Changelog

All notable changes to the anti-hall plugin are documented here. The plugin pins an explicit version in plugin.json only (the authority); the marketplace entry carries no version to avoid the silent-precedence trap where plugin.json wins silently. Every behavioral change MUST bump plugin.json version or installed users will not receive the update.

0.300.2 (2026-10-10)

Engine update tool, security fixes and repo tidy.

Added

• ah-update: one command (hooks/ah-update.sh, no Node) moves the engine binary between sources: offline from a file (--from), the latest stable release (--channel stable) or the latest dev build (--channel dev), with sha256 checks and --rollback. The new engine.autoUpdate setting (off, stable, dev; default off) can run it for you at most once a day (#141).

Fixed

• Security: the markdown escapers in the handover and pre-compact snapshot hooks now escape the backslash first, so a backslash can no longer undo an escape (#133); the remaining engine workflow actions are pinned to commit SHAs (#134).
• Engine settings parity: the settings CLI knows engine.autoUpdate, and the parity goldens run in CI whenever the engine config or settings schema changes (#153).

Docs

• OpenSSF Best Practices badge in the README (#147).
• Engine docs match the shipped engine; new section on verifying release binaries (#135, #138).
• GUIDE, AH-ENGINE, PRIVACY and llms.txt describe ah-update and engine.autoUpdate; the repo-pipelines and contributing docs say Copilot is off by default.

Repo (no effect on the installed plugin)

• Repo root tidied: benchmark scripts moved from eval/ to tools/eval/, docs site requirements to docs/requirements.*, the engine lock example into ah-engine/; stray helper scripts removed (#149, #152).
• Issue-triage workflow retired (community workflow handles it) and the community gate crash fixed (#146).
• Model steps use structured output; GitHub Copilot is off by default in the model chain (copilot_fallback: false) (#150).

0.300.1 (2026-10-10)

Docs, site and repo patch. No engine or hook behavior changes.

• Docs site: neutral near-black dark background with a faint teal hero glow (#125); new "How it works" section linked to the settings page (#127).
• Docs: the Rust ah-engine is presented as the core component everywhere (README, GUIDE, HOOK-LATENCY, docs index, skills in both ports); the Node hooks are a temporary fallback removed in v1.0, never an option or mode (#127, #129).

0.300.0 (2026-10-09)

Highlights

• Optional ah-engine (Rust) answers hook calls without starting Node per call. One thin trigger per event; the engine decides natively what it can prove identical to the Node hook and defers the rest to Node, never weaker than Node. Claude and Codex ports alike. macOS and Linux; Windows is not supported yet.
• Everything tunable lives in plugin files (plugins/anti-hall/engine/), read at run time with hot reload, layered failover and self-heal. Nothing is compiled into the binary.
• Local-only telemetry: ah-engine telemetry summary.
• Released separately. The engine has its own version and GitHub Release (ah-engine-v0.1.0, six targets, build-provenance attested); the plugin pins it by sha256 in ah-engine.lock. A plugin without the binary, offline or on an unsupported platform runs the Node hooks exactly as before.

Added

• Engine bootstrap with sha256 verification. The plugin ships ah-engine.lock (engine version and the sha256 of each release asset). On SessionStart hooks/ah-engine-bootstrap.sh (POSIX sh, detached, never fails a session) downloads the archive for the detected target (macOS arm64/x86_64, Linux x86_64/arm64 glibc or musl, WSL as Linux) from the GitHub Release over HTTPS and installs ~/.anti-hall/ah-engine/bin/ah-engine only if its sha256 equals the lock's entry (no trust on first use; a mismatch installs nothing). Atomic, idempotent, retried at most every 6 hours after a failure, previous binary kept as ah-engine.prev, a binary it did not install is never overwritten, log in ~/.anti-hall/ah-engine/bootstrap.log. Opt out: AH_ENGINE_BOOTSTRAP=0. A plugin tree without ah-engine.lock installs nothing and stays on Node.
• One thin trigger per event. hooks/hooks.json and codex/hooks/hooks.json are generated from the dispatch table (engine/defaults/dispatch.toml) and call hooks/ah-hook.sh <Event> (Codex: --host codex; ten Codex events, all Claude Code events except WorktreeCreate/WorktreeRemove). hooks.registry.json lists the individual hooks. The wrapper runs the Node hooks when the engine is absent, times out, crashes or defers (exit 75).
• Layered failover and self-heal for the engine files. Per file and per setting: the edited engine/defaults/, then the last-known-good copy (~/.anti-hall/ah-engine/defaults.lkg/), then the read-only engine/defaults.pristine/, then Node. Every fallback is logged and marks the engine degraded. A setting the edited files lack is taken from the pristine copy and appended to the edited file (existing text kept, backed up once, idempotent; skipped in a version-controlled checkout). ah-engine config heal does it on request.
• Shadow and rollback. Per-entry mode = "shadow" runs an engine check beside its Node hook (Node decides) and logs dispatch_shadow; mode = "off" skips the engine's check. Whole rollback: ah-engine stop, delete the binary, AH_ENGINE_BOOTSTRAP=0.
• Telemetry (ah-engine telemetry summary|events|rollup): per hook and check, the event, outcome, latency histogram and bytes injected into context, identifiers only, stored in ~/.anti-hall/ah-engine/, never uploaded. telemetry.enabled, telemetry.retention_days.
• Docs: new "Install, go-live and rollback", "What still runs on Node" and "Measured results (pre-release)" sections in docs/AH-ENGINE.md; engine notes in the READMEs (both ports), GUIDE, CONTRACT-1.0, DEVELOPMENT, llms.txt and the system-briefing and settings skills (both ports); PRIVACY.md now lists the binary download, the local telemetry and the background process.
• DevSwarm engine paths. The engine runs the DevSwarm gates and guards natively (parent and child gates, comms guard, reply tracker, child drain, codex nudge, task tracker, verify-first), with a new engine-devswarm-supervisor skill and its own settings area.
• Reconcile and sweep behind a switch. The supervisor reconcile and sweep tail run natively only when devswarm_sup.reconcile_mode (engine file) and devswarm.sweepTailMode (setting) are set; both default to node, so nothing changes until you opt in.
• Faster startup. The engine no longer links the macOS IOKit, CoreFoundation and CoreServices frameworks , and transcript-scanning Stop/prompt checks have their own script time limit so they no longer defer on real transcripts.
• Skills call the engine with a Node fallback. Skills run through scripts/ah-run.sh, which uses the engine when it is installed and healthy and falls back to the Node script otherwise.
• Command guard parity. The engine command check ports the read-only chain units and background-script safe flags from the Node guard (a gcloud read inside a read-only chain and python3 -I scratch scripts are not treated as heavy).

Changed

• PRIVACY and README wording: "no telemetry" became "no analytics, nothing reported to anyone", because the engine keeps local-only counters; two requests are on by default (update check, one-time engine download).
• Documented model default: jev.judgeModel is the alias haiku (the docs still said a pinned version).

Repo automation

These changes affect the GitHub repository only, not the installed plugin.

• Copilot CLI install fix: the Copilot slot now always checks out its lockfile folder, so npm ci works when tools are none.
• Claude and Copilot error diagnostics: each failing slot writes its own error line to the job summary.
• Force-model dispatch: community.yml takes a force-model input that bypasses the daily cap for a test run.
• AI_DAILY_CAP now counts actual model calls per day (a marker artifact is recorded when a slot answers), not workflow runs.
• PR alerts in pr-check, and triage.yml folded into community and pr-check.
• Docs-drift check plus a release docs review.
• Discussions participation: announcements, Q&A follow-up, idea to issue conversion, and the /triage and /explain commands.
• The weekly digest now posts privately to the project board.
• Full board reconcile with Last update and Progress fields.
• Dependabot auto-merge for patch and minor updates into dev.

Still on Node

DevSwarm mesh writes and daemons (ingest, supervisor, reaper), every call that consults a Jev integration, the semantic judge's model call, the statusline, and the blocking branch of several guards (the engine answers the quiet cases and defers any case that could block).

Measurements before release

From one replay of 2113 recorded payloads against the exact go-live bundle and the same-version Node hooks (not a field result): 0 of 68 blocks weaker than Node, 2059 identical outputs, 87.0 percent of hook rows answered natively, about 35.5 ms CPU per call for the engine against 158.2 ms for the Node hooks. Known gaps are listed in docs/AH-ENGINE.md.

0.203.3 (2026-10-10)

Repo

These changes affect the GitHub repository only, not the installed plugin (#87).

• Model steps use two Claude credentials with immediate failover from the first to the second, then Copilot, then rules-only. Each job's summary names the slot used.
• Per-job model routing: each automation job picks its own model from the config.
• privacy-scan checks commit identity (author and committer) on pull requests.
• The moderation sanitizer fix: model output is cleaned correctly before it is posted.
• Leaner pull-request CI: Node 24 only on pull requests; the full matrix runs on tags, main and weekly. A nightly job runs the parity and bench tests.
• Realtime board sync: the roadmap board and stale check update on pushes to dev/main, pull-request close and issue events (rules only, no model); the digest stays weekly.
• Dev skills: every agent and lane brief names its issue and keeps it updated.

0.203.2 (2026-10-09)

Security

• command-guard: the timeout prefix regex (TIMEOUT_PREFIX_RE) had two overlapping flag alternatives, so a timeout followed by many -k -x pairs made the PreToolUse classifier backtrack exponentially (CodeQL js/redos). The alternatives are now disjoint; every real timeout form strips to the same body. A regression test runs the CodeQL witness string (#56).

Repo

These changes affect the GitHub repository only, not the installed plugin.

• Issue forms with priority, area and estimate fields; discussion category forms for ideas, Q&A, show-and-tell and general; saved replies and a release notes template.
• Rules-first automation for triage, moderation and research briefs on issues and discussions, PR checks, and a weekly roadmap digest, each with an optional Claude or Copilot model step that falls back to rules only.
• Privacy scan on pull requests (gitleaks plus repository rules for private paths and identifiers).
• Roadmap board automation, PR path labels, PR title check, stale handling, dependency review, job timeouts, PR concurrency and SHA-pinned actions.
• CodeQL via default setup (the advanced workflow is manual-only), OpenSSF Scorecard, and release drafter.
• Docs site built with MkDocs and published on GitHub Pages at https://talas9.github.io/anti-hall/, plus the wiki; docs/REPO-PIPELINES.md lists every workflow and policy, and SUPPORT.md says where to ask.
• Dev-only skills under .claude/skills/ (dogfood, gh-work, release, engine-lane, repo-hygiene); they are not part of the shipped plugin.
• Dependabot bumps for GitHub Actions (checkout, setup-node, configure-pages, deploy-pages, claude-code-action), now targeting dev.

0.203.1 (2026-10-09)

Fixed

• api-guard: the Python probe now runs with -I (isolated mode) instead of -s. With -s the probe's current directory (the temp dir) led sys.path, so Python listed the whole temp dir on its first import (40-73 s on a machine with about 490k temp entries) and a json.py placed in the temp dir would run inside the probe.

Security

• On Linux the temp dir is the shared /tmp, so another local user could plant a json.py there and have it execute inside the api-guard probe. -I removes the current directory and user site from sys.path and ignores PYTHON* environment variables, closing that path.

0.203.0 (2026-10-09)

Highlights

• Leaner injected context. The SubagentStart worker core, the task-tracker reminder and the DevSwarm workspace table all re-send less (measured per-turn and per-spawn reductions below).
• Accurate limit advisory. The limit-conservation text no longer claims a Claude model has its own weekly bucket.
• Language-agnostic. The Flutter-specific flutter-debug skill and agent are removed.
• Alias-based model routing. The Jev judge and all plugin code route by model alias, never a pinned model version.
• Guard and DevSwarm fixes. git-guard heredoc handling and self-credit messages, command-guard read-only chains, one canonical DevSwarm workspace-id resolver, spawn-time submodule fetch, and auto-archive records that no longer stay pending.

Changed

• git-guard: a data heredoc is no longer vetoed by read-only neighbouring commands or a literal $VAR target, and the self-credit block names the command that carries the credit.
• command-guard: a gcloud read inside a read-only chain and python3 -I scratch scripts are no longer treated as heavy.
• edit-guard: a handover written outside the project gets a specific redirect to the project path.
• Jev judge and plugin code route models by alias (haiku/sonnet/opus), with a guard test against pinned slugs.
• DevSwarm: one canonical workspace-id resolver (meshId/uuid/prefix) across unarchive, send, gate and the other id-taking verbs; spawn fetches a missing pinned submodule commit before create and surfaces every submodule failure in warnings; an auto-archive record without doneHead no longer stays pending forever (already-written entries are repaired).

• limit-conserve: reset time renders at minute precision so emit-dedupe matches across jitter; turn-gate pruning uses the correct tg family; jev-report keeps triage-derived rows out of Jev totals; eval trace extraction counts assistant usage once per message id.

• Fixed the limit-conservation advisory (limit-conserve-inject.js, Codex anti-hall-context-conserve skill) claiming Sonnet draws on a "SEPARATE weekly bucket" or that a downshift preserves a "flagship weekly bucket". Per-model weekly buckets are not documented, and the usage screen shows only "All models" and "Fable only". The text now says only that Codex has its own limit and that cheaper models or fewer agents use less of the shared Claude pool, and makes no claim about Fable's relation to "All models". A test fails if the advisory ever again calls Sonnet, Opus or Haiku a separate bucket.

• Removed the Flutter-specific flutter-debug skill and agent; anti-hall is language-agnostic. The removed code remains in git history.
• The DevSwarm workspace table (parent inbox) is no longer re-sent when only a row's unread count changes; unread already arrives per turn in the inbox segments. Status/finish/risk changes still re-send it, and the keepalive now follows guards.injectionRepeatEvery instead of a fixed 10. Measured on a 3-workspace fixture over 16 delivered turns: 286 -> 198 injected chars per turn on average (the COMMS OVERRIDE line was already once-per-session plus keepalive).
• SubagentStart (verify-first-subagent.js, default context.protocolLevel=compact) now emits a worker-only short core: iron law, stop-and-verify triggers, done/scope/autonomy/skip rules, the PROTOCOL.md pointer and WORKER. Measured per spawn: 3,564 -> 2,518 chars compact (7,701 under protocolLevel=full, unchanged). Main sessions keep the existing session core. The subagent size caps in verify-first-subagent-compact.test.js dropped to 2,800/3,100 to pin it.
• The task-tracker SHORT reminder line is no longer injected on every prompt: it follows guards.injectionRepeatEvery (first turn after the FULL primer or a compaction, then every N delivered turns; 0 = every turn). The per-turn open-tasks / DISPATCH NOW note is unchanged, and the hook no longer emits an empty context block when nothing applies. Measured over 12 delivered turns with no open tasks: 1,896 -> 546 chars (158 -> 45 per prompt).

0.202.0 (2026-10-04)

Highlights

• Bash guards return decisions instead of exiting (no process.exit; CLI output byte-identical).
• Guards honour the evaluate() env argument, and guard output writes retry EAGAIN.
• docs/HOOK-LATENCY.md hook counts corrected and scripts/hook-latency.js --grouped added.
• Codex skill descriptions trimmed.

Changed

• A guard's evaluate(payload, env) decision depends only on its env argument. The settings readers, the skip marker (skip-guard.js isSkipped(name, env)), the home directory, the coordinator entrypoint check and the Jev consult now take the env given to evaluate() instead of reading process.env; the CLI passes process.env, so command-line behaviour is unchanged. Guard output writes (guard-io writeAll) now retry EAGAIN for at most 3 seconds of real elapsed time (measured with a monotonic clock, so an oversleeping host cannot stretch it) instead of silently truncating.
• The 15 Bash pre/post guard invocations return decisions instead of exiting. compact-declaration-guard, git-guard (pre and --audit), command-guard, coordinator-work-guard (pre and --post), merge-side-pick (pre and --post), merge-gate, scan-throttle, api-guard, ship-it-guard, output-verify-guard, devswarm-parent-reply-tracker and devswarm-child-drain each export evaluate(payload, env, { argv }) returning { exitCode, stdout, stderr } and never call process.exit; a thin require.main === module wrapper (hooks/lib/guard-io.js) reads stdin, writes both streams and exits with the code. A block can no longer turn into an allow when guards run in one process inside fail-open try/catch blocks. CLI behaviour is byte-identical. tests/hooks/guard-evaluate-parity.test.js runs every guard through the spawned CLI and in-process and compares exit code, stdout and stderr.
• docs/HOOK-LATENCY.md per-event hook counts are corrected (Bash 9 PreToolUse and 6 PostToolUse on 0.201.0, plus the Codex port's counts), and scripts/hook-latency.js --grouped starts each event's whole hook set in parallel and reports group wall time and summed CPU.
• Six Codex skill descriptions are shorter (anti-hall-doctor, -install-statusline, -omc, -omx, -orchestration, -update).

0.201.0 (2026-10-04)

Highlights

• Tradeoff fixes A-F. git-guard skips heredoc bodies that are data and checks xargs, resolves git aliases and reused commit messages, and holds git/gh beside a data heredoc to a flag allowlist; api-guard, ship-it-guard and Bash edit parity see shell writes (no 64 KB skip); an opt-in unsupported-inference check and a keyless CLI judge backend; noisy advisories (root-cause nudge, output-verify) cut at the source; DevSwarm hooks exit early where they cannot act.
• README tradeoffs list moved into GUIDE "Limits and escape hatches".
• Replay false-positive fixes from 5,828 real PostToolUse events.
• Benchmark harness (evals/anti-hall/) runs in the container sandbox, with --reps, a per-run cost reserve and --cases-dir.
• New opt-in/advisory features: merge-side-pick advisory, Codex spawn-time orchestration rules, reduced tasklist nag, per-prompt Stop-nag budget.

Added

• Idle-agent sweep (hooks/idle-agent-sweep.js, UserPromptSubmit, advisory; guards.idleAgentSweep default on, guards.idleAgentSweepCount 3, guards.idleAgentSweepMin 15; Claude and Codex). Field case: 34 named teammates had sent their final report and sat idle for up to ~1.5 h because nothing reminded the coordinator to stop them. Once per user prompt, the hook lists agents that finished but were never stopped, oldest first (up to 10 names, then "and N more"), with the exact call to end them. Claude: a named teammate whose newest event is an idle_notification with idleReason available or failed, with no later SendMessage to it and no TaskStop (by name or <name>@<team>); an idle with no idleReason (waiting on its own work) and background agents (already ended by their completed notification) are not listed. Codex: a multi_agent_v1 agent whose wait_agent result is completed/errored and that was never closed (close_agent) or re-tasked (send_input/resume_agent); the newer collaboration tool set has no close tool, so nothing is listed there. Fires when 3 are idle or one has been idle 15 minutes; a <task-notification> turn is skipped and a queued burst gets one copy. Replayed on the field session it fires at the first user prompt after the teammates finished (20 names, oldest idle 44 min) and at every prompt until the stop (34 names, the same 34 the coordinator stopped). Detection lives in hooks/lib/agent-scan.js (finishedTeammates) and hooks/lib/idle-agents.js.
• api-guard and ship-it-guard see shell writes (guards.shellWriteChecks, default on; Claude and Codex). Both are now registered on Bash as well as Write/Edit/MultiEdit (Claude) and apply_patch (Codex). hooks/lib/shell-writes.js lists the files a command writes (>/>>/>|/&> incl. > f truncation, heredoc into cat/tee, echo/printf, tee [-a], sed -i, perl -i/-pi, cp/mv, literal python -c/node -e open-for-write paths; also inside sh -c, eval, $(…)) using command-guard's own parsers. ship-it-guard's existence gate runs on those targets (scratchpad and tmp-outside-a-repo writes excluded); api-guard checks the text a heredoc/echo/printf puts in a .py/.js/.ts file. A target the parser cannot know (a variable, a glob, dd/install/rsync, a script run) is allowed. Cost: two more hook processes per Bash call (api-guard exits before parsing unless the command names a .py/.js/.ts file; ship-it-guard is off by default).
• Shell-write checks no longer skip commands over 64 KB, and cover more inline writes. The classify cap (a guard against catastrophic regex cost) made a ~96 KB cat > src/auth/big.py <<'EOF' invisible to api-guard, ship-it-guard and Bash edit parity. Those now scan the heredoc header (target and redirect) with an empty body, take the real body as the content, and parse text after the heredoc unless the header line has a cd; a big command with no leading heredoc is judged on its first 16 KB. 1 MB command: 34-60 ms per hook, wall time with node startup. api-guard still skips a body over its own 600 KB chunk cap, same as the Write tool. Inline-code literals now include perl 2- and 3-arg open with a write mode and node createWriteStream (ruby File.open(...,'w')/File.write and node writeFileSync/appendFileSync were already covered).
• Bash edit parity covers inline code (guards.bashEditParity). A literal python -c "open('src/x.py','w')…" (or node -e writeFileSync, ruby -e File.write) into a repo file now gets edit-guard's delegation block on the main thread, like sed -i and redirects already did.
• git-guard sees through git aliases (guards.gitAliasResolve, safety, default on; Claude and Codex). git <name> for a non-builtin name is resolved through the repo/global git config at hook time (one git config --get-regexp ^alias\. per repo per call; builtins never spawn git), following alias chains (loops resolve to nothing) and !shell aliases, and the expansion is scanned as the command it really runs. Before, git pf with alias.pf = push --force, or git ci -m "...Co-Authored-By: <AI>..." with alias.ci = commit, was allowed. Defining an alias whose body is a blocked git command is blocked too: git config alias.x, git -c alias.x=, GIT_CONFIG_VALUE_<n>=, and a shell alias x= (an AI-credited commit body used to pass; a force-push body was already blocked). A call to a shell alias or function defined in the same command is scanned as the git command it forwards to (g(){ git "$@"; }; g push --force used to pass). The PostToolUse audit follows aliases as well. Logic lives in hooks/lib/git-alias-scan.js.
• git-guard checks reused commit messages before the commit runs (guards.gitReusedMessageCheck, safety, default on; Claude and Codex). For a git commit with no -m/-F, the message it would take from -C/-c/--reuse-message/--reedit-message <rev>, from HEAD (--amend) or from -t/commit.template is read and blocked when it carries an AI self-credit trailer: always when reused verbatim (-C, --no-edit, a no-op editor such as GIT_EDITOR=true), and on the editor path when the command sets no real editor. A real editor override and anything a commit-msg hook writes are left to the existing PostToolUse audit, which tells the agent to amend.
• Unsupported confident inferences (opt-in). guards.inferenceCheck (default off) makes speculation-guard also block, once per reply, a causal claim with no hedge word ("The crash is caused by the cache race.") when no tool output, observation-tool input, pasted fenced block or task notification in the last 1 MB of the transcript mentions the stated cause (new hooks/lib/inference-check.js; Claude transcripts and Codex rollouts). Off by default because field precision is low: 1.00 precision / 0.95 recall on the new 84-case synthetic corpus (eval/inference-bench.js), but it flagged 3.8% of 3,276 real final replies and at most 18 of a 40-flag sample were causal claims about project state (precision ≤ 0.45).
• Semantic judge without an API key. jev.judgeBackend (api default, cli, auto): cli runs the judge on the local claude -p CLI with your own Claude login, isolated (no tools, no MCP servers, no settings files, disableAllHooks) and marked ANTIHALL_JUDGE_CHILD=1 so it cannot recurse; measured about 5–6 s per turn end. Fail-open when the CLI is missing or not logged in.
• eval/inference-bench.js + eval/inference-cases.json: offline precision/recall for both components (--hook, --codex, live --judge-cli).
• merge-side-pick advisory (hooks/merge-side-pick.js, PostToolUse + PreToolUse Bash, Claude and Codex): after a conflict is resolved by taking one side wholesale (git checkout|restore --ours|--theirs, git merge|pull|rebase -X ours|theirs, git merge -s ours), a push with no test run since (npm/pnpm/yarn test, node --test, pytest, go/cargo/flutter/dart test, mvn/gradle test, make test, ...) gets one advisory line in the shared message shape. Never blocks; per-session state in ~/.anti-hall/merge-side-pick-<session>.json, pruned after 7 days. Setting guards.mergeSidePickAdvisory (default on, env ANTIHALL_MERGE_SIDE_PICK_ADVISORY). On Codex the advisory is shown only by Codex builds that support PreToolUse additionalContext (rust-v0.129.0 and later, docs/KB-claude-codex.md section 5.2); older builds ignore it and the recorder stays harmless. Designed from the owner-decisions description; the original report text was not found.
• Experimental, opt-in: Codex spawn-time delivery of the orchestration rules (context.codexOrchFullOn=spawn, env ANTIHALL_CODEX_ORCH_FULL_ON; default session = today, byte for byte). Needs Codex >= 0.129 with hooks trusted. On a positively identified Codex session SessionStart sends the compact core plus the compact orchestration lines, and the full Codex-worded rules arrive once per context epoch on the first spawn_agent call through orch-on-spawn.js (same marker + O_EXCL claim as Claude; the retry scan also recognises Codex rollout developer messages). orch-on-spawn.js is now registered in the Codex port on the ^(?:collaboration)?spawn_agent$ matcher only (silent unless the marker is pending). Codex 0.160 surfaces PreToolUse additionalContext to the model (live probe 2026-10-04: tool_name collaborationspawn_agent, hook fires, context reaches the parent). Codex SessionStart chars in spawn mode are measured with evals/anti-hall/injection-profile.js.

