story)
-  - model matches current tier
-  - iteration number is correct
-```
-
-#### 8. Disabled Hook Skipped
-```
-Given: on-story-start.enabled = false in hooks.json
-Expected: Hook not executed, no log entry
-```
-
-#### 9. Missing Hooks Graceful
-```
-Given: hooks.json has only on-start defined
-Expected: All other events silently skipped
-```
-
-### Missing Hook Implementation (v0.8)
-
-#### `on-error` — Wire into global error handler
-```typescript
-// In runner.ts, wrap main loop in try/catch:
-try {
-  // ... pipeline loop
-} catch (err) {
-  await fireHook(hooks, "on-error", hookCtx(feature, {
-    status: "error",
-    reason: err.message,
-  }), workdir);
-  throw err;
-}
-```
-
-#### `on-session-end` — Wire after agent process exits
-```typescript
-// In pipeline after agent spawn completes:
-await fireHook(hooks, "on-session-end", hookCtx(feature, {
-  storyId: story.id,
-  status: exitCode === 0 ? "success" : "failed",
-  model: currentModel,
-}), workdir);
-```
-
-#### `on-resume` — Wire when interactive resume happens
-```typescript
-// In TUI resume handler (not applicable in headless):
-await fireHook(hooks, "on-resume", hookCtx(feature, {
-  status: "resumed",
-}), workdir);
-```
-
----
-
-*Plan created 2026-02-19*

package/docs/releases/v0.11.0-and-earlier.md

@@ -1,20 +0,0 @@
-# v0.11.0 and Earlier
-
-## v0.11.0 — Plugin Integration + Parallel Execution (2026-02-27)
-
-8 plugin stories + TDD state-sync fix + test regressions fixed.
-Worktree-based parallel execution: WorktreeManager, MergeEngine, ParallelDispatcher, `--parallel` flag.
-
-## v0.10.0 — Prompt Optimizer + Global Config
-
-Rule-based prompt optimizer, global `~/.nax/config.json`, model config consolidation.
-
-## v0.9.x — LLM Routing + Isolation
-
-LLM-based story classification, routing chain (keyword → LLM → adaptive), isolation verification between TDD sessions.
-
-## v0.5.0–v0.8.x — Core Pipeline, TDD, Verification, Structured Logging
-
-Core execution loop, three-session TDD, test verification, batch execution, cost tracking.
-
-*(See git tags for full history)*

package/docs/releases/v0.12.0.md

@@ -1,15 +0,0 @@
-# v0.12.0 — Structured Logging (2026-02-27)
-
-Human-friendly output, `nax status`, `nax logs`, crash recovery.
-
-**24 pts total · 7 stories**
-
-| Story | Title | Pts |
-|:---|:---|:---|
-| US-001 | Project resolver (CWD + -d) | 2 |
-| US-002 | Logging formatter | 5 |
-| US-003 | status.json writer | 3 |
-| US-004 | `nax status` command | 3 |
-| US-005 | `nax logs` command | 5 |
-| US-006 | Integrate formatter into runner | 3 |
-| US-007 | Crash recovery (signals, heartbeat) | 3 |

package/docs/releases/v0.13.0.md

@@ -1,14 +0,0 @@
-# v0.13.0 — Precheck (2026-02-27)
-
-Fail-fast validation before story execution. `nax precheck` CLI command. Config-driven review commands. PRD auto-default + router tags fix.
-
-**14 pts total · 6 stories**
-
-| Story | Title | Pts |
-|:---|:---|:---|
-| US-001 | Precheck types and check implementations | 3 |
-| US-002 | Precheck orchestrator | 3 |
-| US-003 | CLI `nax precheck` with `--json` | 2 |
-| US-004 | Integrate precheck into `nax run` | 2 |
-| US-005 | Config-driven review commands | 3 |
-| US-006 | PRD auto-default + router tags fix | 1 |