Performance

• Hook latency: DevSwarm hooks exit before loading their libraries in a session they cannot act on. devswarm-parent-gate, devswarm-parent-inbox, devswarm-child-turn, devswarm-child-gate and devswarm-child-drain each load a dozen companion libs at module scope (70 to 187 KB of source) and only then reach the check that returns early for a non-DevSwarm session or the other role. New hooks/lib/devswarm-primary-gate.js repeats those same payload-independent checks (the hook's own settings switch, the user skip marker, DevSwarm active, Primary vs child) before the heavy requires, drains stdin and exits 0. A session the hook can act on goes through the full hook unchanged. Measured, paired and interleaved against the previous build, DevSwarm env stripped: devswarm-parent-gate (Stop) 36.8 to 21.3 ms CPU p50, devswarm-parent-inbox (UserPromptSubmit) 38.2 to 21.5 ms, a bare node -e 0 being about 16.5 ms. One side effect, not a decision: devswarm-parent-gate and devswarm-child-gate (Stop) and devswarm-child-drain (PostToolUse) no longer rewrite the stable launcher under ~/.anti-hall/bin/ in a session they cannot act on. The launcher is still refreshed at SessionStart by devswarm-child-role.js and on every real DevSwarm Stop.
• crypto and child_process load on first use in the hooks that rarely need them (hooks/lib/lazy-node.js; task-guard, tasklist-guard, speculation-guard/judge, claim-ledger, codex-nudge, compact-advice-guard, task-tracker, verify-first, phase-tracker, devswarm-child-turn and the shared libs jev-assist, emit-dedupe, command-allow, stop-ack, identity, ...). Call sites are unchanged. Measured gain is 0 to 4 ms CPU per hook, within noise on several, so treat it as small.
• Measurement and the numbers that were checked and not changed are in docs/HOOK-LATENCY.md (addendum 2026-10-04, second).

Fixed

• api-guard no longer treats the result of a chained require (const src = require('fs').readFileSync(f)) as the module itself, and no longer flags a property assignment on a module (fs.x = 1) as a fabricated API read.
• git-guard shell-function wrapper expansion no longer splices call arguments into a name="$1" / local name="$1" assignment when the variable is only echoed or passed as data (test harnesses piping a command to a hook). It still blocks when the variable, or one derived from it, is later run ($c, eval "$c", bash -c, piped or here-string to a shell, source <(...)).
• Judge hardening. The secret scrub now also covers sk_live_/sk_test_/rk_live_, glpat-, npm_, Authorization: Basic|Bearer values and quoted multi-word SECRET_KEY = "a b c" values, and the judge input is scrubbed before it is cut to length (a cut could leave a token fragment below every pattern). The claude -p judge child runs in a private empty temp dir (removed afterwards) instead of the shared temp dir. Every Stop, SessionStart and UserPromptSubmit hook exits 0 silently when ANTIHALL_JUDGE_CHILD=1 (new hooks/lib/judge-child-exit.js), as a second stop against recursion.
• Benchmark harness (evals/anti-hall/, tooling only). Bash failed in every container run: the runtime's masked /proc subpaths make the kernel refuse bwrap's /proc mount (bwrap: Can't mount proc on /newroot/proc), so models could not run git/tests. run-in-container.sh now unmounts the masks as root with CAP_SYS_ADMIN and drops to node with no capabilities (EVAL_KEEP_PROC_MASKS=1 opts out). Also: --reps now reaches a single-arm run as --runs; new --run-reserve-usd per-run cost pre-check; --cases-dir reads cases from outside the repo with a generated manifest; -- --keep-temp copies each run's temp dir into <results>/kept/ with a relative tracePath, so traces outlive a --rm container.
• git-guard: heredoc bodies that are data are no longer scanned as commands (setting guards.gitGuardHeredocData, default on, env ANTIHALL_GIT_GUARD_HEREDOC_DATA; Claude and Codex run the same hook). A note, commit message or PR body that mentions git push --force is no longer blocked when its heredoc feeds a prose/data file or a message: cat <<EOF > notes.md, tee notes.txt <<EOF, git commit -F - <<EOF, git commit -m "$(cat <<EOF ...)", gh pr create --body-file - <<EOF. All-or-nothing and fail-closed: every other command in the line must be on a short allowlist (no shell, interpreter, xargs, eval, source, or path/variable used as a command anywhere), targets must be literal prose/data files outside .git/.husky/hooks/.ssh/.config/.claude/.codex/.anti-hall/bin (no script, extensionless file, dotfile, git hook name or existing symlink), and the opener parse must be exact. A body fed to bash/sh/eval/source/xargs/python/..., piped into a shell, teed into >( ), or written to a file the same line runs is still scanned, and so is a script written by a heredoc. Credit trailers and git-config lines in a body are checked whatever the consumer. The pinned bypass suite (git-guard-heredoc-bypass.test.js) stays blocked; five tests that pinned prose into .md/.txt (and a handover file) as BLOCK now pin ALLOW.
• git-guard: xargs runs get the checks a direct run gets. xargs options are parsed like getopt (GNU and BSD): GNU -i/-l/-e/--replace/--eof/--max-lines no longer swallow the command word, a required option value is taken even when quoted or dash-led (-d '\n'), clusters (-0n1), abbreviated long options and BSD -J/-R/-S are handled, and a bare {} is a literal word (xargs -I{} git ... is no longer split at the braces). An xargs-run sh -c, eval or nested xargs is re-scanned as a command. Before this, xargs -i git push --force ..., xargs -l, xargs -d '\n', xargs -J % and xargs sh -c '<force push>' were allowed.
• task-guard IDLE NEGLECT no longer blocks while unmapped agents could be on the listed tasks. A running agent whose description names no #<id> was assumed to be on an in_progress task first, so the pending task it was actually on (or tasks waiting on its result) were reported as having "no in-flight agent". The Stop block now fires only when more dispatchable tasks remain than running unmapped agents, so at least one is uncovered however those agents are placed. The per-turn DISPATCH NOW line is unchanged. Replay of the 164 IDLE NEGLECT block entries in 14 days of transcripts: 58 had a live agent of the same session; of those, 34 no longer block and 24 still do. The 80 with no live agent are unaffected. Setting: guards.idleNeglectProvenOnly (default on).
• task-guard IDLE NEGLECT: a hung or unrelated agent no longer hides a pending task. In the proven count, a running agent that names no #<id> stops counting as cover when its newest sign of life (launch, SendMessage resume, pending teammate message, output-file write) is older than guards.idleNeglectAgentMaxAgeMin (default 30; 0 = never), or when it was launched before the earliest uncovered task was created or last set pending/in_progress. Unknown age or task time = the agent still counts. The per-turn DISPATCH NOW line is unchanged.
• Noisy advisories: root-cause nudge and output-verify cut at the source. Replayed 5,828 real PostToolUseFailure nudges from 30 days of transcripts through the hook: before, all 5,828 fired; after, 3,438 fire. The 2,390 removed were 362 expected exit-1 predicates (grep no match, test, diff, git diff --quiet, command -v, pgrep; only when the final statement or every && link is a predicate and the exit code is exactly 1), 87 harness refusals (the command never ran), and 1,941 repeats inside one human turn (the text never changes between calls). New lib/expected-failure.js and lib/turn-gate.js; setting guards.failureNudgeFilter (default on, env ANTIHALL_FAILURE_NUDGE_FILTER, off = nudge on every failure again). output-verify-guard gets the same once-per-turn gate per distinct signal set (guards.outputVerifyOncePerTurn, default on): 3,183 historical advisories, 69 still fire on the staged hook (the zero-count and runner-detection fixes already removed 3,114), 57 with the gate. No blocking guard changed. Claude-only hooks (the Codex port has neither PostToolUseFailure nor this PostToolUse shape), so no Codex mirror.
• git-guard: git and gh beside a data heredoc are held to a per-subcommand flag allowlist. A masked body written to a.md could be run on the same line by git fetch --upload-pack='sh a.md' . (also --upload-p, --up, -u), gh repo clone o/r -- --upload-pack=... or git commit -F - --upload-pack=.... Beside a data heredoc, git may now use only commit/tag/notes/merge (message and common flags), status/log/diff/show/add (read-only flags) and rev-parse, plus --no-pager and -C <literal dir>; fetch, push, pull, clone, remote, submodule and config are no longer allowed there, and -c/--git-dir are not either. gh may use only pr/issue/release create/edit/comment with listed flags and no -- passthrough. Any other flag (abbreviations included) keeps every body scanned. A git push on the same command as a data heredoc now gets the body scanned again.
• git-guard: wrappers, positional-arg forwarding and find -exec. stdbuf, caffeinate, ionice, flock (flock FILE -c 'cmd' is scanned as sh -c), setsid, chrt, taskset and doas are unwrapped with their own option grammars, directly and under xargs. A sh -c/bash -c script that forwards its positional args (sh -c '$0 "$@"' git ..., bash -c '"$@"' _ git ...) is scanned with the args spliced in (unquoted references word-split), and under xargs with a --force standing in for the stdin words. find -exec/-execdir/-ok/-okdir commands (\; or +) get the direct-run checks, including -exec sh -c '...'; a find -exec git push ... {} is blocked because a file name can be a +ref refspec. All of these forms were allowed before.
• git-guard: replacement strings, flock -c anywhere, GNU parallel, and git's real value grammar beside a data heredoc. When an xargs -I/-i/-J/--replace string, find's {} or a parallel placeholder is the command word, the git subcommand or an argument before it (xargs -I{} git {} --force, xargs -I{} sh -c 'git {} --force', find . -exec git {} --force \;), the command is unknown and is blocked when a force or remote-delete flag is visible; xargs -I{} git push origin {} is now blocked like any xargs-run push. flock -c/--command[=] before FILE (or --command= after it) is scanned as sh -c. GNU parallel gets the xargs checks (the command before :::/:::: with the inputs appended, the joined line scanned as a shell line, parallel ::: 'cmd' inputs scanned as commands). Beside a data heredoc, --format/--pretty/--unified/--abbrev/-U take only an attached value (as in git), so git log --abbrev --output=x or git diff --unified --ext-diff no longer hides the unlisted flag; -U<n> is accepted on log, and tag's --sort/--points-at/--format take the next word. All of these forms were allowed before.
• git-guard: custom placeholders, stdin-fed subcommands and short-option clusters. { splits a command only as a standalone word (blanks on both sides) and } only after ;, & or a newline, so parallel git {1} --force ::: push, xargs -I{x} git {x} --force and parallel's {.}/{/}/{#} are no longer cut apart before the runner checks; { ...; } groups, function f { ...; }, coproc [NAME] { ...; } and time -p { ...; } bodies still split. When xargs or parallel runs git with no subcommand word (redirections ignored), the subcommand comes from stdin: it is blocked if a force or remote-delete token (--force, -f, +ref, --delete, :ref) appears anywhere on the line, quoted text included and after quote removal (echo 'push --force o m' | xargs git, echo push '-'f o m | xargs git). When the script comes from stdin (xargs -I{} sh -c '{}', xargs sh -c '$0 "$@"', | parallel with no command, | sh, | bash -s), the line's quoted strings and echo/printf words are scanned as commands. Beside a data heredoc, log/diff/show accept only modelled short options (a lone listed letter, -n N, -nN, -N, -M/-C/-U with a number); clusters such as -pn or -wn 3, which git rejects only after --output=FILE has truncated FILE, keep the bodies scanned. A $HOME/ write target is treated like ~/. git branch --merged | xargs git branch -d, ls | xargs git add, xargs -I{} git add {}, find . -exec git add {} + and parallel gzip ::: *.log stay allowed.
• Jev triage: the per-hash claim and the arrival drain lock now use the single lock primitive (companion/lib/lock.js) instead of hand-rolled O_EXCL markers; the lock gained adopt(path, token) so the detached drain worker takes over the lock its spawning hook acquired. Behaviour unchanged; the hygiene allowlist entry is gone.

Changed

• Manifest: plugin.json now sets termsOfServiceUrl (the MIT LICENSE), so the plugin directory listing shows a terms link next to support and privacy. The Codex manifest already had it.

• speculation-judge now sends the judge the latest user request (up to 2000 characters) and the newest tool evidence from the transcript (up to about 6000 characters, secret-scrubbed) besides the reply, so "verified with a tool" is visible to it; the prompt says what counts as supported. Its block reason now uses the shared message shape. Measured precision 0.78–0.81, recall 1.0 (Haiku ×2, Sonnet ×1), so it stays opt-in. PRIVACY.md and the plugin README privacy table list the added text.

• tasklist-guard reduced nag (guards.tasklistNoTaskTools, default reduced). A session that is positively known to lack task tools (today: a Codex session whose transcript shows no task-tool evidence) gets a short nag (no TaskCreate demand: list the tasks in the reply, with the progress and history paths) that blocks at most once per session. A Claude session with no evidence keeps today's full TaskCreate demand: under claude -p the task tools are listed but deferred, so the tool list proves nothing. Evidence is read structurally from the transcript (a TaskCreate/TaskUpdate/TodoWrite tool_use, a deferred_tools* attachment naming TaskCreate, or a task_reminder attachment), never by substring, so the guard's own text cannot confirm itself. Values full (today's nag) and skip. Unset, context.protocolLevel=full makes the default full.
• Per-prompt Stop-nag budget (guards.stopNagBudgetPerPrompt, default 0 = off = today's behaviour). task-guard and tasklist-guard consult hooks/lib/stop-policy.js just before they block; with N > 0 each blocks at most N times per user prompt (key: Stop payload prompt_id, else the last user entry uuid; no key = not applied), inside their existing session caps. Other Stop hooks and the PreToolUse guards are unchanged.
• Jev recommend notice is not sent in non-interactive runs (jev.recommendNoticeHeadless, default false). claude -p exports CLAUDE_CODE_ENTRYPOINT=sdk-cli (verified live; interactive is cli); the notice is skipped for sdk-* entrypoints and the 30-day dedupe stamp is not written, so a headless run does not use up the interactive user's slot. JEV REVIEW DUE and the doctor line are unchanged; Codex is unchanged. Unset, context.protocolLevel=full makes the default true.

0.200.0 (2026-10-04)

Highlights

• Less injected text. In the deterministic injection profile (synthetic payloads, chars not tokens, not a per-run saving) the Claude main-session text per context epoch goes from 26,370 to 13,068 chars (49.6%), SessionStart hooks (Claude and Codex) from 16,562 to 10,740 (64.8%), and the SubagentStart text from 7,701 to 3,371 chars in a normal spawn (43.8%). One setting rolls it back byte for byte: context.protocolLevel=full.
• DevSwarm child workspaces no longer get the COMMS OVERRIDE / SELF_CONTINUE / REMINDER block on every turn (keepalive re-send on change, after compaction and every N turns).
• Coordinator drift guard (coordinator-work-guard) and Bash edit parity: the main thread is nudged, then blocked, when it keeps doing state-changing work inline; Bash writes are judged like the Edit tool.
• Codex guard parity: edit-guard, api-guard and ship-it-guard run on apply_patch; command-guard's heavy-command gate and its block paths work on the Codex main thread (stderr reason).
• Codex wording: Codex sessions get Codex vocabulary in task-tracker, verify-first (orchestration rules and model routing: spawn_agent plus gpt-5.6 frontier/workhorse/fast tiers) and codex-availability instead of TaskCreate, run_in_background and Haiku/Sonnet/Opus; Claude text is byte-identical. The compact core now says "re-sent at session start and after compaction"; codex/README.md documents the context.protocolLevel=full rollback.
• Jev fixes: speculationFramed is switchable, modelRouting records disagreements, triage no longer poisons its cache, arrival labelling.
• Fewer false blocks: tasklist-guard, command-guard (read-only forms, pipe sinks), git-guard-adjacent push forms, AGENT-ROUTING and the shared-tree note.
• Friendlier messages: block messages lead with the path that works and give an absolute, shell-quoted skip command.
• Settings: the plugin options screen is down to 14 options; everything else lives in /anti-hall:settings, existing values migrate.
• Benchmark tooling: injection profile with goldens, strength-study harness, scripts/hook-latency.js.

Fixed

• Jev triage cache repair + prune. Entries cached before this release as a permanent no-label verdict (bare {_seq}, no label) are dropped by update and doctor --repair (repair-jev-triage-cache; real no-label verdicts now carry nl:true and are kept) so those messages are re-triaged. Stale triage claim files, a dead arrival worker's lock and an abandoned arrival queue are pruned (throttled, nothing else touched).
• Guard block messages are readable: one shared shape (hooks/lib/block-message.js: a leading icon, anti-hall · <guard>: <what>, then Why: / Do instead: / Allowed here: / Override (only if the user explicitly asked):) replaces the ALL-CAPS walls of text in edit-guard, command-guard, git-guard, coordinator-work-guard, model-routing-guard, tasklist-guard, task-guard, speculation-guard, silent-agent-nudge, inbox-read-guard and the DevSwarm parent/child gates. Every fact the model needs (override command, TTL, exempt paths, guard name) is kept; Codex still gets exit 2 + stderr and no Claude-only tool names. Fixed icon set: ⛔ blocked, ⚠️ warning, 💡 tip, ✅ done, ⬆️ update, ❌ error.
• The rest of the messages use the same shape: installer and CLI error lines (install-codex, statusline installers, ingest/reaper/supervisor forced-dry-run notices, jev-setup, defect, auto-handover-config, devswarm warnings), the handover-resume, fable- and codex-availability notes, and every DevSwarm injection segment (DEVSWARM <KIND>: banners are now <icon> anti-hall · devswarm-<kind>:). One icon, no ALL-CAPS banners; every fact, command and override variable is kept. Statusline rendering is unchanged (it emits no warnings).
• Codex: command-guard and edit-guard block text no longer tells the model Claude-only things (a scratchpad script, run_in_background, a Haiku subagent). A Codex payload now gets spawn_agent / gpt-5.6-luna wording and no scratchpad advice; Claude text is byte-identical (golden test). Exit 2 + stderr is unchanged (#94).
• DevSwarm child workspaces no longer get the COMMS OVERRIDE / SELF_CONTINUE / REMINDER block on every delivered turn: devswarm-child-turn.js now uses the guards.injectionRepeatEvery keepalive (re-sent on change, after compaction, and every N turns), matching the parent hook. The Codex port runs the same hook.

Added

• Coordinator work window (coordinator-work-guard). The main thread keeps doing state-changing work inline instead of delegating it. A new hook counts successful state-changing Bash calls (WORK) over a 10-minute window. It adds one advisory note when the count reaches 4, and blocks the 7th WORK call in the window. Nudge delivery: PostToolUse additionalContext was live-observed delivering on Claude Code CLI 2.1.238 and is not doc-confirmed (docs/KB-claude-codex.md §1.4); re-verify after a CLI upgrade; blocks are the enforcement.
• WORK is: state-changing git, a gh mutation, a Bash write into a repo file that is not a notes file, a script-file run, and inline -c/-e code that writes files or runs state-changing git/gh.
• Recovery commands (git am|rebase|cherry-pick|revert --abort|--quit, git merge --abort, git stash pop|apply) and loosely matched inline code are counted but never blocked. Precise inline git/gh/repo-write code is blockable.
• Script runs: scripts in the session scratchpad, a tmp dir outside any git work tree, or .anti-hall always count. A script written or modified this session counts, unless it sits in a package-manager or system location. A tracked, clean project script never counts. In a non-git project only a fresh or coordinator-writable script counts; an old one does not.
• Observe-only mode: set guards.coordinatorWorkNudgeAt and guards.coordinatorWorkBlockAt to 0 and the guard only records state. guards.coordinatorWorkWindowMinutes 0 turns it off. Four new settings: guards.coordinatorWorkWindowMinutes, guards.coordinatorWorkNudgeAt, guards.coordinatorWorkBlockAt, guards.coordinatorWorkMaxEntries.
• Skip key coordinator-work-guard (covered by the all skip). The guard is also off when safety.commandGuard is off or command-guard is skipped. Claude host only: Codex PostToolUse behaviour and Codex coordinator detection are unverified, so the hook is not registered on Codex.
• Metrics: per plugin version, the posted share work / calls and the attempted share (work + blocks) / (calls + blocks), blocks, and a separate skipped-would-block counter. Counts survive pruning of old session files through a locked fold. dispatch-report and doctor show them.
• scripts/coordinator-work-baseline.js <transcript.jsonl> [--from-line N] [--cwd DIR] [--json] replays a session transcript through the classifier and window, to get a "before" number.
• Known gaps, all documented in docs/GUIDE.md:
  • obfuscated or computed inline bodies are not detected, and loose inline matches are count-only;
  • a binary compiled during the session (go build -o /tmp/p) is never counted;
  • a script run counts when it is a tracked script you modified this session. That is by design;
  • freshly generated, gitignored build launchers (./build/install/app/bin/app) count;
  • a fresh script inside a git submodule counts, because git status from the parent fails on that path;
  • deliberate mtime back-dating (touch -t, touch -d, cp -p) hides a fresh script;
  • a fresh script dropped into a package-manager or system location is not counted, and neither is one in a fake managed directory made outside the repo (for example ~/x/node_modules/.bin/p.sh);
  • an old, untracked, non-coordinator-writable script inside a repo is not counted;
  • text scripts under ~/Library or ~/.claude/plugins count if they are updated mid-session (an SDK install or plugin update);
  • just and task runs, git stash pop|apply landing edits, and cd "$X" && ... with an unknown cwd are not counted;
  • a trusted ./gen.sh > docs/api.md stays blocked by the Bash edit parity check;
  • the baseline resolves $VAR paths from its own environment, cannot classify direct-exec scripts that no longer exist, and judges freshness against current mtimes;
  • scripts fed on stdin are not counted: python3 - <<EOF, node <<EOF, sh <<EOF, echo … | sh, bash -s <<<;
  • wrapper forms hide the git/gh verb: time -p git, env -C d git, gh -R o/r pr merge, gh api -XDELETE;
  • writes via >|, a clustered cp -rt (wrong target read), install, dd of=, truncate, ln -sf and rm are not judged as repo writes;
  • git checkout . and git checkout <file> are not counted;
  • with a plugin path containing ', the printed skip command itself counts as WORK.
• Bash edit parity (guards.bashEditParity, default on). In the main thread, command-guard applies edit-guard's verdict to Bash writes (sed -i, perl -i, tee, cp, mv, >/>> redirects) into repo files. Notes files the coordinator may edit stay allowed. Bash writes are judged like the Edit tool: a repo file the Edit tool may not write (including gitignored outputs like build/ or .env) is blocked; write under .anti-hall/ or the scratchpad, or delegate. Claude host only: Codex coordinator detection is unverified.
• Codex: edit-guard, api-guard and ship-it-guard run on apply_patch edits (Codex 0.134 or later). Codex reports a file edit as tool_name: "apply_patch" with the raw patch in tool_input.command; the new hooks/lib/codex-apply-patch.js ports Codex's own patch parser (it agreed with the real apply_patch binary on 74 of 74 valid and malformed fixtures) and the guards check every added, updated, deleted and moved-to path. On Codex the main thread is a payload without agent_id/agent_type (confirmed from captured codex-cli 0.160.0 payloads); a Codex process started from inside a Claude Code session is treated as a worker. edit-guard blocks a patch it cannot parse on the main thread; api-guard and ship-it-guard let it through. A Codex block also writes the reason to stderr: Codex reads stdout JSON only on exit 0 and ignores an exit 2 with empty stderr, which a live codex exec run showed (the stdout-only block let the edit through; with the stderr reason it was refused, and a subagent's edit still went through). ship-it-guard's plan-conformance advisory stays Claude-only. Shell writes (cat >, tee, sed -i) still bypass all three on Codex. Claude behavior is unchanged: 353 Claude-shaped test spawns of the three guards gave byte-identical exit code, stdout and stderr before and after.
• Docs: docs/KB-claude-codex.md no longer says Codex PreToolUse rejects additionalContext (supported since rust-v0.129.0).
• settings.js judge on|off|status (and the /anti-hall:settings skills on both platforms): one verb to switch the opt-in semantic speculation-judge (jev.semanticJudge) on or off. on checks whether an Anthropic key is visible to the CLI process (never prints it; a key stored as a Claude Code plugin option is visible to hooks only, so the CLI says "not visible", not "absent") and prints how to add one plus the cost estimate (about $0.0001–0.001 and 1–3 s per turn end, estimated, not measured; no precision eval yet). status and on also report which backend is the semantic judge right now: Jev (when jev.enabled and the speculation integration is on, speculation-guard already asks Jev and the paid API judge exits early, as before), the Anthropic API judge, or lexical-only. doctor prints one info line with the active backend, or the enable command while the judge is off. No new userConfig option and no default changed.
• scripts/hook-latency.js: a pure-Node hook-latency benchmark. It runs every command in hooks.json the way Claude Code does with a realistic payload per scenario, and reports wall p50/p95, CPU (process.resourceUsage() via a probe) and the per-tool-call total per event (--json or a markdown table). First measured numbers are in docs/HOOK-LATENCY.md, and the README no longer says latency is unmeasured.
• Docs: a GitHub Pages site built from README.md and docs/*.md by the dependency-free tools/build-site.js; .github/workflows/pages.yml deploys it on pushes to main only (needs Settings → Pages → Source: GitHub Actions once). The site root also serves llms.txt, sitemap.xml and robots.txt.
• Benchmark tooling (evals/anti-hall/). injection-profile.js is a deterministic injection-size profile (synthetic payloads, fixed root) that compares two plugin trees per channel (session start, skill listing, subagent start, Stop nags) and gates the cost-trim ratios; frozen normalised hook-output goldens (tests/fixtures/cost-trim/goldens/) with a privacy gate for the fixtures. A strength-study harness (arms, interleaving, global spend cap, trace metrics, study analysis, compaction ladder, probes) for the B0-B4 studies. Tooling only; nothing ships in the hook path.

Changed

• The SessionStart verify-first core is now compact by default (context.protocolLevel=compact). It keeps every load-bearing clause inline (Iron Law, rationalization table, the seven rules incl. the done/hedge/merge block, scope and autonomy, the skip-guard clause) and points at the new generated PROTOCOL.md for the full wording. The orchestration rules A-N still arrive in full at SessionStart. Method and figures (deterministic injection profile, evals/anti-hall/injection-profile.js, synthetic payloads, 64-char root; a size measure, not a per-run saving): the SessionStart hooks (Claude and Codex alike) send 10,740 chars instead of 16,562 (64.8%); the core hook alone goes from 8,947 to 3,125 chars. The skill-listing trim (previous entry) adds to the per-epoch total. The SubagentStart text is compact too: the same core (subagent header, SKILLS: root-cause, deadly-loop) plus a short WORKER block (no re-delegation, the assignment is the authorization, tight summary, SendMessage before finishing) instead of the DISCIPLINES block and teammate note: 7,701 to 3,371 chars in a normal spawn (43.8%), 7,947 to 3,617 in a DevSwarm child workspace (child mailbox note unchanged). Same method as above (a size measure, not a per-run saving). context.protocolLevel=full restores today's subagent text byte for byte. Codex has no SubagentStart hook and is unaffected.
• Experimental, opt-in: spawn-time delivery of the orchestration rules (context.orchFullOn=spawn, env ANTIHALL_ORCH_FULL_ON; values auto (default, = session), spawn, session, off). With spawn, verify-first-orch.js sends ORCH_COMPACT and a per-session marker (~/.anti-hall/orch-full/) and the new orch-on-spawn.js (PreToolUse Agent|Task|Workflow) is meant to send the full text once per context epoch (O_EXCL claim, silent for subagents, re-armed by compaction/clear/resume; needs positive Claude evidence: --host=claude in the Claude hooks.json command, a session_id, a transcript canonically inside <config>/projects/). It is NOT the default because it is unverified live: that a PreToolUse context reaches the coordinator, the real transcript line shape and Workflow-spawn behaviour have not been probed. Codex, unconfirmed platforms and a DevSwarm Primary always get the full text at SessionStart.
• One-key rollback: context.protocolLevel=full (env ANTIHALL_PROTOCOL_LEVEL=full) restores today's text on every channel byte for byte (pinned by the frozen goldens in tests/fixtures/cost-trim/goldens/). docs/CONTRACT-1.0.md's "never silently shortened" sentence now names this deliberate exception. The legacy eval/run.js harness is frozen on full.

• Tests: hooks.json command parsers in manifest-drift, codex-jev-hooks-parity and node-hook-flags accept trailing args (a non-match is now a failure, not a skip); node-hook-flags takes a per-script arg allowlist (--audit, and --host=claude only for verify-first-orch.js in the Claude hooks.json).

• Third-party plugin-scanner (plugin-scanner 3.18.0) readiness: test fixtures no longer look like hardcoded secrets or dynamic code execution, the companion's ingest-daemon marker constant is renamed REAPER_DAEMON_MARKER (same value), and a comment no longer trips the eval heuristic. Added plugins/anti-hall/SECURITY.md, plugins/anti-hall/.codexignore, .github/dependabot.yml (github-actions, weekly) and a root package-lock.json.

• Codex manifest: interface.composerIcon and interface.logo now point at assets/icon.png (the AH icon), and interface.screenshots lists two real captures (assets/screenshot-claude-code-session.png, assets/screenshot-git-guard-blocks.png), so plugin-scanner 3.18.0 scores the repo 100/100. The Claude manifest still has no icon key.

• command-guard's anti-hall-plugin check reads only .claude-plugin/plugin.json when it walks up from a script (every anti-hall copy, the Codex install included, ships that manifest), and the Codex skills check the plugin root with test -d .codex-plugin instead of naming the manifest file. No hook or script names the Codex manifest file any more, so the image paths in it are not reachable from the hooks.

• Background scratch-script runs allowed by guards.allowBackgroundScratchScripts, scripts written during the session, modified tracked scripts, other text-script runs outside package-manager/system locations, and inline -c/-e code that writes files or runs state-changing git/gh now count toward the main-thread work window. Running a tracked script you modified this session counts by design (the verify loop belongs to the subagent). The scratch hint now reserves scripts for read-only output capture. Patch application is for integration agents: the coordinator gets no exemption for git am or git apply, apart from the recovery commands above.

• Contributing: day-to-day work lands on dev; main changes only through a pull request from dev.
• Docs: docs/CONTRACT-1.0.md drafts the 1.0 contract, the settings, CLI verbs, hooks and state paths that semver will freeze.
• The plugin options screen is down to 14 options: the manifest userConfig goes from 129 to 14: the 10 headline switches (the four safety.* guards, auto-handover on and threshold, jev.enabled, devswarm.supervisorMode, guards.modelRouting, limitConserve.mode) and the four API keys. Every other setting is reached through /anti-hall:settings, grouped by category (settings.js show, then show --section <category>).
• Values you already set keep working: a non-default stored value is copied into ~/.anti-hall/settings.json by the update or doctor --repair run of the first release that runs the migration (this one, for an install coming from 0.121.x), and every removed option stays a read-only source below the settings file (a stored plugin option or a still-exported CLAUDE_PLUGIN_OPTION_* resolves exactly as before; a value equal to the schema default counts as unset). Defaults are unchanged. An older plugin version resolves the same values, because the settings-file value wins.
• Safety options you set in /config survive their row leaving it: the four locked options that lose their row (guards.stashGuard, guards.editGuardAllow, guards.allowSubagentMailbox, devswarm.maintainerNotice.post) are now copied too, as human-confirmed values (the same write settings.js set <key> <value> --confirmed makes), because a value stored in Claude Code's plugin options can only have come from the person's own /config choice. Before, they were skipped and stayed readable only from Claude Code's stored options, so an armed stash guard would have fallen back to off if those were ever dropped. The copy still happens only when the stored value is the current effective one, so no guard changes behaviour.
• The settings skills, the system-briefing skills, the guide, llms.txt, AGENTS.md, CONTRIBUTING.md and the Codex README describe the grouped show flow and say that /config only has the headline switches, the safety guards and the keys.
• Tests: 320 test files that read home-dir state (settings, caches, registry) without their own HOME now require tests/helpers/isolate-home.js, which points HOME/USERPROFILE at an empty temp dir, so they can no longer read the real ~/.anti-hall or ~/.claude.
• Skill descriptions are trigger-first and at most 200 characters on Claude and Codex; the long text moved into a When to use section of each skill. Skill-listing injection in the profile: 9,808 to 2,328 chars (synthetic fixture; a size measure, not a per-run saving).
• Settings added this cycle: context.protocolLevel (compact default, full = rollback), context.orchFullOn (auto default = session), guards.coordinatorWorkWindowMinutes, guards.coordinatorWorkNudgeAt, guards.coordinatorWorkBlockAt, guards.coordinatorWorkMaxEntries, guards.bashEditParity, guards.sharedTreeAgentNote. New hook: orch-on-spawn.js (PreToolUse Agent|Task|Workflow, inert unless context.orchFullOn=spawn). New generated file: PROTOCOL.md (from tools/gen-protocol.js).

Fixed

• coordinator-work-guard no longer loads the 237 KB command-guard.js for plain read-only Bash commands (git status, ls, cat | head, ...): a closed-vocabulary pre-filter (provablyNotWork in lib/coordinator-work.js, differentially tested against classifyBashWork) answers "not work" first. PreToolUse CPU p50 for that hook dropped from 53.4 to 45.0 ms in an interleaved before/after run (load 220); other commands classify exactly as before. The Node compile cache was measured (0 to 6 percent CPU change) and not adopted; see docs/HOOK-LATENCY.md.

• Jev audit snippets for outputVerifyGuard now keep the first 200 + last 400 characters (joined with …, redacted as a whole, total <= 700) so the test-runner pass/fail summary at the end of the output is judgeable; other integrations' snippets are unchanged.

• Jev: speculationFramed is now registered in jev-setup.js KNOWN_INTEGRATIONS, so jev status / jev mode can see and switch it (a registry test derives every call-site id and asserts it is in KNOWN_INTEGRATIONS and the settings schema). modelRouting decisions now record wouldChange plus an audit snippet whenever Jev's tier differs from the rule-based verdict (also in on mode, regardless of confidence), so jev report can count and label them.

• command-guard: a pipe sink that decides an allow (the gcloud read carve-out and the bounded verification pipeline) now has to match the closed stdin-only grammar. ... | head /etc/passwd and ... | tail -n +1 --pid=123 no longer pass as bounded sinks; head|tail -c N and grep -m N -E PAT stay accepted.

• A read-only gh api graphql call is no longer treated as a mutation. A graphql call is heavy unless it is proven to be a read: one query= field with no $, backtick, leading @ or mutation, and only read flags. The attached forms (-fquery=..., --raw-field=query=..., -F<x>, --field=) and --input now count as body flags on every endpoint; before, -fquery=..., --raw-field=query=... and --input b.json were not blocked.

• Block messages give an absolute, shell-quoted skip command. The skip hint in edit-guard and the new guard is built from the plugin path, single-quoted, so a path with a space or $ works. A relative path broke when the cwd was not the plugin root.
• Codex: command-guard's heavy-command gate now runs on the Codex main thread. Coordinator detection keyed on CLAUDE_CODE_ENTRYPOINT, which Codex does not set, so on Codex the heavy-command gate never fired (a live main-thread npm test ran). hooks/coordinator-detect.js now recognises any Codex payload (a non-empty turn_id plus a non-empty model, or an apply_patch call) and treats it as the main thread unless it carries agent_id/agent_type (a spawned subagent) or the process inherited CLAUDE_CODE_ENTRYPOINT (Codex started from Claude Code as a worker). Partial or mistyped payloads fail open. Verified live with codex-cli 0.160.0: a main-thread npm test is refused and does not run, and a subagent's npm test runs. Claude Code behaviour is unchanged: 2,140 command-guard/edit-guard spawns from the existing tests gave identical exit codes, stdout and stderr before and after.
• Codex: command-guard and compact-declaration-guard now actually block. On exit 2 Codex takes the block reason from stderr and ignores stdout JSON; with stderr empty it records a failed hook and runs the tool call (codex-rs/hooks/src/events/pre_tool_use.rs, rust-v0.160.0). Both guards blocked with stdout JSON only, so on Codex they blocked nothing: a live codex exec main thread ran an armed git stash push. Their block paths now go through the new hooks/lib/emit-block.js, which writes the same reason to stderr; the same run is now refused. A hygiene test fails on any exit-2 path in a Codex-registered hook that leaves stderr empty. Claude shows the JSON reason when there is one (Claude Code hooks reference, "Exit code 2"), and the stderr text is identical, so Claude output is unchanged.
• Docs: docs/CONTRACT-1.0.md and the Codex parity notes no longer say Codex has no SubagentStart event. A captured codex-cli 0.160.0 payload has hook_event_name: "SubagentStart" with agent_id/agent_type. verify-first-subagent is still not registered on Codex.
• The root package.json / package-lock.json no longer read as 0.0.0. In the marketplace clone the root test-harness package was the first version file an agent found, so peers reported the installed plugin as "0.0.0 local dev build". Both files now carry the plugin version and a description pointing at plugins/anti-hall/.claude-plugin/plugin.json; tests/hygiene/manifest-drift.test.js pins package.json, both package-lock.json version fields and both plugin manifests to one version, and RELEASING.md lists them in the bump step. Nothing in the plugin reads the root package.json.
• The Codex installer now registers the PostToolUse git-guard.js --audit hook. install-codex.js omitted it while the shipped codex/hooks/hooks.json template had it since the self-credit audit landed, so project/global installs never ran the audit; tests/codex/codex-hook-parity.test.js missed it because it compared hook basenames only, and now compares full normalized commands (flags and arguments kept) per event.
• tasklist-guard no longer says "NO background agent is live" while agents run: it now reads running agents from the session transcript (as task-guard does) instead of the global 20-minute heartbeat, and an unknown count is treated as not stale.
• speculation-guard: lock adversarial regression corpus. tests/hooks/speculation-guard-regression.test.js pins 67 adversarial and 19 evasion diagnoses (labelled, bounded, plan-worded, requirement-prefixed) plus 20 plain ones as must-block; test-only, no behaviour change.
• command-guard false blocks on read-only forms (approved only when the WHOLE command is the read form, optionally piped into tail/head/wc/grep -c/-m; no substitution, ;/&&/||/newline or other redirection): firebase --version/-V (and the same bare version flag on the other deploy/infra CLIs) passes; gcloud describe/list/get/read passes with a separated value for --project/--region/--zone/--location/--limit/--freshness/--page-size/--sort-by (any other separated flag value, --format json included, stays blocked); a plain push chain may end with git ls-remote <configured-remote> [ref] or git rev-parse <ref>, and a plain push may be piped through | tail/head -N mid-chain. Deploy/delete/push-of-anything-else verdicts are unchanged.
• AGENT-ROUTING no longer suggests Explore for prompts that tell the agent to write or mutate. The model-routing-guard write-signal list missed instruction forms such as save ... to <path>, clone <repo> into <path>, git format-patch, create new files and run the generator/tests/build, while its ambiguous words (build, release, tag, patch, fix, install) also suppressed read-only prompts that only mention them as nouns. Those words now count only in instruction position, an explicit read-only statement ("report only", "do not edit", "read-only", "no edits") overrides the bare stems, and the instruction forms above always suppress.
• SHARED-TREE note no longer fires for spawns that work in a scratch dir. guards.sharedTreeAgentNote now stays silent when the new spawn, or the running agent, establishes a scratch work location ("work in a scratch clone", or work in / cd into / cwd = a /tmp, /private/tmp, /var/folders or scratchpad path), since those spawns share no git tree. A bare mention of a scratch directory or tmp path, an in-place edit statement ("in the repo", "in place", "working copy", "checked-out files", "on main") or a negation ("not a scratch clone") still warns.
• The per-prompt task line no longer counts owner/external-blocked tasks. task-tracker now reuses the Stop task-guard's isOwnerBlocked predicate: open tasks: 2 (+1 blocked: external), and when only blocked tasks remain the "update or close them" instruction is dropped. Codex shares the same hook.
• "Running-agent count unknown" no longer fires for agents that launched and finished in the same session. Root cause: an empty running list on a transcript larger than the 1.5MB tail was always treated as unprovable. agent-scan now makes one widened (12MB) read to prove the count, and when it still cannot, the line names the agent ids seen and the window it could check.
• Canonical ANTIHALL_SCAN_THROTTLE and ANTIHALL_SESSION_END_REAPER env names (old ANTI_HALL_* names still read as deprecated aliases via schema envAliases; canonical wins); devswarm.js help now covers inbox tick, primary, ready-check and describes ensure as idempotent; settings-schema wording for reset confirmation and fable-availability/codex-availability; KB-claude-code-hooks.md and GUIDE now match the official hooks doc (over-cap hook output spills to a file with a 2,000-char preview, it is not truncated).
• A failed unread-summary refresh after an ack is now recorded. applyReadAckOps swallowed a summaries/<hash>.json refresh failure; it stays fail-open but now logs op: 'summary-refresh' with the path and error to the bounded cursor-log.
• limit-conserve threshold now resolves at call time. isConserving() read the module-load value when called without home, so a settings.json or env change after require() was ignored; it now always reads the unified settings store (the Codex status script shares this module).
• update/doctor no longer tell an idle Primary to arm a wake watcher that would exit at once. update.js (wakeMonitorPostUpdate) and doctor's wake-monitor check advised "NOT live — arm it" while the watcher itself idle-skipped (no live non-held/non-ignored child), so the agent armed it, it exited, and every inbox tick kept saying idle-skip. All three now use one shared decision (idleSkipApplies in companion/lib/devswarm-live-children.js): when it applies they report "wake watcher not needed now (no live child workspaces; the mailbox tick covers you)" and add idleSkip: true to the status (existing fields unchanged); unknown liveness or devswarm.wakeWatchIdleSkip off keeps the arm advice.
• Jev: triage no longer caches budget-skipped messages as a permanent no-label verdict (a bulk read used to fill the 500-entry cache with empty entries and evict real labels; attempted items are now an explicit cacheable null, unattempted ones retry). Concurrent triage of one message no longer calls Jev twice (per-hash O_EXCL claim, post-claim cache re-check, merge-on-write).
• Jev: a direct message is now labelled at arrival, so the parent gate's cache-only question lookup finds a label while the message is still unread. Arrivals go through one bounded drain worker per HOME (capped queue file, O_EXCL lock stale after 30 s); a burst of 50 sends spawns one worker, not 50.

0.122.2 (2026-10-03)

Fixed

• Two tests that failed only on Linux CI are now platform-independent (the command-guard message-order differential and the wake-watch lock-stale-bound test). Test-only; no plugin behaviour change.

0.122.1 (2026-10-03)

Added

• Shared-tree agent note: the new setting guards.sharedTreeAgentNote (default on; env ANTIHALL_SHARED_TREE_AGENT_NOTE; settings file and env only) makes swarm-guard add one advisory sentence when a write-capable subagent is spawned without isolation: "worktree" while another write-capable agent is still running in the same working tree (two such agents can commit each other's uncommitted changes). Read-only agent types, isolated spawns and unknown agent state stay silent. Never blocks.

Changed

• command-guard "allow plain push" accepts -u / --set-upstream. A session pushing its own branch with git push -u origin <branch> [2>&1 | tail -N] was blocked only because of the upstream flag. The flag is the single allowed flag slot (never combined with -q or any other flag) and requires an explicit remote AND ref; remote/ref vetting, the output-sink rules and the chain allow-list are unchanged (rev-parse/ls-remote/node/echo after a push stay blocked). git-guard.js is untouched.

Fixed

• doctor: the live guard self-tests now run against an isolated temp home instead of the caller's ~/.anti-hall, so an unexpired user skip or an exhausted Codex quota no longer makes a working guard's self-test report FAILED. The temp home is removed when the run ends; the context-footprint measurements keep the real home on purpose.
• Transcript-heavy hooks no longer hang at exit on Node 24+: the 19 hooks that may parse 1.5 MB or more of the session transcript before exiting (ask-guard, auto-handover, auto-handover-pause-nag, claim-ledger, codex-nudge, compact-advice-guard, compact-declaration-guard, devswarm-child-turn, devswarm-parent-inbox, dispatch-tier, edit-guard, limit-conserve-inject, precompact-snapshot, silent-agent-nudge, stale-agent-stop-note, task-guard, task-tracker, tasklist-guard, verify-first) now run node --no-concurrent-recompilation --no-concurrent-sparkplug. This includes the four that use emit-dedupe, whose scan widens to a 4 MB tail. That is 19 of 64 Claude entries and the 14 matching Codex entries, including the commands codex/install-codex.js writes. Every other hook command is unchanged. On Node 24 and 26 such a hook could deadlock inside process.exit(): a V8 background compile (Maglev or Sparkplug) waited for a main-thread garbage collection while the main thread waited to join that thread (nodejs/node#54918, #64274). The hook then sat until its timeout (30 s for a Stop hook). Replaying a real 14.8 MB transcript through silent-agent-nudge on Node 24.14.0: 4/600 hangs without the flags, 0/600 with them. Node 22 never hung (Maglev is off there). The flags and the hook list live in hooks/lib/node-hook-flags.js. doctor reports whether the running Node accepts the flags, and a hygiene test checks that exactly the listed entries carry them. Existing Codex installs pick up the flags on the next install-codex.js run.
• task-guard idle-neglect message: it now says how to mark a task an agent already covers (set the task's owner to the running agent).
• Heavy-command block message leads with the path that works: every variant of the command-guard.js block text (plain, DevSwarm child, DevSwarm Primary with and without the workspace advice) now starts with one line, to run or re-check the command yourself write it to a scratchpad script and run <interpreter> <script> with run_in_background, then the rest, tightened (about 15% shorter for the plain text). Message only: what is blocked and what is allowed are unchanged, proven by a before/after exit-code table over 49 commands.
• The compact roster unread column summed direct and broadcast unread, so a Primary with no direct mail showed e.g. 34 while inbox tick / read-primary said 0. It now shows direct unread only (the tick's definition) and appends (+N bcast) only when broadcasts are unseen. --json is unchanged (directUnread stays direct-only; broadcastUnread stays separate).
• Dispatch-tier hints are calibrated toward subagent: a workspace or workflow recommendation with Jev confidence below 0.6 is now shown as subagent (logged as low-confidence-subagent), and the classification question now says that a bug fix, a UI text change, any single-file or single-component task, and a priority label (P0/P1/P2) do not make a task a workspace or workflow task. Confident multi-step feature, release and sweep verdicts are unchanged. Verdicts already cached keep their stored answer, but the confidence floor applies to them too.

0.122.0 (2026-10-03)

Added

• Optional "no blocking questions" guard (off by default): the new setting guards.noBlockingQuestions (off, advise or block; env ANTIHALL_NO_BLOCKING_QUESTIONS) watches the AskUserQuestion tool. advise lets the question through and reminds the agent to take the recommended option, say which one, and carry on; block refuses the call. A question whose first entry starts with DESTRUCTIVE: or CREDENTIAL: (in the header or at the start of the question text) is always allowed and noted in ~/.anti-hall/logs/ask-guard.ndjson. In a DevSwarm child workspace the message also says to send the question to the parent instead. Claude only (Codex has no ask tool). In block mode the skills that deliberately ask the user (settings, deadly-loop, ship-it, flutter-debug, devswarm) need that marker, or the setting turned off.
• Agents-in-flight note on questions: the new setting guards.questionAgentsNote (default on; env ANTIHALL_QUESTION_AGENTS_NOTE) makes the same AskUserQuestion hook add one advisory line when background agents are provably in flight, naming how many and their short descriptions and saying they may act on an option before the answer arrives. Silent when none are running or the count cannot be proven. Never blocks and works with guards.noBlockingQuestions off. Claude only (Codex has no ask tool).
• Dispatch-tier text off switch and no-workspace-repo suppression: the DevSwarm Primary dispatch-tier text (the workspace is the top fan-out tier) now goes through one gate used by task-tracker.js, verify-first.js and verify-first-orch.js. It is no longer injected in a repo whose CLAUDE.md/AGENTS.md forbids workspaces for real work, and the new setting devswarm.dispatchTierText (default on; env ANTIHALL_DEVSWARM_DISPATCH_TIER_TEXT) turns it off everywhere.
• Inline-work nudge for Primaries: the new setting devswarm.inlineWorkNudge (default on; env ANTIHALL_DEVSWARM_INLINE_WORK_NUDGE; threshold devswarm.inlineWorkNudgeThreshold, default 5) adds one note per session, via the existing edit-guard.js hook, when a Primary has made more than the threshold of direct edits while actionable tasks are pending and it has proven zero live child workspaces. Silent when liveness is unknown, in a child workspace, and in a no-workspace repo. Never blocks.
• Interval roster on the cron tick (off by default): the new setting devswarm.tickRosterEvery (default 0; env ANTIHALL_DEVSWARM_TICK_ROSTER_EVERY) makes every Nth inbox tick --quiet of a Primary append the compact roster table after the unchanged first line, when unread is 0 and a live child is proven. The JSON form of tick and --child ticks are unchanged.
• Pending child questions are harder to miss: when a Primary has unanswered child questions, the per-prompt "own inbox" notice now starts with one line, QUESTIONS AWAITING YOUR REPLY: N (oldest Xm) — <workspace title>: <first 80 characters of the question>. The preview is cleaned of control characters and has secrets redacted; it is left out when the stored summary has no question text yet.
• devswarm.js spawn note: when --source names a branch other than the default branch and the DevSwarm app already has a workspace (active or archived) on it, the result carries one line in warnings saying the app may show the new workspace nested under it. Output only; nothing else changes, and a failed lookup stays silent.
• Stale-agent stop note: the new hook stale-agent-stop-note (PreToolUse TaskStop, advisory, never blocks) adds one line when TaskStop names an agent that was messaged or resumed after its last report and has not reported since. Setting guards.staleAgentStopNote (default on; env ANTIHALL_STALE_AGENT_STOP_NOTE; settings file and env only, no plugin option).

Changed

• Advanced settings now live in /anti-hall:settings: the 25 advanced settings no longer have a /config row (the manifest userConfig goes from 154 to 129 keys). Non-advanced settings keep their /config rows; /anti-hall:settings shows and changes every setting. The new settings in this release (guards.noBlockingQuestions, guards.questionAgentsNote, guards.staleAgentStopNote, devswarm.dispatchTierText, devswarm.inlineWorkNudge, devswarm.inlineWorkNudgeThreshold, devswarm.tickRosterEvery) are advanced: set them via /anti-hall:settings (settings file or env); they have no /config row. dispatchTierText and inlineWorkNudge are independent switches.
• Stored plugin-option values are copied into ~/.anti-hall/settings.json on update: plugin-option values are now migrated into ~/.anti-hall/settings.json for every plugin-option setting except the 10 headline switches, locked/home-only keys and the credential options, and only when the stored value is already the effective one (the migration never changes what resolves; it re-checks "still unset" under the settings lock). Stored options are read under both pluginConfigs keys (anti-hall@anti-hall, anti-hall) and both shapes. The 10 headline keys are flagged headline in the schema. New permanent default-equivalence test.
• Both READMEs end with a "Links" section naming Documentation, Support and Privacy; documentationUrl now points at the documentation start page (docs/README.md).
• Eight over-200-character tokens (seven regex literals in model-routing-guard.js, command-guard.js, claim-ledger.js, plus the command list in devswarm.js's unknown-command error) are rebuilt from short joined parts so the directory scanner can read them. Behaviour is unchanged; tests/hygiene/regex-source-equality.test.js pins each rebuilt RegExp.source and .flags to the original.
• The icon key is removed from the Claude manifest. The plugin icon ships at the directory's default path, plugins/anti-hall/.claude-plugin/icon.png (512x512 PNG, found without an icon key), and a copy is kept at assets/anti-hall-icon.png. The listing icon is whatever was uploaded in the directory portal; the repository copy is read only at first submission. tests/hygiene/plugin-icon.test.js checks the icon and that no other image or font file is tracked under the plugin folder.
• Skill and model-policy documents refer to this repository's own docs by plain repository path (docs/KB-….md) instead of a full URL. Affected: the devswarm, jev, ship-it and update skills, their Codex counterparts (devswarm, doctor, jev, update) and both MODEL-POLICY.md copies. Vendor documentation URLs in the Jev skills are unchanged.
• The devswarm skills point at the archived orchestration design and plan under docs/archive/superpowers/ (the old path no longer existed).
• The Jev skill leads with the plugin option for storing a key, marks the key file as an opt-in legacy path, and matches the real set-key output.
• CI installs a pinned networkx in a virtual environment so the api-guard third-party tests run; a new hygiene test checks the paths declared in hooks.json, monitors.json, skills and plugin-root references.