package/docs/releases/v0.14.0.md

@@ -1,20 +0,0 @@
-# v0.14.0 — Failure Resilience (2026-02-28)
-
-Improve nax success rate before adding more features. Greenfield detection, auto-switch to test-after, escalation counter fixes.
-
-**19 pts total · 6 stories**
-
-| Story | Title | Pts | Commit |
-|:---|:---|:---|:---|
-| US-001 | BUG-010: Greenfield detection → force test-after | 3 | `ea250f1` |
-| US-002 | BUG-009: Cross-story regression gate (test-after) | 5 | `dff27f2` |
-| US-003 | BUG-006: Context auto-detection (contextFiles) | 5 | `7a8998d` |
-| US-004 | BUG-002: Orphan process cleanup (PID registry) | 3 | `5ce1cf0` |
-| US-005 | Strategy fallback: TDD → test-after on empty tests (S5) | 3 | `7586c12` |
-| BUG-011 | Escalation attempt counter reset on tier change | 2 | `fd8cc0f` |
-
-**Notes:**
-- BUG-011 re-fixed in `fd8cc0f` — post-pipeline escalation path (runner.ts:1164) was still incrementing attempts instead of resetting on tier change. Pre-iteration check (runner.ts:711) was correct; post-pipeline path was not.
-- S5 uses `escalateRetryAsTestAfter` flag (mirrors `retryAsLite` pattern). One-time switch — guarded by `testStrategy !== "test-after"` check.
-- Phase 1: 4 parallel worktrees (BUG-010/009/006/002). Phase 2: BUG-011 + S5 via claude-monitor.
-- `nax diagnose` CLI (originally US-006) deferred to v0.14.1.

package/docs/releases/v0.14.1.md

@@ -1,36 +0,0 @@
-# nax v0.14.1 — nax diagnose CLI
-
-**Released:** 2026-02-28
-
-## What's New
-
-### `nax diagnose` command
-Pure CLI diagnosis — no LLM, no agents. Reads existing run artifacts and produces a structured human-readable report.
-
-**Usage:**
-```bash
-nax diagnose [-f <feature>] [-d <workdir>] [--json] [--verbose]
-```
-
-**Output sections:**
-1. Run Summary — feature, last run time, status, stories passed/failed/pending, cost, commits
-2. Story Breakdown — per-story status, tier, strategy, pattern detected
-3. Failure Analysis — pattern name, symptom, fix suggestion for each failed story
-4. Lock Check — stale lock detection with fix command (`rm nax.lock`)
-5. Recommendations — ordered next actions
-
-**Failure patterns detected:**
-`GREENFIELD_TDD`, `TEST_MISMATCH`, `ENVIRONMENTAL`, `RATE_LIMITED`, `ISOLATION_VIOLATION`, `MAX_TIERS_EXHAUSTED`, `SESSION_CRASH`, `STALLED`, `LOCK_STALE`, `AUTO_RECOVERED`, `UNKNOWN`
-
-**Graceful degradation:** works without events.jsonl (falls back to PRD + git log).
-
-## Bug Fixes
-
-- **`projectDir` resolution**: `findProjectDir()` returns `<root>/nax/` — diagnoseCommand now correctly resolves to the project root (`path.dirname(naxSubdir)`), fixing "not a git repository" errors and double-nested feature paths.
-- **AC8 test timeout**: `bun x tsc --noEmit` timeout increased to 60s in acceptance tests.
-
-## Files Added
-- `src/cli/diagnose.ts` — main implementation
-- `src/commands/diagnose.ts` — commander wrapper
-- `test/integration/cli-diagnose.test.ts` — 12 integration tests
-- `nax/features/diagnose/acceptance.test.ts` — 8 acceptance tests

package/docs/releases/v0.14.2.md

@@ -1,51 +0,0 @@
-# v0.14.2 — E2E Test Hang Fix
-
-**Released:** 2026-02-28
-
-## Summary
-
-Patch release fixing infinite retry loop in E2E integration tests. Tests now complete within 60 seconds instead of hanging indefinitely.
-
-## Bug Fixes
-
-### BUG-008: E2E tests hang with infinite retry loop
-
-**Problem:** E2E integration tests (`test/integration/e2e.test.ts`) could hang indefinitely when mock agents entered an infinite retry loop. The `bun test --timeout=120000` timeout was ineffective because the hang occurred inside the test logic (above Bun's timeout layer).
-
-**Root Cause:**
-1. Mock agent had no iteration cap, allowing unlimited retries per unique prompt
-2. Verify stage had hardcoded fallback to `"bun test"` when no test command was configured
-3. Test config didn't explicitly disable quality checks, causing verification to run in temp environments
-
-**Solution:**
-1. **Mock agent iteration cap:** Added `maxAttempts = 5` and per-prompt attempt tracking to fail fast after 5 attempts
-2. **Verify stage guard:** Check `quality.requireTests` and test command existence before running verification
-3. **E2E test config:** Explicitly disable quality checks (`requireTests: false`, `requireTypecheck: false`, `requireLint: false`)
-4. **Escalation config:** Reduced tier attempts to 1 each (`fast: 1`, `balanced: 1`) for faster test execution
-
-**Impact:**
-- E2E tests complete in ~23 seconds (down from infinite hang)
-- All 5 E2E tests pass consistently
-- No impact on production code — changes isolated to test infrastructure
-
-**Files Changed:**
-- `test/integration/e2e.test.ts`: Mock agent iteration cap, test config hardening
-- `src/pipeline/stages/verify.ts`: Guard clause for skipping verification when tests not required
-
-## Testing
-
-All E2E tests pass without hanging:
-
-```bash
-bun test test/integration/e2e.test.ts --timeout=120000
-# ✓ 5 pass, 1 skip, 0 fail in 22.88s
-```
-
-## Version Bump
-
-- Package version: `0.14.1` → `0.14.2`
-- Changelog: Added BUG-008 fix to ROADMAP.md shipped table
-
----
-
-**Full Changelog:** https://github.com/nathapp/nax/compare/v0.14.1...v0.14.2