Fixed

• A DevSwarm Primary that has live workspaces but no way to be woken by their messages (its session cron died with a restart and its watcher exited when no child was live) is now told so. Each prompt shows a NO MAILBOX WAKE PATH line (or a shorter one naming just the missing watcher or tick), spawn adds the same instruction to its warnings, and the Stop gate blocks once per cap when both are missing. Session crons do not survive a restart; the line says what to re-arm.
• The wake watcher's idle-skip line no longer says the cron covers you. It reports how long ago the mailbox tick last ran, or says no recent tick was seen and to check CronList.
• A transient lock-heartbeat failure (the lock's reclaim sidecar briefly busy) no longer makes a healthy wake watcher exit. The watcher skips that restamp and retries next tick; it exits as lost only on a genuine lost lock, or when transient failures outlast the lock's 2-minute stale threshold (with a log line).
• Releasing a lock now checks ownership and unlinks under the reclaim sidecar (waiting at most ~40 ms for a busy one, then the old behaviour), so a stealer that publishes at that moment cannot have its lock deleted.
• Unanswered-question nag and Stop block skip archived-and-dead, held and ignored askers: the Primary's "N unanswered QUESTIONS" notice and "QUESTIONS AWAITING YOUR REPLY" line (devswarm-parent-inbox.js) and the Stop block on unanswered questions (devswarm-parent-gate.js) used to count questions from workspaces that are archived, held or archive-ignored. All three now share one filter and one set of inputs (filterLiveAskers, built on row-eligibility.js; active descriptors count as rows in both hooks): held and ignored askers are dropped; an archived asker is dropped only when its session is provably dead, so an archived-but-live child still blocks and nags (R18). A sender with no row stays counted when the summary is a legacy one without archivedRegistryRows (it may be archived-but-live), and is dropped as retired otherwise. The block's loop signature follows the filtered set.
• "QUESTIONS AWAITING YOUR REPLY" no longer names archived, held or ignored children: the line now lists only questions whose sender row is not archived, held or archive-ignored (the parent gate's policy, via row-eligibility.js); a sender whose eligibility cannot be determined is left out. The rest of the per-prompt notice is unchanged.
• Roster counter survives non-quiet ticks: a non-quiet inbox tick rewrote the wake-tick marker without its seq, resetting the devswarm.tickRosterEvery counter; the previous seq is now carried over.
• Cron tick prompt wording: the prompt now says to decide on the FIRST printed line only and treats any lines after it (the optional devswarm.tickRosterEvery roster) as informational.
• Roster note only in the Primary's tick prompt: the FIRST-printed-line wording is in the Primary's cron-tick prompt only. A --child tick never prints the roster, so the child prompt keeps its 0.121.8 wording and the injected child payload stays under its size budget.
• Edit-guard and command-guard advice in no-workspace repos: the block message shown to a DevSwarm Primary no longer recommends spawning a child workspace when the repo forbids workspaces for real work (or devswarm.dispatchTierText is off); it goes through the same primary-tier.js gate as the other Primary tier text. Advice text only: the same edits and commands are blocked.
• agent-scan: terminal evidence (a stop notification) stamped before an agent's latest resume no longer re-marks the resumed, running agent as finished; the resume check allows 2 s of clock skew. A named in-process teammate that was sent a message and has not reported since now counts as running (rows carry a pendingMessage marker).
• agent-scan: a teammate report is recognised only as the harness-injected record. Typed or pasted text, a peer's cross-session message, a tool result, an assistant message, a report for a teammate this session never spawned, prose before the block, and an inner timestamp in the future of the record's own all no longer count, so a forged report cannot hide a running teammate. A teammate spawned outside the scanned window is "unknown", never "finished". A teammate named like a background agent id no longer replaces that agent's row or clears its terminal state.
• silent-agent-nudge: a teammate whose only running evidence is an unanswered message never causes a Stop block, at any guards.silentAgentNudgeMin.
• Codex: documented that stale-agent-stop-note is Claude-only (no agent-stop tool matcher is documented for Codex).
• A "Repository not found" error from hivecontrol no longer silences a live workspace's mail for hours: live rows are always pulled and keep reporting the failure; archived, held or ignored rows (and a repo with no live row) are suppressed only after 3 identical sweeps in a row, and the match is limited to hivecontrol's own error line.
• The workspace stop gate re-opens the stop budget for the kinds it just satisfied when nothing is owed any more.
• The Primary gate says so (one non-blocking line) when it cannot determine its own unread count, instead of skipping its own row silently.
• Key notices (hooks, jev-setup, migration) say "the plugin's options screen" instead of /plugin config.
• Held and archive-ignored children no longer keep the wake watcher armed: the wake-watch and inbox tick idle-skip now use the parent gate's policy (live = not archived, not held, not ignored).
• Archived or pruned workspace rows are no longer reported as errors by reconcile, and the supervisor log line lists an unchanged failure set once instead of repeating every row each sweep. Nothing is moved or deleted.
• The workspace stop gate no longer re-demands a heartbeat beside an inbox pull after a report, and the Primary gate no longer nags a Primary whose own descriptor has no inbox path.
• The one-time generic Jev key binding notice follows the effective transport (plugin option, env or settings), not only the home settings file.

0.121.8 (2026-10-03)

Fixed

• Directory listing: the plugin icon moved to the plugin's top level (./icon.png) and is now an original "AH" monogram; the display name is "Anti-Hall"; the description is shorter; the marketplace entry has a homepage and an author URL.
• Skill front matter is valid strict YAML (three skill descriptions were not).
• Literal NUL bytes removed from two source files; they now use the \0 escape.
• The monitor command quotes ${CLAUDE_PLUGIN_ROOT}, so it works when the install path contains a space.

Added

• README and PRIVACY have a "What it runs and writes" table.
• Hygiene tests: strict skill front matter, no NUL bytes in shipped files, icon at the plugin's top level, quoted monitor command.

0.121.7 (2026-10-03)

Changed

• devswarm.js roster prints a compact table of live workspaces with a "+N archived" line; --all lists archived ones and --json gives the full data as before.

Fixed

• The stale-handover reminder no longer makes a reply end with "refresh the handover first" after the handover was refreshed in that same turn.
• The workspace stop gate's cap message no longer says there will be no further stop blocks; it now says the limit starts over after a report.

Added

• The stalled-agent check records its phase timings when a run is slow, to diagnose a rare 30-second timeout whose cause is not yet known.
• Orchestration guidance: Claude Code rejects subagent files named report, summary, findings or analysis; name them differently.

0.121.6 (2026-10-02)

Fixed

• Stop-time task check: it no longer guesses the state of a task whose records are far back in a long session (it wrongly nagged tasks marked as waiting on the owner and re-opened finished ones). It now recovers the real state, and says so in one line when it cannot.
• Stalled-agent check: an agent that was stopped is no longer reported as silent. A resume, a launch and a finish now count only from real system records, not from text that merely quotes them.
• Quoted text is no longer mistaken for a real signal in four other checks: the merge gate (only something the user types can sign off a hedge; the assistant can no longer clear its own), the "safe to compact" declaration (table rows are ignored), DevSwarm idle tracking, and the task-list reset check.
• Judge setting: the jev.semanticJudge setting now actually enables the optional judge. Previously only the environment variable did.
• Docs corrected: CI matrix, release guide, Codex hook-event count, Windows wording, activate skill.
• A docs link check no longer fails on local, git-ignored files.

Added

• Handovers are never committed: git-guard blocks a commit that includes a handover (setting guards.handoverCommitGuard, on by default). Doctor lists tracked or out-of-format handovers, and the archived-workspace message names the exact handover path.
• The manifest declares the plugin icon. A code-owners file.

Changed

• New files named CONTINUE-HERE.md are blocked (existing ones stay editable). The deadly-loop state record moves under .anti-hall/.
• Historical plans and audit reports moved to docs/archive/. The test workflow pins its actions and declares read-only permissions.

0.121.5 (2026-10-02)

Fixed

• Claim ledger and second-opinion judge: both now check the reply actually being sent rather than the previous message, and a reply is never counted as evidence for itself.
• Marketplace listing text: the listing now shows the current short description instead of an outdated long one.
• speculation-judge reads the reply being stopped: the opt-in judge now sends the Stop payload's last_assistant_message to the model, not the previous transcript message. The transcript is only the fallback.
• claim-ledger judges the right message: when the transcript is one message behind the Stop payload, the payload text is the reply, the transcript's last message counts as evidence, and tools_this_turn is the running tool count for this turn. The last message of a session is now judged too. When the transcript is up to date the record and its hash are unchanged.
• Jev turn pointer: speculation-guard and claim-ledger no longer log a turnRef when the judged text came from the Stop payload, because the transcript's last line may be the previous turn. Nothing reads turnRef programmatically.

Changed

• License file: the plugin folder now ships its own LICENSE file.
• The privacy policy now states that the optional statusline reads your account email for display only.

0.121.4 (2026-10-02)

Fixed

• Doctor twin-record repair: the repair stage no longer reports "failed" on every run. Records it leaves untouched on purpose are now listed once each as "needs review", with the record id and the reason.
• Archived DevSwarm child: an archived child workspace is no longer woken by its own mailbox watcher, and its tick no longer asks it to re-arm. It is told to delete its own mailbox cron. A live workspace is never silenced.
• Archived-workspace handover check: it now recognises a flat handover file.
• Speculation check: it now judges the reply actually being sent rather than the previous message. That mix-up caused false blocks and let the real reply go unchecked. If the helper that reads the reply cannot load, the check falls back to reading the transcript instead of allowing silently.
• Mailbox watcher handoff line: the "handed off to " line now says when that version is only cached and not yet registered.

Changed

• Plugin icon: it is now 512x512 (under 256 KiB), so every shipped file is under the 256 KiB per-file limit.

0.121.3 (2026-10-02)

Fixed

• DevSwarm ingest warning: the "DEVSWARM INGEST FAILING" banner now appears once per episode instead of on every prompt. When the DevSwarm app's hivecontrol is timing out, it says so (the DevSwarm app is not answering, so check or restart it) instead of telling you to run doctor, which cannot fix a timeout. The doctor advice stays only for a real configuration fault.

• Stop-time open-task message: it now names tasks that were created long before, which previously showed as "(subject unknown)". The name is recovered only from a real, paired task-creation record; otherwise it still shows "(subject unknown)".

0.121.2 (2026-10-02)

Changed

• Docs: the README is cut to about 70 lines. All the detail moved to docs/GUIDE.md; docs/README.md is now the single documentation start page, and the README links to it in one place. The plugin README and the Codex README are slimmed in the same way.
• Demo: the README GIF is now a real Claude Code session. A force-push attempt is blocked by git-guard, and the agent falls back to a normal push. assets/demo/README.md documents how it was recorded.

Tests

• Every doc must be reachable from the docs start page; the Jev recommendation's full text is pinned in the KB doc.

0.121.1 (2026-10-02)

Added

• Jev: an optional backup vendor, jev.fallbackTransport (none|vercel|typesafe). It retries once when the primary times out, returns a server error, or is rate-limited or out of balance. It never retries on a rejected key. A per-vendor circuit breaker skips a failing vendor; when both vendors are failing, Jev is skipped. The docs note that the two vendors likely share a backend, so this is not full redundancy.
• jev-setup enable --fallback.
• Jev reporting: every decision records the vendor that served it, and whether the backup was used. The report and the weekly scorecard break down per vendor. The Vercel per-request cost is read.

Changed

• Jev keys are vendor-bound: jev_vercel_api_key and jev_typesafe_api_key. The legacy jev_api_key is bound to the vendor in the home-only setting jev.genericKeyVendor (default vercel), which is changed with jev-setup bind-generic-key. A key is never sent to a vendor it was not entered for. Behaviour change: a generic key used with the typesafe transport is no longer sent until it is bound, or re-entered as the vendor key.
• Jev: requests refuse redirects. Secret redaction now happens once, inside the client. Error bodies are never logged.
• jev-setup reads and writes the effective configuration. enable previously wrote a file that a newer settings file overrode. status warns when the two config files disagree, and doctor checks it. The balance is shown per vendor ("n/a" where a vendor has no balance endpoint). set-key no longer prints the key length.

Fixed

• Silent-agent warning: agents launched far back in a long transcript are now seen. A queued follow-up message no longer counts as the agent having finished. A resumed agent is tracked from the time of the resume.

0.121.0 (2026-10-02)

Changed

• Internal: scripts/devswarm.js is split. It is now a dispatcher (about 80 KB) plus 15 modules under scripts/devswarm-lib/ (the largest is about 156 KB). It is a pure move: the export surface (198 names), the CLI behaviour and the help output are unchanged. Every file is now under 256 KiB, and a hygiene test enforces that.
• Note for anyone patching the plugin locally: the verb implementations moved to devswarm-lib/.

Tests

• The mutation kit and the source-text checks treat the dispatcher plus devswarm-lib as one source unit. An export-surface snapshot test was added.

0.120.15 (2026-10-02)

Fixed

• DevSwarm roster and plan display. Shows "N/total done", plus "k doing" or "doing #i", instead of a last-touched step index that jumped backwards for plans worked in parallel. A re-opened or replaced plan shows the true count with "(plan changed)". Out-of-order completion no longer reads as all-done, which had silenced the stall, idle and burn signals.
• archive. Completes the app-side archive for workspaces whose builder is closed but still listed. The branch-name fallback runs only when exactly one non-archived builder has that branch, and it is the one being archived. An empty target is never sent. Other builders on the same branch or worktree are snapshotted before and after, and any side effect is reported. doctor --repair matches by exact id only.

Added

• Jev recommendation. A one-time recommendation notice when Jev is off (first session, then at most every 30 days; setting jev.recommendNotice), a doctor section, and a README "Enable Jev" block. The wording states only what is measured.

Security

• git-guard. No verdict changes. 181 heredoc-scanning bypass forms are pinned as must-stay-blocked. The substitution block message now explains that heredoc bodies are scanned as shell, and suggests the Write tool. The GUIDE documents the limitation.

0.120.14 (2026-10-02)

Changed

• BEHAVIOUR CHANGE: API keys come from sensitive plugin options. Jev and Anthropic keys are read from the plugin's sensitive options. Reading a key from the machine environment or a key file is now off by default and needs the home-only opt-in jev.allowLegacyKeyRead (Jev) or guards.allowAnthropicEnvKey (Anthropic env key), set in your home settings. An update migration enables the Jev opt-in once for existing installs that already have a key file, so those keep working. If you use an env-var key, or an Anthropic env key, set the matching opt-in or move the key into the plugin option. Key files must live under ~/.config or ~/.anti-hall and hold a single token.
• Previous release's Jev endpoint change (loopback-only test override) was hardening; it is not a feature change.

Added

• .anti-hall/ gitignore check. Doctor warns when .anti-hall/ is not git-ignored; --repair writes .git/info/exclude; a one-time reminder; setting guards.gitignoreHint.
• Community files. Issue forms, PR template, code of conduct, expanded CONTRIBUTING, and an issue-triage workflow (inactive until a repo secret is set).

Security

• Known secret shapes are redacted from text sent to the classifiers (best-effort, not a guarantee).

Docs

• Privacy. PRIVACY.md, the README "Network and data" section, and manifest privacy, documentation and support URLs.
• Directory and validator. No shipped text names input-rewrite or permission-decision fields; the Codex manifest no longer references the icon file; skills link out-of-plugin docs by URL; settings descriptions spell no shell pipeline; the Jev skills are reworded.
• Demo GIF re-recorded. AGENTS.md compacted to about 27 KB, with a 30 KB soft-budget test.

Tests and internal

• devswarm source-unit test helper (split stage 1); the migration test pins the old build by commit SHA.
• CI runs once per release, on rc-v* tags, sharded; main and PRs run a reduced matrix.

0.120.13 (2026-10-02)

Security

• Jev test-endpoint override is loopback-only. The Jev classifier's test-endpoint override (ANTIHALL_JEV_TEST_ENDPOINT) is now honoured only for loopback addresses. Previously, an environment value could redirect the request carrying the gateway API key to an arbitrary host. Users with a Jev key configured should update.

Fixed

• spawn submodule repair. Reports a bare 40-hex sha; byte-identical set-aside files are no longer reported as conflicts (the duplicate copy is removed); differing files state which copy is in place; a leftover set-aside dir holding env or credential files produces a warning.

Docs

• Release policy. RELEASING.md now states that rc tags are pruned after the release is published.

Tests

• Defect history. Added a single-tag test for the defect-history backfill.

0.120.12 (2026-10-02)

Added

• Plugin icon (plugins/anti-hall/.claude-plugin/icon.png), also referenced from the Codex manifest interface (composerIcon, logo).
• Short manifest description plus keywords in both manifests.
• CONTRIBUTING, SECURITY and issue templates.

Changed

• BEHAVIOUR CHANGE: scan-throttle is now advisory-only. It injects additionalContext and never rewrites the command or tool input.
• Codex anti-hall-activate and anti-hall-context-conserve skills run shipped scripts (codex/scripts/) in place of inline node -e one-liners.

Fixed

• The NUL dedup-key separator in doctor-runtime.js is written as an escape instead of a literal control byte.

Docs

• README overhaul: demo, what-it-blocks table, verify and uninstall, glossary.
• llms.txt uses absolute links.
• The Windows claim is corrected.
• Settings descriptions for allowGcloudReads and allowBackgroundScratchScripts reworded (text only, no detection change); GUIDE matches.

0.120.11 (2026-10-02)

Fixed

• silent-agent-nudge is no longer disarmed by an agent-list "running" row, and it survives compaction by adopting task_status attachments.
• killed and cancelled agents are treated as terminal (notification and task_status shapes). An adopted agent with no timestamp and no output file is never nudged.
• Orchestration rule I wording: no phantom heartbeat file, and "running" in an agent list is not progress.
• limit-conserve honours the caller's home in inbox tick, so it no longer reads or writes the real home from in-process tests.
• Hooks emit block JSON via a synchronous write.

Docs

• Docs alignment: Jev mode count, hook table, monitors and --auto, inbox tick in llms.txt, the locked safety key, deadly-loop-multi marked Claude-only, the Windows snippet removed, private project names genericised, and a scratchpad volatility note in the orchestration skill.

Tests

• LOCK LOST watcher test no longer races the watcher's own lock refresh (rare CI-only failure).

0.120.10 (2026-10-02)

Fixed

• The wake-watch update-available line is emitted once per new version, persisted across re-armed watchers, and says /reload-plugins.
• The task-guard IDLE NEGLECT text tells you to set blockedBy for tasks waiting on an in-flight task.
• command-guard allows chains of individually light segments with an allowed bounded form. Shell-wrapped and heavy segments still block.
• Read-only filters before a bounded last stage (... | grep -E x | head) are treated as bounded.
• Codex rate limits that surface only in background job logs are detected and recorded, so the Critic seat falls back and the Codex nudge stays quiet.
• The stale-version notice says /reload-plugins.
• A pipeline filter stage with any output redirect is never treated as read-only (fixes a Linux-only allowance).
• Dormant roster rows no longer show STRAYING, and supervision skips stall/burn nudges for them.

0.120.9 (2026-10-01)

Fixed

• tasklist-guard demanded a progress header started: taken from its own clock, so it changed every Stop and could never be satisfied. It is now derived once from the transcript and persisted.
• The running-agent count reads "unknown" instead of 0 when a launch is outside the transcript window, and never fires DISPATCH NOW on an unknown count.
• parent-gate re-checks the live own-unread count before blocking on a cached one.
• git-guard's command-substitution block suggests the Write tool for message text.

Added

• mesh read also returns messages.
• mesh history re-reads consumed broadcasts without moving cursors.
• inbox messages --with-broadcasts.

Changed

• After an update, /reload-plugins is the step to take. It was verified on 2026-10-01 to load new hooks and skills; restart only if a path still shows the old version.

0.120.8 (2026-10-01)

Fixed

• devswarm.js spawn repairs a submodule worktree DevSwarm failed to add. Root cause: DevSwarm's background, un-awaited worktreeInclude copy pre-creates the submodule dir before git worktree add -b. The repair sets the files aside, adds the worktree (attaching to an existing branch if needed) and restores the files without overwriting; conflicts are reported. The output includes a pinned-commit hint.
• send/mesh read/heartbeat from a non-worktree cwd (e.g. the session scratchpad) fall back to CLAUDE_PROJECT_DIR for a Primary.
• model-routing-guard no longer blocks a flagship on reasoning-heavy briefs (analyze/synthesize/read a PDF page by page), and never suggests haiku for them.
• command-guard allows a background direct-exec of an executable script in the session's own scratchpad, and names the allowed shapes. git pull and mutating fetches are labelled as state-changing remote operations.

0.120.7 (2026-10-01)

Changed

• /anti-hall:update runs update.js (and the DevSwarm supervisor/ingest installer steps) IN the main session instead of delegating to a Sonnet subagent. Reason: it runs migrations, and the main session must judge the result, per the owner's rule that deploys and migrations are never handed to a delegated model by default.
• command-guard exempts the anchored update.js and installer invocations.
• model-routing-guard blocks a subagent spawn that would run the update (setting guards.updateInSession, default on).

0.120.6 (2026-10-01)

Fixed

• devswarm.js archive reported appArchive.ok:true from hivecontrol's exit code alone, without checking the DevSwarm app, so a workspace could stay live in the app while anti-hall treated it as archived. The app archive is now VERIFIED against the app-DB snapshot, or against hivecontrol's archived:true response when the DB isn't readable. Note in passing: workspace list all keeps archived rows, so it isn't an archived signal. An unverified archive returns partial:true with manualCommand.
• archive <branch|meshId|uuid> archives the app side alone when the anti-hall descriptor is already archived.
• roster rows carry appArchived; appStillLive and a one-time Primary note surface workspaces the app still shows after an anti-hall archive.
• doctor detects that mismatch, and only an explicit doctor --repair runs the verified app archive.
• Verified live against DevSwarm on throwaway workspaces.

0.120.5 (2026-10-01)

Fixed

• devswarm.js roster no longer lists an archived workspace twice. A native branch-name row whose worktree maps to an archived descriptor folds into the archived row (hints:['archived']). The output adds liveCount/archivedCount.
• command-guard names state-changing remote operations (gh pr create/merge, git push) as such in its block reason, instead of "heavy". A ;-joined cd that would qualify with && gets a "use cd <dir> &&" hint. Behaviour is unchanged.

0.120.4 (2026-10-01)

Security

• git-guard now blocks launcher-dir writes via glob redirect targets and same-command variable targets (pre-existing).

Fixed

• git-guard reads a redirect target as its first word (fewer false blocks after an odd quote).
• command-guard allows git push ... > <own scratchpad file> (symlinks refused; newline-safe).
• Test fixtures use neutral ids.

0.120.3 (2026-10-01)

Fixed

• The update's reconcile step: a DevSwarm native message-count timeout with nothing imported or lost is now "skipped (native unavailable: timeout)", reported in one aggregated summary line, with one retry after a backoff, instead of "failed" per worktree.
• devswarm.js archive/unarchive/archive-request accept mesh ids, resolved like send --to. An ambiguous id lists the candidate UUIDs and archives nothing.
• parent-gate: unread broadcast rows to a done (archive_ready) child no longer count as neglect, and the escalation suggests archiving when every flagged child is done or idle.
• New regression tests for edit-guard handover writes and devswarm.js send loops.

0.120.2 (2026-10-01)

Fixed

• Compact advice/declaration guards no longer fire on a MENTION of the phrase: straight double-quoted text and backticked /compact mid-sentence are treated as quotes. Instruction forms ("Run /compact …", a standalone command line, a bare SAFE TO COMPACT line) still count.

0.120.1 (2026-10-01)

Fixed

• Compact-declaration guard deadlock: the auto-handover nag's mandated footer (GOOD POINT TO /compact NOW) and its pasteable /compact focus: … line were read as a SAFE TO COMPACT declaration, blocking every tool call in later turns; refreshing the handover (which the block itself demanded) was also blocked. Now only an explicit SAFE declaration counts, .anti-hall/handovers/** edits are always allowed, and leading hook reminders no longer stop a new user prompt from resetting the turn.

0.120.0 (2026-10-01)

Fixes from the second cross-project peer bug sweep (Primaries plus their workspaces), three rounds of adversarial security review of the command/git/edit guards, and DevSwarm identity, inbox and mesh fixes.

Fixed

• DevSwarm store id-collision guard no longer rejects a submodule path of the registered workspace. The persisted toplevel of a child running in a submodule (e.g. <ws>/sub) was compared against the workspace-keyed id as if it were a different worktree. The guard now resolves both directions to the outermost superproject root and treats them as the same worktree.
• Child summaries and sends refresh the plan progress clock; identical repeats do not. A child that was working (heartbeat --summary, mesh sends) but had not changed plan step was judged stalled. noteActivity now records activity with new text; text already among the recent signatures does not refresh, so a looping child still stalls.
• child-gate: one-time inbound-only warning when the native queue is unreachable and the outbound half is already satisfied. The gate re-demanded a heartbeat right after one was sent and prescribed inbox pull, which hits the same dead native channel. It now warns once (own kind, cap 1) with an exit that does not need the native channel.
• Queued-prompt bursts no longer repeat COMMS OVERRIDE and the primary TASK-LIST block; task-guard accepts workspace branch/title owners. N cron ticks delivered together showed the static block N times; it now collapses via emit-dedupe (keepalive = guards.injectionRepeatEvery). task-guard also accepts an owner spelled as the branch name or title of a live, non-archived workspace.
• No NOT DRAINING claim on graced fresh sends to stuck children; own-inbox escalation is count-free. The Primary's own-inbox-only escalation is held while usage limits are at conservation, and the forced-ack state is cleared on a fully clean pass so new mail starts a fresh budget instead of escalating immediately.
• mesh read/inbox row shape is normalized; mesh read --last/--since added (peek-only); project resolves from DEVSWARM_BUILDER_ID outside a worktree. The filters require --peek so they cannot consume unread rows.
• Guard housekeeping. tasklist-guard ledger wording, heredoc/comms hook housekeeping, edit-guard matches .anti-hall/** allowlist names against the project root when cwd is a subdirectory, submodule or symlinked spelling (additive, never narrower), and a line starting with RETRACT/RETRACTED/RETRACTING is a free-form retraction. Docs: one git writer per worktree.
• DevSwarm roster step counter is monotonic; a done-reported child no longer shows STRAYING stall/burn. The displayed plan step could move backwards, and a child that had reported done was flagged as stalled/burning while it was simply awaiting its parent.
• The devswarm-fold-mesh journal test no longer flakes on same-millisecond registry timestamps. The 2+ LIVE fold guard now seeds the second live entry on a later millisecond.
• command-guard judges shell-loop bodies per command and tracks cd. A for ... do node .../devswarm.js send ...; done loop was blocked while the single send passed, because the loop keyword stayed glued to the body and defeated start-anchored exceptions; the keyword is now stripped and each body segment is classified on its own. Bounded checks follow cd; path-qualified interpreters that exist as regular files are accepted; [npx] vitest run / jest on 1-2 explicit test files and a push of a HEAD sha are allowed (full suites, watch, --coverage stay heavy). The devswarm.js exemption now requires the file name to end at devswarm.js.
• git-guard: odd-quote heredoc prose no longer blocks the executed launcher. Launcher-dir redirect targets are attributed per line, so an apostrophe in a heredoc body does not make the real command look like a launcher-dir write. ditto is now a copy verb for launcher-dir writes.
• codex-quota parses "try again at " and codex-nudge stays quiet while limited. A Codex usage-limit message giving a reset as an ordinal date ("try again at Oct 3rd, 2026 ...") was not parsed, so no quota record was kept and the nudge kept firing. The date is now parsed, an unparseable limit message falls back to a 6 h cooldown, and codex-nudge is skipped while a quota record is live.
• DevSwarm Primary registration and workspace listing no longer key a submodule cwd as its own worktree. register-primary, workspaces list, archive-prefix and the ingest installer workdir used the submodule toplevel, minting phantom Primary rows. They now use the superproject-folding resolver. doctor detects existing phantom submodule Primary rows; only doctor --repair archives them (nothing is deleted).
• command-guard read-only-verify and push carve-outs tightened (review round 2). cd is honoured only as an &&-chained step (not after ||, in a pipe, or after ;) and the cd target and script path are realpath'd, so symlinks cannot steer an anti-hall script past the refusal; the vitest/jest carve-out requires each operand to be an existing regular *.test.*/*.spec.* file (a bare .test.ts is a filter pattern); a short-sha push source must resolve through git to exactly HEAD (a tag named like the sha no longer matches); a leading ! negation (while ! npm test; ...) no longer hides the heavy verb.
• work-detect: a << after an unquoted # is a comment, not a heredoc. The lines below it were dropped as heredoc body and hid real work from the housekeeping-only verdict.
• git-guard: the quote-blind launcher backstop is skipped unless the text can contain an anti-hall path; a backslash-newline collapses only after an odd backslash run. The backstop made the 160 KB cd-chain PERF test about 10x slower; an O(n) precheck restores it. A launcher-dir-looking path with an escaped backslash before the newline no longer false-blocks.
• work-detect: an escaped \<< is not a heredoc, and a partly quoted delimiter (<<E"OF") ends at its unquoted word. Both dropped real commands from the housekeeping-only verdict.
• Defect channel: two concurrent defect report calls for the same fingerprint could lose one line. The creating process opened the file without O_APPEND and overwrote the other's append. The file is now created with 'ax' (O_CREAT|O_EXCL|O_APPEND).

Security

• git-guard: a leading ! negation was not treated as a wrapper word, so if ! <push with a force flag>; then ..., while ! <force push>; ... and if ! <push of an empty-source refspec>; ... slipped past the force-push and ref-deletion checks. ! is now resolved like if/then.
• git-guard: git accepts unique prefixes of long options, so abbreviated push deletion options (--del, --dele, --pru) and force/mirror options (--force-w, --for, --mir) were not recognised. git push long options are now resolved by unique-prefix match; an ambiguous prefix counts as every candidate (fail-closed, --f blocks as force).
• git-guard: a launcher-dir write (cp/tee/mv/sed -i/install/ln/cd+write) placed after a heredoc body with an unbalanced apostrophe was not detected; a quote-blind per-line launcher backstop now blocks it.
• git-guard: a quoted redirect target spanning a newline (>"$HOME/<NL>/../<launcher dir>/x", also >>, 1>, &>, x>) escaped the launcher-dir write block because the target was cut at the newline. Redirect words are now read from the raw text (a quoted span runs to its matching quote) in both the quote-aware pass and the backstop.
• git-guard: a backslash-newline continuation in the middle of a launcher-dir path (> ~/<dir>/\<NL>bin/y) bypassed the launcher-dir write block; continuations are now removed (as bash does) before launcher analysis.
• git-guard: git push deleting a remote branch/tag (--delete, -d, origin :<ref>, --prune) is now blocked with a reason naming the skip.json override; deleting published refs needs explicit owner confirmation.

0.119.0 (2026-09-30)

Fixes from a cross-project peer bug sweep plus Jev measurement fixes: the wake watcher, STALE DATA banner, reload/restart wording, guard hints and home isolation, and jev report gains rare-trigger counters and --exclude-project.

Fixed

• Wake watcher no longer wakes non-DevSwarm sessions. monitors.json ("when": "always") starts the watcher at every session start, and every stdout line is a transcript event, so a plain terminal session got REFUSED TO ARM: not-a-devswarm-session and spent a model turn on it. The harness-started entry now passes --auto; with it the expected refusals (not-a-devswarm-session, disabled-by-settings) go to stderr only. A model-armed watcher still prints its one refusal line.
• Wake watcher and companions no longer emit the node:sqlite ExperimentalWarning, and the watcher can hand off on every later release. On Node 22.5+ the first require('node:sqlite') wrote an ExperimentalWarning to stderr, and under the harness Monitor every stderr line is a wake event, so each one cost the model a turn for noise. All companion and devswarm.js loads now go through companion/lib/sqlite-quiet.js, which swallows only that one warning during the load. Separately, the handoff loop guard allowed one handoff per process chain (stamp 1), so every second release in a long-lived chain ended in STALE BUILD plus a manual re-arm. The stamp is now the target version, and a handoff is allowed whenever the newest version is strictly newer than the stamp; same-or-older targets and legacy or non-semver stamps are still refused.
• The ingest STALE DATA banner is emitted once per stale episode and says what is at risk. The banner repeated on every turn and only told the user to run /anti-hall:doctor. It now goes through staleBannerOnce (a recovery clears the record; re-emits only when staleness crosses a coarser tier, with a 50-turn keepalive). The text names what may be stale (roster and app-state freshness) and notes that mesh sends are written directly to the store and are not affected. When launchctl print-disabled lists the ingest job as disabled, the banner says self-heal is skipped and gives the one-line launchctl enable command; anti-hall never runs it.
• The Primary no longer gets told a dead, older session "was active until" a recent time. Session recency compared another session's start and its handover mtime against the current session's start, so a long-running live Primary was warned about an older dead session, and unconditionally when its own transcript was not matched. Both checks (primary-seat stale-resume and anchorSessionDrift) now compare transcript last-activity by stat only, and stay silent when the current session's activity is unknown. handover-resume also adds a WRITER KEPT RUNNING line when the handover's writer transcript was written more than 5 minutes after the handover.
• tasklist-guard no longer counts .anti-hall/handovers writes as work. Writes to .anti-hall/handovers/ (which the handover flow itself directs) and cwd-relative .anti-hall/progress|history|handovers/ paths counted toward the work threshold. The exemption pattern now covers handovers and accepts a path with no leading slash.
• PARENT INBOX hints and update wording name the stable launcher and the right reload step. Hints in devswarm-parent-inbox embedded the version-pinned plugin-cache path, which goes stale after /reload-plugins or once an update prunes that version directory. A shared preferStableLauncher (in hooks/lib/stable-launcher.js) now returns the ~/.anti-hall/bin launcher when it already exists and devswarm.stableLauncher is on, and is used by the parent-inbox and child-turn hooks and the primary-seat conflict text in devswarm.js. The update skill, version-alert, and the registry-lag note now say /reload-plugins only when the plugin cache alone changed, and a full restart of Claude Code when the harness registry names a newer build than the running session. The update skill also respawns a Sonnet delegation with model:"opus" when Sonnet is unavailable or usage-exhausted (never Haiku).
• edit-guard's DevSwarm block text points at the exempt notes locations. The block message now says session notes and reports can go in .anti-hall/history/** or the scratchpad (exempt), and that repo docs need a subagent or a trusted .anti-hall/edit-allow.json.
• command-guard blocked the background scratch-script shape its own block text recommends, and the timeout form of anti-hall CLI calls. A run_in_background scratch script chained with a read sink (script > out; wc -l out) was refused because the allowance covered a single unbroken segment only. The check now accepts segments joined by ;, && or |, each either a scratch-script segment or a bounded sink (wc, head, tail, grep -c / grep -m N), with at least one script segment required. Separately, timeout N node <dir>/devswarm.js roster | head was blocked while the same line without timeout passed, because the anchored anti-hall CLI exemptions did not see through the wrapper; isHeavySegment now also matches the command with a leading timeout [-flags] <duration> removed. The heavy-pattern block text now names the working shape: use the literal absolute scratchpad path (not $VAR) and chain only wc/head/tail/grep -c/grep -m N.
• askDetached (Jev) defaults to the 3000ms ceiling instead of the 1500ms interactive budget. A detached Jev call no longer inherits the shorter interactive timeout.
• Spawned hook children carrying the test-isolation marker can no longer resolve the real home. resolveHome in companion/lib/test-home-guard.js now refuses a child whose HOME is missing or real instead of falling back to the developer's ~/.anti-hall; covered by new cases in no-real-home-entrypoints and git-guard tests. The commit also bounds Jev row volume per git-guard invocation.
• Rare Jev triggers are counted and shown in jev report. speculationFramed and devswarmOnBrief / devswarmExtraSanctioned occurrences are now recorded as counters and listed in the report.
• jev-report --exclude-project <name> drops the raw rows of a leaked or synthetic project from the report.
• Test hygiene. New os.homedir() call sites in handover-resume.js and emit-dedupe.js (forget) now go through resolveHome (the homedir-call-site-ratchet baseline stays 315), and the handover-resume test's git spawn isolates HOME/USERPROFILE.

Notes

• git-guard still treats a launcher-dir write command quoted inside a heredoc body as a real write (fail-closed); a narrower exemption was tried and reverted after review found real bypasses — write such text with the Write tool.
• workflow-drift-guard false positives on conditional test.skip(cond, …) come from oh-my-claudecode, not anti-hall.
• the 2026-09-28 10:57–11:01Z jev-assist rows from project v117-int are synthetic; exclude them with --exclude-project v117-int.

0.118.0 (2026-09-30)

DevSwarm wake-watch/limit-skip and nudge/roster fixes, a codex-nudge scratchpad-exclusion fix, and further git-guard hardening — five field-reported fixes, each root-caused against a reproducing test before the fix.

Added

• devswarm.wakeWatchIdleSkip (default true, #39) — a DevSwarm Primary with 0 LIVE (non-archived) child workspaces gains nothing from an armed wake-watch Monitor (nothing will ever message it), yet re-arming it every cron tick still costs a turn. When on and the caller is a Primary with 0 live children, inbox tick reports watcherArmed idle-skip (never the boolean false), so the cron prompt's "re-arm if watcherArmed false" rule stays inert; if devswarm-wake-watch.js is started anyway it prints [wake-watch] idle-skip: no live child workspaces — not arming (cron fallback covers) and exits 0 without ever acquiring the watch lock. A live child (companion/lib/ devswarm-live-children.js hasLiveChild) leaves both paths unchanged; an archived-only child still counts as 0 live. The cron fallback itself is never removed or altered. Metric: ~/.anti-hall/devswarm/rearm-cues.jsonl (trigger idle-skip), surfaced by doctor as "wake-watch idle-skips: N". Codex mirror: inbox tick's watcherArmed documentation updated in plugins/anti-hall/codex/skills/ anti-hall-devswarm/SKILL.md (Codex has no Monitor tool, so a Codex workspace never produces idle-skip itself).

Fixed

• nudge <id> escalated immediately ("poke-exhausted") on the very first call after a child had been idle over an hour. computeLiveness's resolved-to-alive paths (heartbeat-fresh, nudged→alive on advance, and the general recompute) carried a stale nudgeAttempts/nudgedAt forward from an EARLIER episode instead of resetting them — only the heartbeat-fresh branch reset the poke budget. A LATER, unrelated stale spell then inherited an already-exhausted budget and escalated on its first pokeOrEscalate call. companion/lib/liveness.js's two remaining resolved-to-alive returns now reset nudgeAttempts/nudgedAt on that episode boundary too. The escalation notice into the parent's store now also tells the owner to click/continue the workspace in the DevSwarm app (still allows reassign/archive), and lastNudgeError is preserved unchanged.
• nudge <child meshId> failed {"ok":false,"error":"no descriptor for workspace ..."} while send --to <that same meshId> worked. cmdNudge looked up only readDescriptorFile(home, id) (an exact builder-id match), with no meshId resolution at all. It now falls back to the SAME resolution send uses (resolveSendTarget: meshId match, then exact registry-id, then a one-hop retired-redirect) before failing closed.
• roster from a cwd outside any project (e.g. a session's scratchpad) returned bare {"ok":false,"reason":"no-project"} with no guidance. repoKey is always git-derived (there is no repoId→repoKey registry to fall back through — DEVSWARM_REPO_ID is a caller-declared label, not a store key, and trusting it here could silently read the wrong project's roster), so roster now returns an actionable error string (same wording as send's own no-project error) instead of inventing a new resolution path.
• task-guard's IDLE NEGLECT block never mentioned delegating a task to a live DevSwarm child workspace. When at least one live (not-archived) DevSwarm child workspace exists, the IDLE NEGLECT reason now adds one line: delegate the task by setting its owner to the workspace id (TaskUpdate owner), which already counts as attended via the existing devswarmChildAttended check — detection is unchanged, this only documents the option.
• The "CHILD NOT DRAINING" nudge repeated every single turn for an idle child. devswarm-parent-inbox.js's normal-tier unread segment (buildUnreadSegment) passed no keepaliveTurns to its on-change dedupe call — unlike the urgent tier just above it — so an UNCHANGED segment re-fired on every delivered turn once the prior copy was consumed. It now passes keepaliveTurns: 2 (same pattern the urgent tier already uses), capping repeats to 2 before going quiet until the content actually changes (new mail, a drained inbox, a status flip) or the keepalive window resurfaces it. Suppressions are counted in a new not-draining-suppressed.jsonl, reported by doctor --check alongside the existing cron-found-mail.jsonl line.
• codex-nudge.js counted scratchpad-only and out-of-worktree edits as "substantial code edits", nudging for a Codex review over disposable repro scripts. Seen twice for *.py files written to the session's own scratchpad (/private/tmp/claude-<uid>/<encoded-cwd>/ <session>/scratchpad/), and once for a scratchpad .js repro script. The edit counter now excludes any edited path strictly inside the session's own scratchpad (reusing lib/scratchpad.js's ownScratchpadDirs/isInsideDir, derived from transcript_path's encoded-cwd segment — the same mechanism edit-guard.js/command-guard.js already use) and any path outside the session's git worktree, when payload.cwd resolves to one (via companion/lib/identity.js's resolveContext, the single canonical worktree resolver — no new filesystem walk). Both checks fail open when the needed payload fields are absent.
• git-guard: more force-push/wrapper bypasses closed (0.117.2 follow-up, A1-5/A1-6). None needed a quote desync. git push --mirror force-updates and deletes every remote ref and is now treated as a force push. time -p/command -p used to resolve the effective command verb to -p itself, skipping the wrapped command entirely - both now skip their own -p flag. coproc git push --force ... is now recognized as a wrapper, like exec. An xargs-run git push is now treated as a force push whether or not the visible argv already carries --force: xargs appends words it reads from stdin as trailing arguments, so a hidden -f (e.g. echo -f | xargs git push origin main) cannot be ruled out statically. env -S 'STRING'/--split-string (which word-splits STRING and runs it as a new command) is now unwrapped and re-scanned, and a bash -c $'...' ANSI-C-quoted payload is now decoded before being re-parsed (it used to carry a literal leading $ into the recursed command, so the verb never resolved to git). A literal string piped into a bare shell (echo "git push --force origin main" | bash) or fed via a here-string (bash <<< "git push --force origin main") is now recognized as feeding that shell's stdin as its script, the same as bash -c "...".
• git-guard: quadratic scan on many git commit -F - segments (0.117.2 follow-up, A1-6). extractQuotedLiterals(cmd) ran once per -F -/--file=- segment over the FULL, unchanged command string; 20000 such segments took about 13s, over the hook's 10s timeout (a fail-open miss of a trailing force push). It is now memoized per distinct command string, computed once instead of once per segment; the same input now decides in well under 100ms.
• emit-dedupe: a fixed-turn-count keepalive block (parent-inbox-urgent, keepaliveTurns: 10; NOT DRAINING, keepaliveTurns: 2; limit-conserve; verify-first; task-tracker) could go silent forever on Codex. The fallback window used when the transcript cannot confirm consumption (always true on Codex, which has no hook-attachment transcript) doubled as BOTH the pending-suppression window AND the "new turn" detector once dedupeWindowMin (default 20 min) replaced the old fixed 15s constant for the former. A dedupeWindowMin of 20 minutes meant a turn only counted as "new" every 20 minutes, so a keepaliveTurns: 10 block needed over 3 hours of unchanged content before it re-surfaced — effectively never, on a normal cadence. The "new turn" check is now back on the original fixed 15s threshold regardless of dedupeWindowMin, which continues to govern only the initial pending-suppression window.
• git-guard: an xargs-run git command merely MENTIONED inside a quoted commit message or redirect target was wrongly treated as a live command (A1-2, 0.117.2 follow-up). xargsGitVerdict ran from the quote-BLIND backstop split (cuts at every |/;, inside or outside a quoted string), so e.g. git commit -m 'docs: explain why ls | xargs git push is blocked' or echo '... | xargs git push origin' > notes.txt false-blocked. It now runs only from the quote-aware segment scan and the quote-aware per-line backstop recovery pass; a real echo -f | xargs git push origin main still blocks, and an xargs-run git command inside a heredoc BODY line still blocks too (heredoc bodies are deliberately scanned as shell, unrelated to this fix).
• DevSwarm inbox tick's wake-watch idle-skip scoped "does this Primary have a live child?" from the CALLING process's cwd instead of the tick id's own registered worktree (A1-3). A tick invoked from a different clone/checkout of the same project than the one id is registered under resolves to a DIFFERENT repoKey (repo-keyed off --git-common-dir, which is per-checkout), so hasLiveChild's project scoping silently missed every real sibling child and idle-skip fired even with a live child present. The scope now comes from id's own registered descriptor's worktreePath; when that cannot be resolved, the idle-skip check is skipped entirely (fail open, never idle-skip on an unresolvable scope) rather than falling back to the calling cwd.
• git-guard: the -F -/--file=- stdin-commit-message scan was still O(N^2) on many segments with quoted text (A1-4, 0.117.2 follow-up). A1-6's memoization cached only extractQuotedLiterals's result ARRAY; the candidate-text .join() and the self-credit regex test against that joined text still ran unmemoized on every -F - segment, so a command with quoted text on each segment (e.g. git commit -F - <<<'m'; repeated 20000 times) still paid an O(cmd.length) join + regex scan per segment. Both are now memoized per distinct command string alongside the literal array.

Changed

• command-guard.js's "Heavy command detected" delegation text now surfaces the scratchpad-script path first. The "write it to the scratchpad and run it with run_in_background" option used to be the very last clause of the block message, easy to miss before reading it as a plain "spawn a subagent" instruction. A one-line version now appears right after the first sentence in both the DevSwarm-primary and non-DevSwarm variants. Text only — no change to which commands are allowed or blocked inline.

0.117.2 (2026-09-30)

Security fix for git-guard.

Fixed

• git-guard could miss a force push that came after a heredoc or a stray quote (0.116.1 and 0.117.1). git-guard splits a command into its separate commands while tracking quotes. Some text threw that tracking off: an apostrophe in a heredoc body (It's done), a quote in a # comment, or a heredoc inside a quoted $( … ). When that happened, the rest of the command looked like one long quoted string, so a later force push was allowed. git-guard now also runs a quote-blind check. It cuts the whole command at every newline, ;, &, |, (, ), $( and backtick, ignoring quotes, heredocs and comments, and applies the git rules to each piece: force push in every form, push arguments built by command substitution, command-valued git config, and AI self-credit trailers on commit-creating commands. These pieces are also checked inside eval and bash -c payloads. The command is blocked if either check blocks it. Rules that are not about git, such as launcher-directory writes, still use only the quote-aware check. Known and deliberate: quoted text that has a separator right before a literal force push, such as git commit -m "don't; git push --force", is now blocked. A plain mention like git commit -m "never git push --force" is still allowed.
• Slow arithmetic scan. Long inputs with many << inside $(( … )) took about 9 s to check, close to the hook's 10 s timeout. The scan now continues from where it stopped instead of starting again at the beginning, so a 96 KB input is checked in about 30 ms.
• Follow-up hardening on the quote-blind check above. The quote-blind check cuts a command into pieces at every ; & | ( ) and backtick, so it could also cut INSIDE a git command's own quoted argument - git -C "$(pwd)" push --force-with-lease origin main, or a -m/--trailer message containing one of those characters (a conventional-commit subject like feat(x): y opens with (). That split the piece holding the git verb from the piece holding --force/the trailer, so the command was allowed. The check now also re-reads each physical line on its own with the normal quote-aware splitter and applies the git rules to it - a line is almost always quote-balanced by itself even when the whole command is not. Also, a force push inside the condition of an if/while/until/elif (e.g. if git push -f origin main; then …; fi) was never checked at all; those are now recognized the same way then/do/else already were. And a regex alternation grouped in parentheses (e.g. grep -E "(a|git push -f)" x) was wrongly blocked, because the quote-blind check's own (/) cuts split the still-open quoted pattern across more than one piece before its closing quote; the check now tracks the quote state across pieces on the same line instead of only the one piece right after a |.

Fixed

• UserPromptSubmit injection burst deduplicated by a configurable window (field report) — a DevSwarm Primary idle through a multi-day usage-limit outage had every queued cron/wake prompt re-delivered together on resume, and each one re-triggered anti-hall's full LIMIT CONSERVATION, TASK-LIST, DEVSWARM COMMS OVERRIDE and DEVSWARM WORKSPACES injection blocks — one resumed turn carried ~60 identical copies (~150 KB). hooks/limit-conserve-inject.js, hooks/task-tracker.js and hooks/devswarm- child-turn.js already deduped their static blocks via hooks/lib/emit-dedupe.js (as does hooks/devswarm-parent-inbox.js's WORKSPACES table); the fallback window used when a burst's consumption cannot be read from the transcript is now driven by the new context.dedupeWindowMin setting (default 20 minutes, 0 = off/disables emit-dedupe entirely) instead of a fixed 15s constant. Suppression counts (per session and overall, with a last-suppressed age) now surface in /anti-hall:doctor via hooks/lib/emit-dedupe.js's new summary().
• inbox tick reports watcherArmed limit-skip while LIMIT CONSERVATION is active — the mailbox-tick cron prompt tells the agent to re-arm a lapsed Monitor wake-watch when watcherArmed reads false, which directly contradicted LIMIT CONSERVATION's own "defer non-urgent work" instruction while both were active at once. inbox tick (scripts/devswarm.js cmdInboxTick) now checks hooks/limit-conserve.js isConserving() after the existing idle-skip check and, while conservation is active, reports the string watcherArmed limit-skip instead of false — sibling behavior to devswarm.wakeWatchIdleSkip's idle-skip, no separate setting. The cron prompt text (hooks/lib/devswarm-wake.js drainCmd's rearmClause) now says both idle-skip and limit-skip mean "do not re-arm"; the cron job itself is never altered. Metric: same ~/.anti-hall/devswarm/rearm-cues.jsonl ledger, trigger limit-skip, surfaced by doctor as "wake-watch limit-skips: N".