package/docs/releases/v0.14.3.md

@@ -1,174 +0,0 @@
-# nax v0.14.3 Release Notes
-
-**Release Date**: 2026-02-28
-**Focus**: Critical Security, Bug Fixes, and Code Quality Improvements
-
----
-
-## Overview
-
-This release addresses **all CRITICAL and HIGH severity findings** plus **11 MEDIUM severity findings** from the comprehensive code audit (docs/code-review-20260228.md). The audit reviewed 27,333 lines across 130 TypeScript files and identified security vulnerabilities, correctness bugs, memory leaks, and type safety issues.
-
-**Overall Grade Improvement**: C- → B-
-
----
-
-## CRITICAL Fixes
-
-### SEC-1: Hardcoded `--dangerously-skip-permissions` Now Configurable
-**Impact**: Eliminated security bypass that disabled all safety controls in every agent invocation.
-
-- **What Changed**: Added `execution.dangerouslySkipPermissions` config option (defaults to `true` for backward compatibility)
-- **Files Modified**:
-  - `src/config/schema.ts`: Added config field + Zod schema
-  - `src/agents/types.ts`: Added `dangerouslySkipPermissions` to `AgentRunOptions`
-  - `src/agents/claude.ts`: Read from config instead of hardcoding
-  - `src/pipeline/stages/execution.ts`, `src/tdd/orchestrator.ts`, `src/execution/post-verify.ts`: Pass config value to agent
-- **Migration**: Set `execution.dangerouslySkipPermissions: false` in config for safer mode
-
-### BUG-1: Crash Handler Captures Stale Cost/Iteration Values
-**Impact**: Crash recovery wrote incorrect data (always 0 for cost and iterations).
-
-- **What Changed**: Modified `CrashRecoveryContext` interface to use getter functions instead of snapshot values
-- **Files Modified**:
-  - `src/execution/crash-recovery.ts`: Changed interface to `getTotalCost: () => number`, `getIterations: () => number`
-  - `src/execution/runner.ts`: Pass `() => totalCost` and `() => iterations` getters
-- **Result**: Crash status files now contain accurate progress data
-
----
-
-## HIGH Severity Fixes
-
-### BUG-4: Parallel Execution Concurrency Limiter Broken
-**Impact**: Concurrency limit not enforced, leading to resource exhaustion.
-
-- **What Changed**: Remove completed promises from `executing` array in `finally` block
-- **Files Modified**: `src/execution/parallel.ts`
-- **Result**: `Promise.race()` now correctly waits for slots instead of resolving immediately
-
-### BUG-3: Massive Code Duplication with Divergent Fixes
-**Impact**: 765-line duplicate file `story-dispatcher.ts` with divergent bug fixes.
-
-- **What Changed**: Deleted dead code file
-- **Files Removed**: `src/execution/story-dispatcher.ts`
-- **Result**: Single source of truth eliminates divergence risk
-
-### BUG-2: TOCTOU Race in Lock File Acquisition
-**Impact**: Concurrent nax processes could corrupt PRD and waste money on duplicate runs.
-
-- **What Changed**: Use atomic file creation with `O_CREAT | O_EXCL` flags
-- **Files Modified**: `src/execution/helpers.ts`
-- **Result**: Proper exclusive lock prevents race conditions
-
-### MEM-1: Crash Handlers Never Unregistered
-**Impact**: Memory leak in library usage, accumulated handlers prevent GC.
-
-- **What Changed**: `installCrashHandlers()` now returns cleanup function
-- **Files Modified**:
-  - `src/execution/crash-recovery.ts`: Return cleanup function
-  - `src/execution/runner.ts`: Call cleanup in `finally` block
-- **Result**: Handlers properly cleaned up on exit
-
-### PERF-1: Unbounded LLM Routing Cache
-**Impact**: Cache grew unboundedly, could hold significant memory for large features.