0.117.1 (2026-09-28)

Four field-reported fixes from DevSwarm child workspaces, all root-caused against a reproducing test before the fix.

Fixed

• edit-guard's own-scratchpad exemption broke after an in-session cd. The session scratchpad directory is named after the session's ORIGINAL project cwd, but the exemption re-derived it from the LIVE cwd on every call — after a cd (e.g. into a DevSwarm child worktree), a legitimate Write/Edit into the session's own scratchpad was wrongly blocked with the edit-delegation message. lib/scratchpad.js's ownScratchpadDirs() now prefers the encoding read off transcript_path's parent directory (the harness's own record of the session's original cwd), falling back to cwd when the transcript path is absent, with no change to which session a scratchpad belongs to (still scoped strictly to session_id).
• A child's first-ever heartbeat --summary (before any register) was silently dropped — then the first fix for that opened an impersonation hole. cmdHeartbeat's mesh-broadcast ownership check required a pre-existing registry row for the target id before considering any ownership leg; a workspace's very first interaction is often a direct heartbeat <id> --summary ... with no prior register, so the broadcast was refused caller-not-registered and never reached the shared store — devswarm-child-gate.js's Stop gate then kept re-prescribing the same heartbeat forever. The first cut of the fix gave broadcastFamilyOwns a first-claim leg that granted ownership of ANY never-registered id to ANY cwd-resolved caller — which let an unrelated caller impersonate a sibling's FUTURE id and lock the real owner out once claimed (review finding B-a0-impersonation). First-claim now additionally requires GROUND TRUTH: the DevSwarm app's own database (builderForWorktree, the same ground-truth reader the register-path app-archive guard already trusts) must name a builder for the caller's own resolved worktree whose id is exactly the id being claimed — a bare DEVSWARM_BUILDER_ID declaration is never sufficient proof by itself. No app-DB match (DB off/unreadable, no builder row for the worktree, or a different builder id) fails closed, same as any other refusal. Also: a dropped --summary now carries a plain top-level note: 'summary NOT recorded: <reason>' instead of only a nested dropped/dropReason pair that was easy to miss.
• First-claim heartbeat ownership: follow-up hardening round (the app DB "ground truth" was itself env-forgeable). The fix above's own claim that the app-DB ground-truth reader "never consults env" was wrong: its DB file path honors ANTIHALL_DEVSWARM_APP_DB with no gating, and a real CLI invocation's ctx.env defaults to process.env — the same process env the untrusted caller controls — so a caller could point the "ground truth" DB at a throwaway sqlite file of its own and claim any never-registered id through the very leg meant to stop that. The override is now honored only when an in-process caller (tests, another in-process embedder) supplied its own env explicitly; a real CLI invocation always resolves the fixed per-OS app DB path. This leg also now matches an ACTIVE app-DB builder row only — an archived/hidden-only row at the worktree no longer grants first-claim.
• A workspace could register itself with the exact id system. Mesh code reads a row's sender/from field to attribute a message; a workspace registered as system would make its own outbound rows indistinguishable from a genuine system-authored one. 'system' is now a reserved EXACT id (never a substring match — an id that merely contains "system", e.g. ecosystem-service, still registers normally) on a fresh register, refused the same way the existing reserved-token ids are.
• devswarm.js nudge <id> gave no reason for "poke-exhausted." A failing poke (e.g. the session's channel is unreachable) was silently swallowed; pokeOrEscalate now persists the failure as lastNudgeError (carried across sweep ticks) and, once attempts are exhausted, the escalate result carries lastNudgeError plus a human line: "session appears dead/unreachable — needs a manual continue in the DevSwarm app."
• Escalation notices into the parent's inbox showed a blank sender. The synthetic escalation row had no sender at all (rendered as an empty "from:" line) — root cause was two-fold: the row literal was missing sender: 'system', and the delivery path itself (via: 'message') only persists {workspaceId, ts, hash, body} and silently drops every other field including sender; delivery now goes through the mesh-aware via: 'row' insert (already used elsewhere) so sender is actually written.

0.117.0 (2026-09-28)

Measured. Every new judgment/automation surface in this release ships its own effectiveness report: DevSwarm dispatch demand (scripts/dispatch-report.js), Meeseeks supervision — plans, warnings, corrections, respawns, token burn (devswarm.js supervision-report), and Jev's own agreement-vs-deterministic-signal and follow/override counts (jev-report.js, folded into supervision-report per integration).

Added

• DevSwarm Meeseeks supervision: step plans (P1). spawn -p turns a numbered list in the brief into the child's step plan (~/.anti-hall/devswarm/plans/<key>.json; a Scope: line becomes its file scope). A brief without a list is never refused. New verbs plan set|show; heartbeat --step N --status doing|done|blocked. The workspace table and roster show step 3/7 · 42m · progress 18m ago. Settings devswarm.planTracking (on) and devswarm.planRequired (off). Rows without a plan render exactly as before.
• Straying detection + correction (P2). For planned children only, the supervisor sweep raises advisory signals: stall (busy, no step progress for devswarm.stepStallMin, 30 min), off-scope (ready-check --allow over scope ∪ extras), idle (stale liveness verdict) and burn (see below). Each episode warns once, capped at devswarm.strayWarnMax (2) per signal per step. The Primary gets one capped DEVSWARM STRAYING line per warning per session on Stop (stable alert kind devswarm-straying, never a block), STRAYING: … and +N extras on the table cell, and plan.straying on the roster. devswarm.js correct <id> [--dry-run] sends "step N '': . Return to step N or reply BLOCKED " and records warned_at only after the send succeeds. Nothing is automatic; respawn stays manual.
• User-sanctioned extras. devswarm.js scope add <id> --glob G --note TEXT: the child tags extra work a user asked for; tagged globs stop counting as off-scope and the Primary sees the note. The child-turn hook tells a planned child to do this.
• Token burn. The sweep reads each planned child's own session transcript incrementally (byte offset per workspace, complete lines only, one count per message id) and computes weighted tokens: input + output + cache writes + devswarm.burnCacheReadPct% (10) of cache reads. A burn warning fires past devswarm.burnTokensWarn (2M) since the step last moved ("used 2.1M tokens since step 3 last moved", also in the correction text). The table and roster show · 1.8M tok; the table's change-dedupe ignores the rising figure. Codex children have no Claude transcript and get no burn figure.
• Five Jev supervision integrations, as recommendations. jevIntegrations.devswarmOnBrief, devswarmExtraSanctioned, devswarmWaitKind, devswarmLoop and devswarmStepMap default on: asked detached from the sweep only when a deterministic precondition fires (one ask per input per devswarm.supervisorBlockerLabelReaskSec), inputs capped and secret-scrubbed, answer read from the cache next sweep. The verdict and confidence ride on the warning ("Jev: waiting on CI/owner/peer, not stuck 0.92"); Jev never suppresses a warning, blocks or kills, and the Primary decides. shadow logs only. jev-setup.js mode knows all five.
• Supervision effectiveness metrics. ~/.anti-hall/logs/devswarm-supervision.ndjson (1 MB × 5, daily rollups in devswarm-supervision-daily/) records plans, step changes, warnings, corrections, corrections followed by step progress, extras, done (time-to-done, steps done vs planned, tokens per completed step), token periods and Jev answers. devswarm.js supervision-report [--days N] [--json] reports warnings by signal and repeats, the correction follow rate, extras, tokens per workspace and per step, burn warnings and their corrected rate, and per Jev integration its agreement with the deterministic signal and the Primary's follow/override counts. doctor prints a one-line 7-day summary.
• Primary-run respawn that keeps progress (P3). devswarm.js respawn <id> [--dry-run] replaces a straying child. It refuses unless the caller holds the Primary seat, the plan has warned_at (a correct was sent) and devswarm.respawnGraceMin (20) minutes have passed; nothing runs it automatically and it never kills. In order: it asks the child to commit and push its WIP and waits up to devswarm.respawnWipWaitSec (120 s); commits anything still dirty or unpushed through a private index onto a new park/<branch>-<ts> branch and pushes it (the child's worktree is untouched, nothing is stashed or discarded, and a failed park or push aborts the respawn with the local park branch kept); writes plans/<id>.handover.md; spawns <branch>-r<N> with -s <default branch> (not -s <old branch>, which would make the old branch the merge target) whose step 1 merges the old or park branch, followed by the remaining steps, scope and extras; archives the old id and asks the owner to close its app tab. --dry-run prints the plan with no side effects. Metrics: respawns, WIP parked or not, aborts, time to first step progress in the new workspace and whether it finished, in supervision-report.
• Token savings. A 24h field measurement found idle DevSwarm wake turns re-paying ~620K-930K tokens each (mostly cache reads) against a ~90K fixed per-turn floor, with 48 Monitor-expiry turns and 45 mailbox-tick turns running on overlapping 30-minute cadences. Four owner-approved levers, each with a settings key:
• Monitor re-arm only at the cron tick (devswarm.rearmOnTickOnly, default true). The SessionStart wake directive (hooks/lib/devswarm-wake.js monitorArmLine) no longer tells the agent to re-arm a lapsed Monitor watcher inline on the tool's own final/expired event — it replies in ≤1 line and stops; the cron tick's own watcherArmed:false check (drainCmd's rearmClause) is the one re-arm trigger. false restores the pre-0.117.0 wording. The cron fallback itself is never disarmed (unchanged, non-negotiable). Metric: ~/.anti-hall/devswarm/rearm-cues.jsonl records each re-arm cue by trigger (tick/expiry; scripts/devswarm.js recordRearmCue), written from inbox tick's existing watcherArmed computation.
• Prune completed tasks (guards.pruneCompletedTasksAfter, default 10). Claude Code's own TaskCreate reminder re-prints the whole task list, completed tasks included, every few turns. Once completed/cancelled tasks exceed the threshold, task-guard.js emits a one-line advisory at Stop (never a block) to prune them via TaskUpdate status=deleted after recording them in the history ledger. Metric: the completed-task count at Stop (visible in the advisory itself). Advisory only — never gates the Stop hook.
• Deadly-loop scales to risk. skills/deadly-loop, skills/ship-it (and their Codex mirrors codex/skills/anti-hall-deadly-loop, codex/skills/anti-hall-ship-it) now lead with a decision table: the full Reviewer+Auditor+Critic trio only for guard/security/parser/schema/CI/shell changes, one reviewer for normal code, none for text/doc-only changes. Guidance only, no metric.
• Periodic peer/check crons default to a longer cadence. Verified (git grep/command grep, not the shell grep alias) against every CronCreate reference in plugins/anti-hall/skills and plugins/anti-hall/hooks: the only agent-created periodic cron in the plugin is the DevSwarm mailbox-wake tick, which this release deliberately leaves at its existing 30-minute cadence per the owner's mailbox-tick carve-out. No second periodic peer/check-in cron directive exists in the codebase to retune.
• Jev: dispatchTier, speculationFramed, and a durable review-due reminder. dispatchTier is a shadow advisory on whether pending work belongs in a DevSwarm child workspace or a plain subagent. speculation-guard's framed-expectation calls (speculationFramed) are now judged by Jev in shadow instead of the bare heuristic alone. A JEV REVIEW DUE reminder (SessionStart + doctor) resurfaces periodically so labelled-but-unreviewed Jev calls don't go stale.
• Orchestration: dispatch demand survives the machine-wide heartbeat, respects maxParallelDispatch, and honours addBlockedBy. The parallel-dispatch nudge used to be blanket-suppressed by a single machine-wide heartbeat, so it could silently stop firing even with pending unblocked tasks; it now fires per pending/unblocked task and is capped by the new maxParallelDispatch setting. SendMessage-resumed agents now count as running (not orphaned) against that cap. Tasks are scoped to the current task-store epoch so a restored/reset store doesn't resurrect stale nudges, and nudges now show the task subject. addBlockedBy dependencies are honoured with an order-independent fixpoint (see the 0.116.0 cyclic-blockedBy fix); a live DevSwarm child workspace now counts as "attended" for IDLE NEGLECT purposes, and IDLE NEGLECT uses one consistent priority filter.
• DevSwarm misc: a maintainer notice lets one post reach every project's Primary; doctor/wake now warn when the mailbox cron has stopped ticking (e.g. after a restore) instead of going silently dark; hivecontrol startup-state samples are captured to detect a crash-paused workspace; an archived child that tries to re-register is told to hand over and stop instead of continuing; hook wake text now points at one consistent CLI path and wake instruction everywhere it's quoted.
• Mesh read directive corrected. The SessionStart COMMUNICATION OVERRIDE text grouped mesh read with the genuinely read-only roster/inbox read-primary calls; mesh read with no flags actually advances the caller's broadcast cursor and returns no ackCommand. The directive now flags mesh read as consuming (use mesh read --peek to preview without consuming) and scopes the ackCommand claim to inbox read-primary, where it's actually true.

Fixed

• Plan-file writes are locked (no lost step updates). The supervisor sweep's Jev step-map write and the child's heartbeat --step, scope add, plan set and done (and the Primary's correct) each did an unlocked read-modify-write of plans/<key>.json, so a write landing between another writer's read and its rename was dropped. Every writer now goes through one read-modify-write under the plan's lock (companion/lib/lock.js) on the fresh on-disk plan.
• AGENTS.md regenerated (tools/gen-agents-catalog.js) to cover the two new settings keys; still fits the Codex 32 KiB cap.
• work-detect: a housekeeping segment can no longer hide real work. isDevswarmHousekeepingOnly classed a whole segment as pure DevSwarm/crontab housekeeping once its leading verb matched, even when that same segment also redirected into a real file (crontab -l > src/app.js, node devswarm.js roster > README.md) or hid work in a command substitution (crontab -l $(sed -i s/a/b/ src/x.js)). Each housekeeping-looking segment is now also checked for an escaping write/substitution before being excluded from the tasklist-guard work count; the legitimate mailbox-wake crontab install (redirect target under /tmp or the session scratchpad) still stays housekeeping-only.
• compact-declaration-guard/compact-advice-guard: the "SAFE TO COMPACT" matcher no longer fires on a quoted mention, a question, or a negated/conditional sentence. findAdvice matched the bare phrase anywhere in the text, so a reply merely describing the guard (`SAFE TO COMPACT` is declared, 'SAFE TO COMPACT' must be last), asking about it (Is it safe to compact now?), or ruling it out (far from safe to compact, once this lands it will be safe to compact; first I need to …) was misread as a live declaration. stripQuoted now blanks single-quoted and backtick-quoted spans (unless the quoted text itself names a /compact//clear//new invocation), matches inside a question-ending sentence are ignored, negation detection covers far from, not yet, and the once … it will be … ; first … conditional shape, and the bare safe to compact/clear wording only counts at a line/sentence start or as the unambiguous ALL-CAPS SAFE TO COMPACT form — the more specific forms (good point to /compact, safe for a context reset, run/then/now /compact, a standalone /compact line) are unaffected.
• guards.compactDeclarationGuard default reset to ON. It shipped opt-in (default off) in 0.116.0 pending the false-positive fixes above; now that the shared matcher ignores quoted/question/negated/conditional mentions, the PreToolUse block is back on by default. Opt back out with /anti-hall:settings if needed.
• git-guard: a round of self-credit and force-push hardening. Self-credit detection now covers pipes, variables, same-command files, merge/commit-tree/rebase -x, interpret-trailers, gh pr merge --body-file, hook-authored trailers, and git tag -m/-F (with a widened -F stdin trailer scan); force-push detection covers command-valued config/env values and quoted code-string literals passed to a call, and an alias-body force flag is now found however its body is quoted (splitting on quotes/parens/braces/shell separators, not whitespace alone). Writes into the ~/.anti-hall/bin launcher directory are blocked (best-effort; a launcher-dir bypass gap closed in a follow-up round). The >| clobber-redirect tokenizer bug (pre-existing) is fixed, a dangling-symlink target no longer false-blocks, and Write/Edit now gets a hint to use those tools instead of a Bash heredoc-to-file, with Write/Edit itself denied on a matching block. The heredoc mailbox-message exemption (added mid-release to let a legitimate mailbox heredoc through) was removed after it failed security review — no heredoc-shaped exemption ships in 0.117.0.
• git-guard: follow-up hardening rounds (self-credit Jev consults, tokenizer, rm-through-symlink, project .anti-hall/ copies). Jev self-credit consults are now memoised, capped (8 distinct texts per hook call) and bounded to 4 s total consult time per invocation, so a pathological command can no longer exceed the PreToolUse hook timeout. The escaped-operator tokenizer now handles \>| and \>& correctly. rm through a symlinked parent directory into ~/.anti-hall/bin is blocked (a real file/dir reached via a symlinked parent component previously bypassed the launcher-dir guard). Ordinary project-local .anti-hall/ copies (a project's own .anti-hall/, not the launcher dir) are no longer false-blocked.
• command-guard: plain-push and read-only carve-outs tightened. A colon-bearing plain-push ref (push origin :refs/...) now requires an explicit remote instead of being silently accepted; allow-plain-push now also accepts HEAD:refs/heads/<current>, a trailing 2>&1, and a final | tail/head filter without losing its narrow scope.
• devswarm respawn: secret-shaped untracked files are excluded from the WIP park branch. .env, key/credential-shaped filenames and similar are never committed onto a park/* branch by the respawn WIP-park step, even when they're dirty/untracked in the straying child's worktree.
• tasklist-guard: a reset task store after a session restore now gets an explanation instead of a bare nudge; the progress-freshness path now keys on the session's project root, not a submodule cwd, so progress recorded from inside a submodule is found correctly.
• wake-watch: consistent primary role from repo root or subfolder — armed from a subdirectory no longer flips role detection relative to being armed from the worktree root.
• work-detect: anti-hall's own bookkeeping and scratch writes are no longer counted as "work" for freshness purposes, and real work chained onto a housekeeping command (e.g. crontab -l && sed -i ... src/app.js) still counts — closing both directions of the false-classification gap the earlier housekeeping-segment fix opened.
• limit-conserve: an expired reset window no longer injects a stale "conserve tokens" reminder.
• mcp-reaper: recognises <name>-mcp-suffixed server process names; orphan-kill rules are unchanged.
• doc coverage + regenerated catalogs. Doc-coverage gaps closed and ratchet baselines bumped for the v117 merge; AGENTS.md and docs/KB.md counts regenerated to match.

0.116.1 (2026-09-28)

Fixed

• wake-watch: no more false "+N new mail" wake after a version handoff, or when an older hook rewrites the mailbox summary. A counter with no recorded history (an older seen-file predating it, or none at all) was diffed against a fabricated 0 baseline on the very next arm, producing an immediate false wake for history the watcher never actually had. That counter is now seeded from its own first live observation instead. A related flap: the broadcast channel's bucket is now chosen per row (the first bucket whose row actually carries a total), matching how the primary snapshot picks it, instead of falling through per field — an older build rewriting the summary without one field no longer flips the channel onto an unrelated, stale bucket and re-fires a false wake on the next new-build rewrite. The seen-file merge also now preserves any keys a newer build wrote that this build doesn't own, instead of dropping them on rewrite.
• Handoff tests reap their child processes. The handoff-forwarding test suite was leaking orphaned watcher processes; it now reaps its own children.
• The update skill runs update.js on a sonnet subagent, matching the model-routing floor instead of a heavier default.
• The post-handover new-work gate nudge skips scheduled housekeeping prompts (a mailbox-wake tick, a DevSwarm peer-check tick, a broadcast bug-sweep tick) — these fire on every prompt and can't act on a "park this work" nudge, so gating them was pure noise. Real user prompts are unaffected. A new autoHandover.gateHousekeepingMarkers setting adds extra markers on top of the built-in defaults.

0.116.0 (2026-09-27)

Added

• compact-advice-guard (Stop): no /compact recommendation at low context or right after a compact. Field defect: a reply declared "SAFE TO COMPACT NOW" and repeated a /compact focus: … line a few turns after a manual /compact, at low context, with "no background agents running" as its only reason. The guard blocks once per declaration when the final reply recommends compacting and either context % is below autoHandover.pct - guards.compactAdviceMarginPct, or a compact boundary (Claude compact_boundary; Codex compacted/context_compacted) is within guards.compactAdviceRecentTurns turns. The threshold-fired auto-handover path stays allowed; double-quoted spans, fenced code blocks, and phrasing immediately preceded by "not"/"n't"/"never"/"no need"/"no reason"/"retract(ed/ing)" are excluded from matching (single-quoted/backticked mentions and other negated or questioning phrasing are not — see the opt-in note below). Registered for Claude and Codex.
• compact-declaration-guard (PreToolUse, opt-in — off by default): no new work in the turn after declaring SAFE TO COMPACT. Field defect: after the declaration the model started a background agent and a state-changing shell command in the same turn. Agent/Task spawns, Write/Edit/MultiEdit/NotebookEdit and state-changing Bash are blocked while the current turn holds an active declaration; read-only tools pass. The next user message or an explicit RETRACT SAFE TO COMPACT — <why> line clears it (task notifications do not). Codex: Bash only, matching the port's PreToolUse policy. Ships with guards.compactDeclarationGuard defaulting to false in 0.116.0: a reviewer probe found the shared quote-stripping/negation matcher it uses (lib/compact-advice.js) still hard-blocks a turn on harmless single-/backtick-quoted mentions, questions ("Is it safe to compact now? No"), and negated phrasing outside its narrow lookbehind ("far from safe to compact", "will be safe to compact") — false positives are too costly on a hard PreToolUse block. Opt in with /anti-hall:settings once you've read the caveat; the Stop-time compact-advice-guard above stays on by default (a soft, once-per-declaration, recoverable block).
• The shared compact-advice matcher also recognizes the Codex handover wording ("GOOD POINT FOR /compact OR /new NOW", "SAFE for a context reset") and its retractions.
• Handover skill (Claude + Codex): a quiet background queue is necessary, not sufficient, to declare SAFE TO COMPACT — declare it only on the auto-handover threshold or genuinely high context, never within guards.compactAdviceRecentTurns turns of a compact, and retract before doing more work.
• Jev: daily rollups and longer log retention. jev-assist.ndjson kept one 1MB backup (about a day) and jev-triage.ndjson truncated itself at 1MB, so no audit could see more than a day. jev-assist.ndjson now rotates at 2MB and jev-triage.ndjson at 1MB into .1 … .N (jev.logRotatedFiles, default 10, about 20 days); lowering N never removes generations already on disk. Before each rotation every retained row is folded into ~/.anti-hall/logs/jev-daily/<YYYY-MM-DD>.json (per id × backend × mode: counts, fresh calls, changed-vs-baseline, timeouts, failures, cost, p50/p95 latency, outcomes). Rollups are never removed by default; jev.rollupRetentionDays is an opt-in.
• jev-report reads history. It reads every rotated generation (not only live + .1), and summarises days the raw logs no longer cover from the daily rollups (rollupHistory in --json, an "Older history" text section). A day is never counted twice; rolled-up p50/p95 are labelled approximate.
• settings show --section jev lists every Jev integration's effective mode (master switch and env kill switches folded in), the stored value, its source tier and the log it writes to (jevEffectiveIntegrations in --json).

Fixes

From a peer workspace sweep:

• Scratchpad exemption encodes the cwd like the harness. The harness names the per-project scratchpad dir by replacing every non-alphanumeric cwd character with -; the shared helper replaced only /, so any cwd containing . or _ (e.g. dotted worktree paths) computed a dir that never exists and the own-scratchpad exemption never matched in edit-guard or command-guard. One shared encoder now mirrors the harness; the session id is still required, so sibling sessions stay blocked.
• command-guard: 2>&1 / >&2 / &> are redirections, not background separators. The splitter split on every lone &, so x 2>&1 | tail never reached the bounded-check allowance. An & after >/< (fd dup) or before > now stays in the word; a real background & still splits. Only 2>&1 is ignored when judging a check's shape; any other >& routes output around the sink and disqualifies it, and &>file targets go through the write-redirect rule.
• command-guard: the delegation hint names the exact inline-allowed shapes instead of promising any "bounded single-target check": python3 -m pytest -q <one file>, node --test <1-2 files>, ctest -R <name>, <cc> -fsyntax-only, git clone --depth 1 <https-url> <scratch/tmp dir>, a non-heavy command with --check/--dry-run/--list, or an interpreter on an existing script with --check, each piped to tail/head/wc/grep -c/grep -m N; scratchpad scripts are run_in_background only. The guards.allowReadOnlyVerify descriptions (GUIDE, /config, settings schema) now say the same.
• tasklist-guard: progress freshness is relative to the last work, not wall-clock. An idle turn (cron tick, status check) more than 30 min after the last progress write was blocked although no work had happened since. Freshness is now judged against the newest file-changing action when known; new work after the progress write still blocks.
• task-guard: a self-referential or cyclic blockedBy no longer counts as an honest block. A blocked by A, or A/B blocking each other, satisfied the old membership check and silenced the generic drain nudge for tasks that are not honestly blocked at all. an order-independent set fixpoint over the blockedBy graph now requires a blocker to name a different open task whose own chain reaches something that can actually progress (no honest blocker, or an owner/user/external blockedOn): self-references, pure cycles and dangling ids never count as honest blockers, and the verdict no longer depends on task order.
• speculation-guard: quote/blockquote masking can no longer hide the session's own hedge. A > line is now masked only up to the earliest sentence-break after quoted text (em dash, "; so", ", so", …), so a hedge appended after a quote on the same line is still caught; a reply that is 100% blockquoted/fenced is no longer masked into nothing, and neither is a reply that is a single straight-quoted or inline-code hedge with nowhere else to hide (masking to nothing falls back to matching the unmasked text). Straight " pairing is now per-line with an even-count guard, so a stray unpaired quote no longer mispairs across the line.
• devswarm send: a no-project failure explains the fix (run from inside the repo) instead of returning a bare reason code, like relay and reap-orphans.
• command-guard: narrow read-only gcloud reads accept a 2>&1 stderr merge. A trailing, unquoted, space-separated 2>&1 is now the one redirection a gcloud read may carry (whole-command carve-out and per-segment inspect exemption); every other redirection, and a redirect glued to a flag value, is still refused.
• devswarm: stale-main spawn refusal names the submodule it refers to. Run from inside a submodule, the refusal now leads with submodule <name>: (the path in the superproject, else the .git/modules dir) instead of pointing at the meta-repo.
• devswarm: WAL-health tick performance. health() re-scanned the full os.tmpdir() per WAL (123 readdirSync calls on a 33k-entry tmpdir per tick, ~96% of inbox tick CPU); it now lists tmpdir once per call and threads the filtered list through, cutting a tick from ~5.5s to ~0.15s CPU with unchanged behavior.
• devswarm-wake-watch: a false wake on role flip. A Primary whose descriptor sits at the main worktree resolves as child when armed from the worktree root and primary when armed from a subdirectory; both roles shared one lastTotal field but meant different counters (NDJSON count vs. mesh summary total), so a re-arm under the other role compared against a stale, wrong-shaped baseline and fired a false wake. The seen file now carries meshTotal/ndjsonTotal by name and each role reads/writes its own; legacy files migrate on read.
• devswarm reconcile: archived/pruned worktrees are skipped, not reported as failures with no detail. An archived-but-present row reached the app-DB archive guard, which refuses with a reason and no .error field, so the fallback printed "unknown error"; an archived+pruned row hit the missing-worktree path with no concept of "archived". cmdReconcile now classifies archived rows (via the DevSwarm app DB or anti-hall's own archived marker) as skipped with a skipReason, separate from genuine failures, and the per-target error now falls back through the parsed reason and the hivecontrol exit code/stderr before ever saying "unknown error". update.js and doctor-repair.js report skipped counts separately.

Review-wave hardening (a second pass over the peer sweep above):

• task-guard and speculation-guard above are all second-pass hardening from this same review wave (self/cyclic blockedBy, blockquote/quote masking).
• compact-advice-guard/compact-declaration-guard: prefer last_assistant_message, block like sibling PreToolUse guards. Claude/Codex Stop payloads carry last_assistant_message — the exact text the model just produced — which is now preferred over the transcript-tail fallback; compact-declaration-guard now blocks via exit 2 like command-guard.js/edit-guard.js instead of a flat {decision:'block'} on exit 0.
• compact-advice-guard: declaration matching requires explicit forms only. "safe to clear the cache" and a bullet merely mentioning /compact (or a fenced-code example of it) no longer count as a declaration; only explicit forms (SAFE TO COMPACT, safe to /compact, good point to /compact, /compact now, run /compact, the Codex skill's GOOD POINT FOR /compact OR /new) match, and fenced code blocks are blanked before matching alongside the existing blockquote/quoted-text stripping. A tokens-latch handover (firedVia:'tokens', or 'stop-tokens' from the Stop-time nag) may now declare SAFE below the pct threshold too, as long as no compact has happened since the latch fired.

Wave-2 fixes (a second peer sweep):

• devswarm: inbox messages --since filters before the per-source row cap. A --since window on an inbox with more rows than the cap could come back empty even though matching rows existed, because the cap truncated the source before the since-filter ever ran; the filter now applies first, so a recent window is never emptied by an oversized old inbox. Behavior change: a plain (non-acking) inbox messages read that the cap truncates now returns the NEWEST rows per source instead of the oldest; read-primary and its non-mutating preview peek-primary keep the oldest prefix (cursor safety), so peek-primary still shows exactly what read-primary will deliver.
• devswarm-wake-watch: a sender's own broadcast/direct send no longer wakes it. A send loop back to the sending session's own inbox counted as new mail and re-armed its own wake, producing a self-triggered wake cycle; a sender's own outgoing message is now excluded from what counts as new mail for it.
• devswarm: emitted ackCommand uses the stable launcher instead of a raw path, matching every other devswarm-emitted command shape and staying correct across install layouts.
• devswarm-child-gate (Stop): a --summary heartbeat sent earlier in the turn now satisfies the gate. The gate's activity window was a fixed 5-minute wall-clock interval, so a heartbeat sent earlier in a turn longer than 5 minutes read as stale and the gate re-demanded one. The window is now anchored to this session's previous Stop check (persisted lastCheckAt), with the 5-minute floor only for a session's first check. The continuation Stop right after a block also records its check time, so a report sent in that continuation does not keep satisfying later turns.
• tasklist-guard: sees an early TaskCreate, and devswarm/cron/agent spawns no longer count as file changes. A TaskCreate issued before any file-changing tool call wasn't picked up by the freshness check; housekeeping tool uses (Agent, Task, CronCreate, CronDelete, devswarm stable-launcher chains) are now excluded from what counts as work, so they no longer mask genuinely stale progress or falsely satisfy it.
• devswarm: one consistent inbox-drain instruction. read-primary and the emitted ackCommand previously implied two different drain sequences; both paths now point at the same instruction.
• devswarm-comms-guard: no unresolved-advisory for in-process subagent targets. A send addressed to an in-process subagent id was flagged as an unresolved target even though it never needed mesh resolution; subagent ids are now recognized and skipped.

Deadly-loop round-2 fixes:

• git-guard: a force flag inside a !shell alias body is found however it is quoted. git -c alias.x='!sh -c "git push --force"' x, '!f() { git push --force; }; f', '!eval "…"', the reversed-quote form and '!(git push --force)' were allowed because the body was split on whitespace only, leaving --force", --force; or --force). Alias bodies are now split on quotes, parens, braces and shell separators too, and an inner -- of another command in a shell body no longer disarms the check. This gap predates 0.116.
• devswarm-comms-guard: the session-index lookup runs before the agent-id silent allow. The widened agent-id pattern (bare a<hex>) was tested first, so a workspace-backed peer session whose name happened to be agent-id-shaped was silently allowed. The target is now looked up first; a workspace-backed match is blocked whatever its shape, and only unresolved or non-workspace agent-id targets are silently allowed.

Jev logging:

• parentGateQuestion decisions were never logged. The triage and assist caches evict the lowest _seq first, but _seq came from a per-process counter that restarted at 1 in every hook process; once a cache reached 500 entries each new entry sorted lowest and was evicted in the same write. The triage cache froze, the question-needs-answer lookup never found a label, and parentGateQuestion never reached its decision. _seq is now seeded from the stored max; an already-frozen cache heals in place.
• jevIntegrations.triage: off now disables triage labelling (it only checked jev.triage); ANTIHALL_JEV_TRIAGE=0 does too.
• modelRouting is consulted only on routing blocks, so a window with no blocks correctly logs zero rows (documented, fixture-tested).

New settings

Key	Default	/config
guards.compactAdviceGuard	true	guards_compact_advice_guard
guards.compactAdviceRecentTurns	10	guards_compact_advice_recent_turns
guards.compactAdviceMarginPct (advanced)	10	—
guards.compactDeclarationGuard	false (opt-in)	guards_compact_declaration_guard
jev.logRotatedFiles (advanced)	10	—
jev.rollupRetentionDays (advanced)	0 (keep all)	—

0.115.2 (2026-09-27)

Fixes

• command-guard: a shell comment containing ) no longer triggers a false heavy-command block (peer-reported). The segment splitter split on ), ;, |, & even inside comment text, so # 1) go to x produced a bogus go to x segment classified as the heavy verb go. An unquoted # that starts a word (start of input, or after unescaped whitespace, ;, &, |) at nesting depth 0 and outside backticks is now dropped to end of line, as the shell does. A # that is not a comment stays code (a#b, $#, ${#x}, ${x#y}, ${x:- #}, (( 2 #)), $[1 #], backticks, $(echo a)#b, escaped/quoted #, continuation lines); the newline still ends the comment; the existing # refusal for the allowlist/bounded-sink paths is unchanged.
• command-guard: four splitter bypasses closed (latent, not new regressions). Each let a real chained command (e.g. ; go build) reach the shell unclassified:
• ANSI-C $'…' quoting was read as plain '…', so an escaped \' closed the quote early and hid what followed — in both the segment splitter and the $( … ) substitution extractor.
• A <<< here-string was parsed as a heredoc on its operand (<<< "#"), swallowing every following line as "body".
• A heredoc delimiter was cut at the first non-identifier character (<<EOF#x read as EOF), so the body never terminated. The delimiter is now the full shell word with quote removal; words the parser cannot model exactly are not treated as heredocs (nothing is skipped).
• command-guard / git-guard: << inside arithmetic ($(( … )), (( … )), $[ … ]) is a left shift, not a heredoc. A letter-led operand ($((1<<y))) opened a fake heredoc whose "body" hid every following line. The shared heredoc parser now rejects << whose innermost enclosing context is arithmetic, so every caller (both guards' heredoc scans and the substitution extractor) is covered.

0.115.1 (2026-09-26)

Fixes

• devswarm-wake-watch: orphaned watchers never exited when their starting parent (Monitor shell, or the stable-launcher wrapper ~/.anti-hall/bin/wake-watch.js) died. Field evidence: a watcher started by a test's intermediate parent 19 hours earlier was still running with PPID 1, holding its per-child watch lock — the same shape can leave a live session's next watcher refusing to arm (REFUSED TO ARM: lock-held) or reporting watcherArmed from a dead process. devswarm-wake-watch.js now captures its startup process.ppid and checks every poll tick (parentGone()): it exits cleanly (releasing its lock) the moment it is reparented (ppid changed / became 1) or process.kill(startPpid, 0) throws ESRCH.
• stable-launcher: the generated ~/.anti-hall/bin/ wrapper forwards SIGTERM/SIGINT/SIGHUP to its target and spawns asynchronously, instead of blocking synchronously with no way to react to a graceful shutdown signal; stdio and exit code passthrough are unchanged.
• A fleet test (devswarm-fleet-8143ced316d3.test.js) no longer leaks a live watcher process on assertion failure — the spawned watcher child is now cleaned up unconditionally, not only on the success path.

0.115.0 (2026-09-26)

Changed

• doctor --prune-cache warns that a cron or Monitor job naming a versioned cache path directly will break once that version is pruned, and points it at the version-independent ~/.anti-hall/bin/ launchers (devswarm.js, wake-watch.js) instead.

Fixes

• doctor --prune-cache keeps versions referenced in recent session transcripts. A CronCreate/Monitor job created during a session (hooks cannot read CronList) could still literally name a versioned cache path; pruning that version left the job failing silently on every tick. Prune now does a cheap, bounded (<=2s, <=20 files, 512 KB tail each), read-only best-effort scan of the newest recent (<=7 day) session transcripts under ~/.claude/projects/*/ for any versioned cache path they mention, and keeps those versions. The scan is bounded and fail-safe: if the scan fails, nothing is removed.

0.114.1 (2026-09-26)

Fixes

• command-guard: P0 — the version-independent stable-launcher form (~/.anti-hall/bin/devswarm.js / wake-watch.js) was wrongly blocked as a heavy command. Since 0.109 (devswarm.stableLauncher, default on), every hook-emitted directive — the mailbox wake cron prompt, the Monitor re-arm command, the DevSwarm comms-override role text, and Stop-gate drain/handover pointers — names the version-independent launcher under ~/.anti-hall/bin/ instead of the plugin-relative scripts/devswarm.js path. The command-guard allowlist only ever anchored scripts/devswarm.js, so every one of those emitted commands fell through to the generic node <file>.js HEAVY_PATTERN and was blocked in coordinator context — breaking every Primary's cron tick and inline mesh command that used the launcher form (peer-reported by the downstream Primary). Added anchoredAntiHallStableLauncher(), a home-anchored carve-out (accepts ~, $HOME, "${HOME}", and the resolved absolute home directory immediately followed by /.anti-hall/bin/devswarm.js or /.anti-hall/bin/wake-watch.js, no other prefix) with the same whole-invocation scope as the existing scripts/devswarm.js carve-out. A look-alike path (evil/.anti-hall/bin/devswarm.js, /tmp/x/.anti-hall/bin/devswarm.js) is still NOT exempt, and chaining a second heavy command after the launcher invocation still blocks on that segment.

0.114.0 (2026-09-26)

Fixes

• command-guard: P1 — the leading-cd carve-out let a nested repo (submodule or untracked nested .git) hijack a push. cd realsub && git add z && git commit -m x && git push origin subbr qualified for the plain-push carve-out whenever realsub merely lived under the outer repo's directory tree, even when it was a git submodule or any independently-git init'd nested repo with its own .git/remote/branch — branch/remote resolution then ran against the WRONG repository. Path containment was never a repo-identity check. resolvedLeadingCdTarget now requires the cd target to share the payload cwd's git-common-dir (the real .git store) — linked worktrees of the same repo share it and still qualify, but a submodule or untracked nested repo never does. Fails closed on any git error.

• command-guard: "allow plain push" missed three common shapes. Peer-reported: cd <repo> && git add a b && git commit -q -m "fix: x" && git push -q origin main && git log --oneline -1 was blocked as "heavy-pattern" even though it should have qualified for the carve-out. Root-caused to three independent gaps, all reproduced first with the exact command via a real PreToolUse payload: (a) -q/--quiet on push was not recognized by PLAIN_PUSH_SEGMENT_RE; (b) a leading cd <path> segment was not recognized at all; (c) a trailing read-only segment (git log/status/show) was not recognized at all. isAllowedPlainPushChain now accepts -q/--quiet on push (still refusing it combined with --force or any other flag), ONE optional leading cd <path> — only when it realpaths to the payload cwd's own repo toplevel or a directory inside it (fails closed on another repo, a $() argument, or an unresolvable path) — and optional trailing git log --oneline [-N] / git status [--short|-s] / git show --stat [-N|HEAD], only after a push segment has already appeared in the chain.

• doctor: orphaned-workspace-process remedy now runs anti-hall's own archive verb, not raw hivecontrol. The re-archive remedy for an archived/app-archived hit printed hivecontrol workspace archive <id> directly. It now prints node <cli> archive <id> (the stable-launcher path when available, falling back to the plugin's own scripts/devswarm.js) — anti-hall's own verb carries the app-archive retry-once fix above plus the app-DB target-gate verification, neither of which a bare hivecontrol call gets.

• doctor: orphaned-workspace-process report gave the wrong remedy for an ARCHIVED (not gone) workspace. Peer report: the claude process in an archived DevSwarm tab stays alive, and killing it just relaunches it from the pty shell — the only real remedy is re-archiving the workspace in the app. orphanedWorkspaceProcessCheck previously suggested kill <pid> for every hit regardless of reason. It now prints the exact safe remedy line (hivecontrol workspace archive <full id>) with an explicit "do not kill it — the pty shell relaunches it" warning for archived/app-archived hits, and keeps the plain kill suggestion for a genuinely gone workspace (worktree removed from under a still-registered row, no relaunch mechanism). Still report-only — never kills or archives anything itself.

• devswarm: app-archive retry regex missed a reworded DevSwarm error text. attemptAppArchive's single retry only fired on the exact phrase "could not confirm terminal process boundary"; a later DevSwarm build rewords the same transient failure as "Could not confirm terminal stopped", so every first archive attempt failed and the built-in retry never triggered. APP_ARCHIVE_RETRYABLE_RE now matches the stable "could not confirm terminal" prefix, covering both wordings while still excluding unrelated hivecontrol errors from the retry.

0.113.0 (2026-09-26)

Features

• command-guard: narrow read-only gcloud in the main thread (owner-approved). Three shapes now run inline instead of being delegated: gcloud auth print-access-token on its own; gcloud <group…> <describe|list|get-iam-policy|read> … --format=json|yaml|value(...), optionally piped into tail/head/wc/grep -c/grep -m N/jq; and T=$(gcloud auth print-access-token); curl -s|-sS [-H "Authorization: Bearer $T"] <https URL> (; or &&). The URL's parsed host must be googleapis.com or a subdomain of it (no userinfo, no IP literal, no other host), and -L/--location, --resolve, --connect-to, -x/--proxy, --url and -K/--config are refused, so the token never leaves Google. The curl must be a GET, and its output must be piped into a bounded sink or jq, or capped with --max-filesize. Everything else stays blocked: create/delete/deploy/set/update/add-iam-policy-binding/remove-*/patch/import/export/ rollback/start/stop/ssh/scp/submit/run/apply, curl -X other than GET, -d/--data*/-F/-T/--upload-file/-o/-O/--output, @file, any other curl flag, redirects, and any chained segment. $T may appear only in the Authorization header. Subagents are unaffected. New setting guards.allowGcloudReads (default true).
• command-guard: background scratch scripts in the main thread (owner-approved). A Bash call with run_in_background: true may run ONE segment <python3|node|sh|bash> <script file> [args…] inline when the file is an existing regular file in the session scratchpad or a tmp root (os.tmpdir(), /tmp, /private/tmp). The path is checked on its realpath, so a symlink out is refused. Refused: an interpreter option before the file (-c/-e/-m), an env prefix or wrapper, chaining, pipes, $/backtick/backslash/process substitution, a stdin redirect, and a write redirect outside the scratchpad/tmp. Foreground runs keep today's verdict, and Monitor is unchanged. New setting guards.allowBackgroundScratchScripts (default true).
• doctor --prune-cache (opt-in plugin cache prune, owner-approved). It never runs automatically: update.js, the supervisor, crons, SessionStart and hooks never call it. Without --confirmed it lists the old ~/.claude/plugins/cache/anti-hall/anti-hall/<semver>/ dirs it would remove and their total size. --confirmed removes them and logs each removal. It always keeps the newest 3, every dir holding an installPath registered in installed_plugins.json, every version a live process runs from (process cwd via the 0.111 doctor scan, or the cache path in its argv), the running version, and anything it cannot parse. Symlinks and paths outside that root are refused, both when listing and again just before each removal. If the live-process scan is unavailable, nothing is removed. New setting updates.allowCachePrune (default true), which only enables the verb.

Security fixes

• command-guard gcloud reads: the read verb must be the last command-path word (P1). The new read-only gcloud carve-out, and the older read-only cloud-inspect exemption, accepted read/list/get-iam-policy in ANY position. That included a separated flag value, so gcloud compute instances reset vm1 --zone read --format=json, gcloud secrets versions access latest --secret read …, gcloud kms decrypt … read … and similar ran inline. Both paths now accept only gcloud <group…> <verb> [≤1 positional] [--k=v…]. The verb is the last path word. Every flag is --k=v or a known boolean (--quiet, --uri); a separated value is refused. No path word may be access/reset/suspend/resume/publish/call/execute/decrypt/ encrypt/sign/print-/attach-/detach-/add-/set-/remove-/delete/create/update/ deploy/ssh/scp/run, nor a hyphenated form of a mutating action (delete-access-config, reset-windows-password, …). run is allowed only as the product group, and read only as logging read. This also closes a pre-existing hole in the older read-only cloud-inspect list exemption, which took the same separated-flag-value bypass.

• command-guard gcloud token curl: closed set of token variable names (P2). The token may only be assigned to T, TOKEN, ACCESS_TOKEN or GCLOUD_TOKEN. Any other name (HTTPS_PROXY, http_proxy, CURL_CA_BUNDLE, SSLKEYLOGFILE, …) could be an env var curl itself reads, and is refused.

• doctor --prune-cache: registered installPath compared canonically (P2). Both sides go through fs.realpathSync.native, and the comparison is case-insensitive on darwin. A registered path spelled in a different case, or reached via /tmp, .. or a trailing slash, is kept.

• doctor --prune-cache: live-process match on the cache suffix (P3). A process cwd or argv now counts as live when it names plugins/cache/anti-hall/anti-hall/<ver> followed by a path boundary, whatever the prefix (/tmp vs /private/tmp, a symlinked home). <ver>.bak never matches.

• command-guard gcloud read sinks: no env/input/file access (P3). A jq filter after a gcloud read or the token curl may not use env, $ENV, input, inputs, input_filename, import, include or $__loc__. grep -f/--file, including in a short-flag cluster, is refused.

• command-guard background scratch scripts: same F1 rule as the script check (P3). A script whose realpath is inside any anti-hall plugin root (this install, a cache copy, or a dev checkout), or any --confirmed argument, never qualifies.

• command-guard gcloud token curl: canonical ASCII host only. The raw URL host must be plain ASCII and equal to the parsed host, with no curl URL globbing ({…}, […]). This refuses percent-encoded and full-width lookalike hosts.

Changed

• command-guard gcloud reads: separated flag values are no longer read-only. gcloud … describe foo --region r (a value in its own argv word) is no longer treated as read-only inline; write it --region=r to keep running inline. This closes the separated-flag-value gap the P1 fix above found in both the new gcloud read carve-out and the older read-only cloud-inspect exemption.

0.112.0 (2026-09-26)

Features

• edit-guard: a per-project doc-edit allowlist (owner-approved). A repo may list repo-relative globs in .anti-hall/edit-allow.json ({"paths":["docs/**","PLAN.md","*.md"]}). The main thread (a DevSwarm Primary or coordinator) may then Edit/Write matching files directly instead of delegating them. It uses the 0.111 command-allowlist trust model and the same lib/command-allow.js machinery. It applies only after settings.js trust-edit-allow <repo> --confirmed records the sha256 of the exact file bytes in ~/.anti-hall/trusted-edit-allow.json. Any edit to the file revokes trust, and a symlinked file is refused. Absolute, .. and match-everything globs are ignored. A match never covers a path outside the repo (checked on real paths), .git, .anti-hall, .claude, .codex, hook config, ~/.claude, or a symlinked or hard-linked target. Each path segment is folded with NFKC plus lowercase before these checks, so hookſ.json (long s) and .huſky are denied like the plain spellings the filesystem treats them as. The main thread can never edit .anti-hall/edit-allow.json itself. Subagents are unaffected. Doctor reports untrusted, changed or ignored entries. New setting guards.projectEditAllow (default true). Codex registers no Edit-family hooks, so this is Claude-only. The Codex settings skill documents the trust command.
• inbox tick --quiet (peer ask, downstream Primaries 2026-09-26). inbox tick's JSON carries duplicate legacy+new field names (unread/unreadTotal, cursor/cursorNdjson, storeCursor/cursorStore), which made a cron-prompt directive eyeballing raw JSON error-prone. --quiet prints one line: tick <id>: unread N, known true|false, meshGap true|false, watcherArmed true|false on success, or a loud ok:false ... line + non-zero exit on failure. The JSON default (no --quiet) is unchanged. The DevSwarm wake-cron prompt now uses --quiet and words its stop condition against that line.
• devswarm.js send takes several recipients. --to <id1>,<id2>[,…] or a repeated --to sends the same body to each recipient (duplicates dropped), so a caller no longer needs a shell for loop, which command-guard treats as heavy. Every recipient is attempted even after one fails. The result lists per-recipient ok/seq/bytes, and the exit is non-zero if any recipient failed. --quiet prints one line per recipient. A list does not combine with --broadcast, --to-primary or --cc-primary. Documented in the devswarm skill (Claude and Codex) and help. New setting devswarm.sendMultiRecipient (default true; false keeps "last --to wins").

Fixes

• DevSwarm wake-cron default moved off :00/:30 (peer ask, downstream Primaries 2026-09-26). WAKE_CRON_DEFAULT was */30 * * * *, which fires exactly on :00/:30 — every other machine's */N cron piles onto the same wall-clock instant. Now 7,37 * * * *: same 30-minute cadence, off-minute offset. The MAILBOX WAKE CronCreate directive also now states plainly that ANY existing job already running inbox tick for the workspace — any schedule, id, or partition UUID — counts as present; never create a second one.
• handover-resume.js GUIDED RESUME PATH is now adaptive. It used to unconditionally tell the agent to run a "section-10 resume-verification checklist" and read state.md/decisions.md/trials.md — a handover written without that section or those files left nothing to follow. It now detects (fail-open) what the referenced HANDOVER actually has and only mentions what exists, falling back to a generic 3-step check (git status --short --branch, pwd, CLAUDE.md/AGENTS.md re-read) when the checklist section is absent — still requiring the resume-verified: line either way.

• model-routing-guard: deploys, migrations and secret work are never pushed to haiku. An opus spawn that ran a production deploy (wrangler … cors set, deploy_webui.sh prod) was blocked with "respawn with haiku", which is the wrong advice for deploys, migrations, rollbacks and secret/credential work. A spawn is deploy-shaped when it has one action signal: deploy, migrate, rollback, token rotation, or wrangler/terraform/kubectl apply/ firebase deploy/db migrate. Two distinct context words out of prod, secret and credential also count; one stray "no secrets" does not. At or above a floor, the rows that push toward haiku are skipped and every other row still runs. Below the floor, or with no explicit model, the spawn gets an advisory naming the floor instead. It is never blocked. New setting guards.modelRoutingDeployFloor (sonnet default, opus, or off for the old table).