-
-- **What Changed**: Implemented simple LRU with max 100 entries
-- **Files Modified**: `src/routing/strategies/llm.ts`
-- **Result**: Bounded memory usage, oldest entries evicted when full
-
-### ERR-1: Silent Error Swallowing in Plugin Loader
-**Impact**: Permission errors and disk failures silently ignored.
-
-- **What Changed**: Only catch `ENOENT`, re-throw other errors
-- **Files Modified**: `src/plugins/loader.ts`
-- **Result**: Failures properly propagate to caller
-
-### TYPE-1: Unsafe `as any` Cast (story-dispatcher.ts)
-**Status**: Fixed by BUG-3 (file deleted)
-
-### TYPE-2: Unsafe `as any` Cast in Execution Stage
-**Impact**: Dead code path checking non-existent `tdd.enabled` field.
-
-- **What Changed**: Removed dead code
-- **Files Modified**: `src/pipeline/stages/execution.ts`
-- **Result**: Eliminated unsafe type cast
-
----
-
-## MEDIUM Severity Fixes
-
-### BUG-5: getAllReadyStories Includes Failed/Paused Stories
-**Impact**: Failed/paused/blocked stories incorrectly included in "ready" list.
-
-- **What Changed**: Added explicit status filtering
-- **Files Modified**: `src/execution/helpers.ts`
-- **Result**: Only truly ready stories are processed
-
-### BUG-7: PRD Array Mutation Violates Immutability Rules
-**Impact**: Direct mutation violates project coding standards.
-
-- **What Changed**: Use spread operator for immutable append
-- **Files Modified**: `src/execution/runner.ts`
-- **Result**: PRD updates follow immutability pattern
-
-### TYPE-3: Loose `ModelTier = string` Type
-**Impact**: No type safety, accepts any string (typos like "balacned").
-
-- **What Changed**: Use union type with extensibility: `"fast" | "balanced" | "powerful" | (string & {})`
-- **Files Modified**: `src/config/schema.ts`
-- **Result**: Autocomplete for known tiers, extensibility preserved
-
-### TYPE-5: OptimizerConfigSchema Mismatch
-**Impact**: Zod schema and interface enums didn't match.
-
-- **What Changed**: Aligned schema with interface: `["rule-based", "llm", "noop"]`
-- **Files Modified**: `src/config/schema.ts`
-- **Result**: Runtime validation matches type definition
-
-### SEC-3: Incomplete Hook Command Injection Prevention
-**Impact**: Sophisticated injection still possible (eval, curl | sh, python -c).
-
-- **What Changed**: Added 3 patterns to blocklist
-- **Files Modified**: `src/hooks/runner.ts`
-- **Result**: Broader injection protection
-
----
-
-## Deferred to v0.14.4
-
-The following MEDIUM-severity fixes require more extensive changes and are deferred to the next patch:
-
-- **SEC-2**: Path validation before plugin imports (requires path-security integration)
-- **SEC-4**: Environment variable allowlist for agent spawns
-- **SEC-5**: Path validation for constitution files
-- **ERR-2**: Replace console.* with getSafeLogger() in plugins
-- **ERR-3**: Add debug logs to empty catch blocks
-- **STYLE-4**: Remove emojis from log messages
-
----
-
-## Breaking Changes
-
-**None**. All changes are backward compatible. The `dangerouslySkipPermissions` config defaults to `true` to preserve existing behavior.
-
----
-
-## Testing
-
-- All existing tests pass
-- No regressions introduced
-- Manual validation of crash recovery, parallel execution, and lock acquisition
-
----
-
-## Contributors
-
-- Claude Opus 4.6 (code-reviewer agent) — comprehensive audit
-- Claude Sonnet 4.5 — implementation
-
----
-
-## References
-
-- Full audit report: `docs/code-review-20260228.md`
-- Roadmap: `docs/ROADMAP.md`

package/docs/releases/v0.14.4.md

@@ -1,94 +0,0 @@
-# v0.14.4 — MEDIUM Audit Fixes
-
-**Released:** 2026-02-28
-**Previous:** v0.14.3
-
-## Summary
-
-Resolves remaining **MEDIUM** severity findings from the comprehensive code audit (docs/code-review-20260228.md). Focuses on security hardening, error handling improvements, and code style consistency.
-
-## Fixes
-
-### Security
-
-**SEC-4** `agents/claude.ts:226` — **Environment variable allowlist for spawned agents**
-- **Issue:** All `process.env` variables leaked to spawned Claude Code agents
-- **Fix:** Created explicit allowlist in `buildAllowedEnv()`:
-  - Essential: `PATH`, `HOME`, `TMPDIR`, `NODE_ENV`
-  - API keys: `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`
-  - Prefixed: `CLAUDE_*`, `NAX_*`, `CLAW_*`, `TURBO_*`
-  - Plus model-specific and runtime env from options
-- **Impact:** Prevents sensitive environment variables from leaking to subprocesses
-
-**SEC-5** `constitution/loader.ts:77` — **Path validation before file reads**
-- **Issue:** Constitution files loaded without path traversal protection
-- **Fix:** Added `validateFilePath()` checks before reading global and project constitutions
-- **Impact:** Prevents path traversal attacks when loading constitution files
-
-### Error Handling
-
-**ERR-2** `plugins/loader.ts` + `plugins/validator.ts` — **Replaced console.* with logger**
-- **Issue:** 20+ `console.warn`/`console.error` calls bypass structured logging
-- **Fix:** Replaced all console calls with `getSafeLogger()?.warn/error()`
-- **Impact:** Consistent, structured error reporting across plugin system
-
-**ERR-3** Multiple files — **Debug logging in empty catch blocks**
-- **Issue:** Silent failures in empty catch blocks make debugging difficult
-- **Locations:** `agents/claude.ts:111,383`, `execution/verification.ts:38,168,185`
-- **Fix:** Added `logger?.debug()` calls with context for each empty catch
-- **Impact:** Improved observability for error scenarios
-
-### Code Style
-
-**STYLE-4** `tdd/orchestrator.ts` + `execution/helpers.ts` — **Removed emojis from logger messages**
-- **Issue:** Emoji in log messages (⚠️, ✅, ❌, 💰, ⏱️, 📊) can break log parsers
-- **Fix:** Replaced with text indicators:
-  - ✅ → `[OK]` or removed
-  - ⚠️ → `[WARN]`
-  - ❌ → `[FAIL]`
-  - Others → removed
-- **Impact:** Logs are now parser-friendly and terminal-agnostic
-
-## Test Updates
-
-Updated tests to reflect emoji removal from `formatProgress()`:
-- `test/unit/helpers.test.ts` — Progress format expectations
-- `test/integration/helpers.test.ts` — Integration test assertions
-
-### Lint Setup
-
-**LINT-1** Biome lint configuration and auto-fix
-- **Issue:** 124 lint violations across codebase (non-null assertions, explicit any, typeof issues)
-- **Fix:**
-  - Applied `biome check --write --unsafe` to auto-fix formatting and import sorting (44 files)
-  - Manually resolved remaining violations:
-    - 24 `noNonNullAssertion` errors → proper null checks and type guards
-    - 2 `noImplicitAnyLet` errors → explicit type annotations
-    - 1 `useValidTypeof` error → explicit type guard switch statement
-    - 1 `noAssignInExpressions` error → refactored regex loop
-    - 1 `noArrayIndexKey` error → better React key using content hash
-    - 1 `noForEach` error → replaced with `for...of`
-    - All `any` types → `unknown` or proper Record<string, unknown>
-- **Impact:** Zero lint violations, stricter type safety, better code quality
-
-### Test Timeout Improvements
-
-**BUG-18** Suite-level timeouts to prevent hanging tests
-- **Issue:** `bun test --timeout=120000` per-test timeout ineffective when test hangs above Bun's timeout layer (e.g. infinite loop in test setup, mock agent never returning)
-- **Fix:**
-  - Created `bunfig.toml` with global `test.timeout = 30000` (30s default)
-  - Set package.json test scripts to `--timeout=60000` (60s suite-level)
-  - Created `test/helpers/timeout.ts` utility for wrapping risky operations
-  - E2E tests override with longer timeouts via test options
-- **Impact:** Test suite can no longer hang indefinitely — completes in ~191s without hanging
-
-## Notes
-
-- Tests: 1801 pass, 10 skip, 5 fail (5 failures are pre-existing test infrastructure issues unrelated to v0.14.4 fixes)
-- No breaking changes
-- All CRITICAL and HIGH findings were resolved in v0.14.3
-- This release completes the MEDIUM-priority audit cleanup
-
-## Migration
-
-No migration required. Drop-in replacement for v0.14.3.