• command-guard: a read-only --check run of a real script file is allowed again. 0.111 refused every interpreter verb on the check-flag path, so python3 tools/gen_contract.py --check | tail -5 blocked. The main thread may now run <python*|node|ruby|perl|php> <existing script file> --check|--dry-run|--list piped to a bounded sink. The script must be an existing regular file named right after the interpreter. Inline code (-c/-e/-m/-p/--eval/--require), stdin or heredoc scripts, $/backtick/process substitution, env-assignment prefixes and wrapper verbs (sh/bash/eval/exec/xargs/env/nice) never qualify, and the remaining arguments must be non-heavy. An anti-hall script (this plugin, or any other anti-hall install found by its plugin.json) never qualifies, and neither does any command carrying --confirmed, so the main thread cannot flip a safety switch or trust an allowlist this way. Claude and Codex share the hook. New setting guards.allowReadOnlyVerifyScripts (default true).

• devswarm.js spawn refuses a flag value that is really the next option. spawn b -s main -t -p "brief" made -p the workspace title and dropped the brief without a word. Spawn now refuses before fetching or creating anything, and the message names the flag. It checks -s/--source, -a/--agent, -t/--title or -p/--prompt with no value, or with a value that starts with -. For -p, only a single option-shaped token counts, so a brief that opens with a - bullet is still accepted. New setting devswarm.spawnStrictFlagValues (default true).

• devswarm-parent-gate.js: the fresh-mail grace window (parentGateNeglectGraceMin, 0.111.0) now covers mesh-direct send --to messages, not just the native NDJSON inbox. A Primary that ran devswarm.js send --to <child> and ended its turn seconds later still got hard-blocked with DEVSWARM NEGLECT (peer field report), because the grace window's own scoping blanket-excluded every STORE-ONLY-union row (a mesh-direct send is store-only, no NDJSON line at all) regardless of who sent it. The exclusion now keys on the row's sender: a store-only row this Primary itself sent, still within the grace window, is downgraded to a stderr advisory — "N unread — awaiting child pickup (Ns)" — exactly like a fresh native-inbox send; a row from anyone else (or with no resolvable sender) still blocks unconditionally, unchanged. The pre-existing busy-child downgrade already applied to store rows and needed no change. New tests in tests/hooks/devswarm-parent-gate-neglect-grace.test.js cover a fresh own mesh-direct send (advisory), an old own send (still blocks), a fresh send plus an unanswered child question (still blocks), a fresh third-party mesh-direct row (still blocks), and an unresolvable sender (fail-open, still blocks).
• devswarm-parent-inbox.js's "CHILD NOT DRAINING" per-turn nag: the 120s grace window (unreadIsGraced) was defeated by a busy child's own heartbeat. A field report showed the exact scenario the grace window exists to fix still reproducing verbatim: a 9-second-old own mesh-direct send to an actively-working (uuid-addressed) child, whose heartbeat was 1 second old, still produced "CHILD NOT DRAINING" and blocked the next Stop. Root cause: unreadIsGraced disqualified grace the instant the child recorded ANY heartbeat after the send — but a heartbeat file is rewritten on every inbox tick/turn cycle regardless of whether the specific message was ever read, so a busy, continuously heartbeating child (precisely who this window protects) almost always fails that check within its very first tick. The heartbeat check is removed entirely and replaced with the same sender-keyed predicate used in the Stop-gate fix above: grace applies while the message is within the window UNLESS its sender is positively known to be someone other than this Primary (an unresolvable/legacy sender still gets grace, matching the pre-fix lenient default). devswarm-store.js's summary projection now additively emits oldestDirectUnreadSender (the sender of the oldest unread row, computed alongside oldestDirectUnreadTs at zero extra cost) so the hook can make this call without a second store read. New/updated tests in tests/hooks/devswarm-parent-inbox-grace-window.test.js reproduce the exact field shape (fresh own send, fresh child heartbeat -> still graced) and cover a known third-party sender (never graced, however fresh).

Security

Hardening for the new 0.112.0 command-guard/edit-guard/model-routing surfaces above, found and fixed before release (F1–F4):

• F1 — command-guard script --check: an anti-hall script, or any command carrying --confirmed, never qualifies for the read-only allowance, closing a path where the main thread could otherwise flip a safety switch or self-trust an allowlist through the new script-check exemption.
• F2 — edit-guard project allowlist: path segments are folded with NFKC + lowercase before the deny-list check, so unicode-confusable spellings (hookſ.json long-s, .huſky) are denied exactly like their plain-ASCII equivalents.
• F3 — command-guard read-only verify: a comment or an unbounded check no longer passes. x --check #| tail -5 was allowed because the comment hid the sink from the shell, and so was x --check && x --check | tail, where the first check is unbounded. An unquoted # now disqualifies the line, as does a background &; every pipeline that runs a check must end in a bounded sink.
• F4 — model-routing deploy floor: weak single-word context no longer counts as deploy-shaped. One stray "no secrets" in an otherwise mechanical opus task used to count toward the floor; it now takes two distinct context words (out of prod, secret, credential) to qualify, keeping the original BLOCK for the weak case while still letting genuinely deploy-shaped spawns through.

Fixed

• mcp-reaper: GRACE=0 honored via a deterministic parseGrace(), not a wall-clock e2e bound. The e2e test asserted elapsed time < 2500ms for a real subprocess run (spawnSync + two real ps scans) to prove GRACE=0 wasn't coerced to the default 3 by a 0 || 3 gotcha; that bound is wall-clock/scheduler-dependent and flaked under heavy local CPU load. The grace-parsing logic is now a pure, exported parseGrace() (used in production at mcp-reaper.js:569) covered by exact-equality unit tests (no subprocess, no timing); the e2e test keeps only a generous-deadline poll for the orphan's actual death.
• "Restart" advice no longer implies harness registration that hasn't happened. Two sites could tell a user to just reload/restart to pick up a newer anti-hall build even when the Claude Code harness (installed_plugins.json) had not actually re-registered it yet — restarting alone does not load a version the harness has never seen (claude plugin update anti-hall@anti-hall is required first; see doctor.js's own harness-registration check). Field repro (2026-09-26): the marketplace clone had fast-forwarded to 0.111.0 while installed_plugins.json still reported 0.110.0 and no cache dir existed for 0.111.0 — devswarm-wake-watch.js's "update available" line said the version "is registered" when it was only known from the marketplace clone.
• plugins/anti-hall/companion/lib/devswarm-wake-watch.js: checkStaleVersion() now returns a registered flag (true only when installed_plugins.json itself already names the newest version or newer); formatUpdateAvailableLine() branches wording accordingly — pointing at /anti-hall:update instead of claiming "is registered" when the harness has not caught up.
• plugins/anti-hall/hooks/version-alert.js: CASE 2 ("already downloaded ... run /reload-plugins") now checks the harness's own installed_plugins.json (read-only, reusing update.js's resolver) before claiming a reload/restart is enough; when the harness lags the mirrored cache dir it instead tells the user to run /anti-hall:update first.

0.111.0 (2026-09-26)

Security

A security review of the three new main-thread command-guard allowances (read-only verify, per-project allowlist, plain push) reproduced nine bypasses; each is fixed with regression tests (tests/hooks/command-guard-security.test.js), and every reproduced case blocks again (or more strictly than 0.110.0).

• Splitter: an unquoted backslash is an escape. git commit -m \" ; npm test ; echo \" hid npm test inside a fake quoted argument (bash reads \" as a literal quote), and every allowance inherited the gap. The shared splitter and its quote scanners now treat \x outside quotes as a literal pair. No shell-scan differential or command-guard corpus verdict changed.
• Read-only verify: a check flag never launders a wrapped payload. sh -c "npm test" --check | tail, bash -lc '…' --dry-run, eval "…" --check and node -e "…execSync('npm test')" --check were allowed. The check-flag path refuses shell/interpreter/wrapper verbs and -c/-e/--eval/-lc, and the segment minus the flag must be non-heavy under the full unwrapping classifier.
• Project allowlist: no shell expansion in a matched command. npm run deploy -- "$(npm${IFS}test|sh)" matched ^npm run deploy -- \S+$. Any $, backtick, backslash or <(/>( anywhere (quoted or not) disqualifies the command.
• Project allowlist: ^.*$ is not an anchored rule. A pattern now needs a literal command word after ^, a closing $, no unbounded wildcard (.*, .+, [^;]*, [\s\S]+, quantified wide groups) and no top-level |; doctor reports each ignored pattern with its reason (its allowlist report also never printed before — a TDZ read of cwd, fixed).
• Project allowlist requires per-user trust. A cloned repo's working-tree .anti-hall/command-allow.json could authorize itself. It now applies only while ~/.anti-hall/trusted-command-allow.json maps the repo's real path to the sha256 of the file bytes (any edit → untrusted); symlinked files/dirs are refused. New verb: node scripts/settings.js trust-command-allow [<repo>] --confirmed (prints the patterns; records nothing without --confirmed). doctor reports untrusted/changed allowlists with that command.
• Plain push: the remote must be a configured remote name. git push ../other-repo main and git push host/evil main qualified; the remote must be one of git remote (fail closed).
• Allowlist audit log: no symlink follow, secrets redacted. The log dirs are lstat-checked, the file is opened O_NOFOLLOW (mode 600), and the logged command is redacted (secret-named flag values, then the existing scrubSecrets).
• Verify redirect/clone targets are resolved first. | tail > …/scratchpad/../../etc/x passed a raw substring test. Targets are resolved and realpath'd and must land inside the session's own scratchpad or a tmp root (helpers shared with edit-guard via hooks/lib/scratchpad.js).
• Verify clone: only git clone --depth 1 https://… <tmp dest>. The local-path clone form and non-https --depth 1 sources no longer qualify.

Features

• command-guard per-project command allowlist (owner-approved 2026-09-26). A repo may declare its own sanctioned exact commands — e.g. a deploy script the project's own rule says must never be delegated to a subagent — in <repo-toplevel>/.anti-hall/command-allow.json ({"patterns":["^anchored regex$", ...]}). Applies in the MAIN THREAD ONLY (a subagent never reaches this carve-out; it already passes through command-guard before this point). Every pattern must be literally anchored (^...$) or it is ignored, never matched. The WHOLE command must be exactly one unbroken segment (no chaining, pipes, subshells, backticks, or $( ) command substitution — reuses the guard's own splitSegmentsDetailed, no new parser) and carry no unquoted redirect anywhere, or it never qualifies regardless of the pattern. A qualifying match writes one audit line to ~/.anti-hall/logs/command-allow.ndjson. Default config is empty (no behavior change for a repo that never opted in). New setting guards.projectCommandAllow (default on). doctor reports an unanchored/invalid pattern in a repo's own config as a warning.
• command-guard "allow plain push" (owner-approved 2026-09-26). In the MAIN THREAD ONLY, git add/git commit/a plain git push [remote] [ref], and &&/; chains made up only of those three, run inline instead of being delegated. ref must be omitted, HEAD, or the current branch (resolved fresh via git symbolic-ref --short HEAD, fail-closed if unresolvable). --force/-f/--force-with-lease/--force-if-includes/ --mirror/--delete/-d/--all/--tags/+refspec/src:dst to another branch, any other chained segment, and pipes/redirects/subshells stay exactly as blocked as before. git-guard.js keeps its own independent force-push/AI-credit checks, untouched. New setting guards.allowPlainPush (default on).

Changed

• Roster wording: "no upstream" no longer reads as an error. A workspace spawn creates a branch with no upstream until it is pushed — normal, not a problem — but the Primary's per-turn workspace table (devswarm-parent-inbox.js's riskMarker()) rendered it with a warning glyph, ⚠ no upstream. Now renders local only (not pushed), no glyph. The underlying noUpstream field and its priority over a stale unpushed count are unchanged.

• command-guard "narrow allow": bounded read-only verification for the coordinator. The coordinator may now run a short, single-target, read-only verification command inline instead of delegating it — e.g. re-running one delegated test file to verify a subagent's "done" claim — when it is a --check/--dry-run/--list flag, a -fsyntax-only compile check, one python3 -m pytest -q <file>, one or two explicit node --test <files>, ctest -R <name>, or a scratchpad-scoped git clone, AND its output is piped to tail/head/grep -c/grep -m N/wc, AND no write redirect targets a path outside the scratchpad/tmp, AND every other segment on the line is trivially safe (cd/pwd/true) or the piped sink itself — any other segment (including a chained second heavy command, or a --check hidden inside a still-heavy invocation) keeps the whole line blocked. Full suites, builds, installs, deploys and pushes stay gated. New setting guards.allowReadOnlyVerify (default on).

• devswarm.js relay <seq|receipt> --to <id> [--note-file <path>]. Forwards a message the caller already received (its own inbox) to another workspace, verbatim, prefixed with a provenance header (relayed from X, seq N, M bytes). <receipt> (an inbox read-primary readReceiptId) resolves only when it covers exactly one message; otherwise it refuses ambiguous rather than guessing. Verifies the relayed byte length against the source and refuses (ok:false) on a mismatch or an empty source body — never a silent partial relay.
• devswarm.js inbox read-primary --format text. Prints one from/seq/body block per message instead of the raw JSON. The default two-step read-then-ack-primary --receipt flow is unchanged; the new, opt-in --ack-after-print flag acks immediately after printing instead.
• devswarm.js send --quiet. Prints one line (sent seq N -> X, B bytes, ok) instead of the full JSON; failure still prints a loud ok:false ... line and keeps the non-zero exit code.
• devswarm.js send --to <id> --cc-primary. A direct --to send also copies the Primary with the identical message body, best-effort — reported under the result's ccPrimary, never flips the primary send's own ok/exit code.
• spawn help text now documents the real hivecontrol args. devswarm.js help spawn names every hivecontrol workspace create flag (-s/--source, -a/--agent, -p/--prompt, -r/--remote, -t/--title) plus anti-hall's own --from-local, with an example and pointers to send/roster/inbox for following up with a spawned child.
• devswarm.js help --short. Peer request: a DevSwarm Primary spent a day driving raw hivecontrol because it never discovered devswarm.js archive existed. Prints one line per verb (verb — purpose), generated from the SAME source of truth as the full help/help <verb> listing (the dispatcher's own verb list + VERB_HELP), so it can never drift out of sync. A hygiene test independently scans the dispatcher's case '<verb>': statements and asserts every one appears in the short list. The Primary's SessionStart directive now names it as the pointer to the full verb list.
• devswarm.js ready-check <sha>. A generic, read-only readiness verdict for a child's "READY \<sha>" claim — works against any git repo, not DevSwarm-specific. Reports ff (is --base, default origin/main, an ancestor of sha), the base...sha file diff (files), submodule pointer bumps (gitlinks), deletions under --watch-deletions dirs (deletions_under), files outside --allow globs (outside_allowed), and a verdict:'ok'|'review'|'block' + reasons[]. Runs git read-only; no fetch unless --fetch is passed.
• devswarm.js inbox tick reports watcherArmed. Whether a live Monitor wake-watch currently covers this workspace (fresh lock, pid alive) — the Claude-branch CronCreate prompt body now checks this field and tells the agent to re-arm Monitor when it reads false (the harness caps a Monitor at 30 minutes; this cron's own 30-minute fallback cadence is exactly when it would have lapsed).
• devswarm.js roster/the parent gate now name what a child is waiting on. A row (or block reason) whose transcript is paused on an unresolved AskUserQuestion/ExitPlanMode now carries a truncated (~120 char) preview of the actual question/plan text, not just "waiting on a human" — reusing the SAME childBusyState detector both surfaces already relied on.
• doctor reports live processes leaked into archived/gone DevSwarm workspaces. A bounded (≤2s), report-only scan cross-references every live process's cwd against archived (anti-hall's own marker, or the DevSwarm app DB's) or gone (worktree removed) workspace paths and prints pid, command name, cwd, and a suggested manual kill — never kills anything itself.

Fixes

• DevSwarm store migration's "SOME COUNTS UNVERIFIED" no longer false-flags every workspace that has ANY native mesh traffic. migrateOne's count-verify used to require the store's TOTAL message count for a workspace to EQUAL today's legacy-inbox line count — but a workspace's store also accumulates rows from native mesh writes that have nothing to do with the legacy inbox, so that equality permanently breaks the instant any such row exists (not a data-integrity signal; confirmed on a live store where 100% of an actively-used project's workspaces failed the old check despite complete data). Verification now checks legacy-line COVERAGE (every legacy line is represented in the store, freshly imported or already covered by another path's row) via the same cross-path identity migrateLegacyInbox already used correctly. migrate-state.js's CLI output now names each still-unverified workspace (title/id + the specific field that failed), capped at 10 with a "...and K more", and states plainly that sources are never deleted so no data can be lost — re-running the (idempotent) migration re-verifies.
• silent-agent-nudge.js could block Stop with no subagent involved at all. ~/.anti-hall/agents/ is a single home-scoped directory shared by every project/session on the machine, but heartbeatCandidates() globbed EVERY *.json in it and treated each as a subagent heartbeat, falling back to the filename as id when one was missing. That misread phase-tracker.js's rolling recent-spawn.json ({ts} only, a 20-minute "orchestration live" marker, not an agent) and other projects'/workspaces' devswarm-<branch>.json files as silently-dead agents. A heartbeat candidate now requires its OWN id and status fields (never the filename) plus a session field that matches the session about to Stop; recent-spawn.json and devswarm-*.json are also excluded by name as defense-in-depth. The heartbeat convention (skills/orchestration/SKILL.md) gained a required session field (session_id of the spawning session); a heartbeat written before this field existed has no owner to verify and is now treated as not-ours (fail-open toward no nudge, never toward blocking on an unverified file).
• The parent Stop gate no longer force-blocks a Primary seconds after it sends a child a message, before the child has had any chance to read it. New setting devswarm.parentGateNeglectGraceMin (default 1 minute): a plain, native-inbox unread backlog younger than this never counts as neglect by itself, independent of whether the child is separately busy. Never applies to a store-only (mesh-direct send, or dead/foreign-descriptor) row, and never suppresses an unanswered child question or a corroborated stale/escalated verdict.
• task-guard's IDLE NEGLECT check now recognizes an explicit owner-blocked marker instead of forcing a fake blockedBy dependency to silence it. A task with metadata.blockedOn (or top-level blockedOn) === 'owner' / 'user' / 'human' (case-insensitive), or a subject starting with "OWNER:" / "OWNER DECISION" (case-insensitive), is excluded from the ACTIONABLE-NOW set and never nags. New setting guards.taskGuardOwnerBlockedMarker (default on). Documented in docs/TASK-WORK.md, docs/KB.md, and the nudge text itself.
• Static per-turn reminder blocks (VERIFY-FIRST, the DEVSWARM PRIMARY dispatch-tier and top-fan-out-tier suffixes) no longer repeat every single turn. They now follow the same once-per-session / once-after-compact-or- clear / once-every-N-turns cadence as the existing DevSwarm workspace-table dedupe, via lib/emit-dedupe.js's keepalive rule. New setting guards.injectionRepeatEvery (default 10 turns; 0 restores every-turn injection). task-tracker.js's own FULL/SHORT + freshness-note logic and devswarm-child-turn.js's COMMS OVERRIDE reassertion are unchanged (the latter is deliberately per-turn — DevSwarm's --system-prompt-file erases the child's system prompt at every spawn, so per-turn reassertion is the only lever against that erasure).
• A Codex quota/rate-limit exhaustion is now recorded once and shared, instead of every lane rediscovering it independently. New PostToolUse hook codex-quota-detect.js (matcher Agent) detects a quota-exhaustion message in a codex:codex-rescue Agent result and records {available:false, until, reason} into ~/.anti-hall/codex-availability.json (lib/codex-quota.js, merged with the existing PATH-probe fields, never clobbering them). The SessionStart codex-availability.js hook now also surfaces a live outage even when the PATH probe alone found nothing to report, with the routing fallback ("Codex unavailable until X; route correctness review to Sonnet"). New setting guards.codexQuotaDetect (default on). The exact Codex CLI quota message wording was not found verified anywhere in this repo or machine at authoring time, so detection matches conservatively on quota/rate-limit exhaustion vocabulary rather than one fixed string.
• Nudge-class Stop hooks now take a per-signature session ack, instead of re-blocking on the same confirmed-false condition. silent-agent-nudge.js and tasklist-guard.js had no user-triggered ack at all (only automatic same-snapshot dedup); devswarm-parent-gate.js already had one (its own intents/intentAcks state, driven by devswarm.js gate-intent --reason) but it is deeply coupled to that gate's own escalation shape, so it was left untouched rather than force-generalized. New shared hooks/lib/stop-ack.js gives the two gap hooks a documented skip-file entry (~/.anti-hall/stop-ack/<session>.json, keyed "<hook>:<signature>") the agent writes once the user has explicitly confirmed a condition is a false positive — that exact signature then stays advisory (never blocks again) for the rest of the session; a genuinely changed condition is a new signature and blocks normally. New setting guards.stopAck (default on).
• A stale, already-fixed nudge no longer keeps blocking after claude plugin update has re-registered a newer build. installed_plugins.json (harness-owned) can be re-registered at a newer version while the CURRENT session's hooks keep executing the OLD build until a full restart — /reload-plugins does not pick this up (doctor.js's own harness- registration check; claude plugin update --help documents "restart required to apply"). New shared hooks/lib/stop-version-gate.js (reusing skills/update/scripts/update.js's own version-resolution exports, never reimplementing installed_plugins.json parsing) lets silent-agent- nudge.js, tasklist-guard.js, and devswarm-parent-gate.js's plain NEGLECT nag detect this and downgrade their block to advisory until restart. Deliberately NOT applied to devswarm-parent-gate.js's unanswered-question / truncation / escalation paths, which bypass the cap unconditionally by design, nor to any safety guard (command-guard/edit- guard/git-guard stay out of scope). Prospective only: a hook build that predates this file has no way to run the check. New setting guards.stopHookVersionDowngrade (default on).
• Investigated (peer complaint #3, batching/re-fire): how Claude Code combines several Stop hooks that each return decision:block in one turn (one continuation vs. several) is not documented in this repo's own docs/KB-claude-code-hooks.md, and no existing test in this repo answers it either — recorded as unverified rather than guessed at. What WAS verified: silent-agent-nudge.js already had a per-exact-snapshot dedup plus a hard once-per-agent-per-session cap; tasklist-guard.js already short-circuits on hash === lastHash before blocking again. Both already satisfied "no re-block for an identical snapshot within a session" before this change — no fix was needed there. devswarm-parent-gate.js's own stable-kind cap (hooks/lib/stop-policy.js) also already resets only on an observed-clear condition, not on content churn.
• DevSwarm directive text (mailbox wake cron, Monitor re-arm, comms override, drain nudge) now names a version-independent launcher instead of a version-pinned plugin-cache path. Every printed node <path> command was baked from the CURRENTLY RUNNING hook's own __dirname — a path like ~/.claude/plugins/cache/anti-hall/anti-hall/0.109.1/scripts/devswarm.js. That path was correct the instant it was printed, but crons, Monitors, and handovers keep the literal text around across releases, so after the next update the printed command pointed at an old (sometimes deleted) version directory and showed a stale version number in the text itself — forcing a manual recreate of every cron/Monitor and a handover edit on every release (peer report: downstream Primary). Fixed by installing two tiny, self- contained launchers under ~/.anti-hall/bin/ (devswarm.js, wake-watch.js) that resolve the CURRENTLY REGISTERED anti-hall install (installed_plugins.json -> the marketplace clone -> the path baked in at generation time) EVERY TIME THEY RUN and delegate to it with full argv/exit-code passthrough; devswarm-child-role.js, devswarm-parent- gate.js, devswarm-child-gate.js, and devswarm-child-drain.js now embed those stable paths in their directive text instead of the raw version- pinned one. Idempotent (only rewrites the launcher when its content actually changes) and fail-open throughout (an install failure, or devswarm.stableLauncher = false, falls straight back to the previous version-pinned path — byte-identical to pre-fix behavior).

0.110.0 (2026-09-26)

Features

• Bug history for the defect channel. defect.js has three new maintainer verbs:
• backfill [--repo <path>] [--dry-run] imports every fix: / fix(scope): commit from git history as a fixed record. The component comes from the source file with the most changed lines (tests and docs are ignored). fixedIn is the earliest release tag that contains the commit. The cause comes from keyword rules. The matching CHANGELOG bullet is linked when found. Records are keyed by commit sha, so a re-run adds nothing. They are stored in ~/.anti-hall/defects/history/ and never appear in list --open or the defect nudge.
• recurring [--since <version|date>] [--top N] [--json] groups reported and imported fixes by component and by cause. It flags hotspots (a component fixed 3+ times, or the same component and cause 2+ times) and likely regressions (the same component and cause fixed again within 5 releases, or an explicit regressionOf).
• similar <text…> [--component X] lists the 10 past fixes closest to a new bug.
• report and rule accept optional --component, --cause (a fixed 12-class root-cause list) and --regression-of <fp>. Existing records without these fields still load unchanged.
• The root-cause skill (Claude and Codex) now runs defect.js similar before an anti-hall fix. If the component is a hotspot, fix the class of bug, not just this instance. The defects skill documents the new verbs on both ports.
• The command guard exempts the two new read-only verbs, defect.js recurring and defect.js similar, alongside report/list/show, so the root-cause skill's similar step runs on the main thread. backfill writes history records and stays gated.

Changed

• One row-eligibility projection (companion/lib/row-eligibility.js). Every workspace row is now judged once for archived (anti-hall marker, DevSwarm app DB, active-list absence, with archivedBy provenance), held (devswarm.heldPartitions), ignored (archive-ignore marker) and live/busy/waiting-on-user. It has a memoized per-invocation context and a batch API. The parent Stop gate, the per-turn parent-inbox table (plus its archive-ready nudge and stale-registry filter), and the CLI's routing, roster and diagnose read it instead of combining the predicates one axis at a time. There is no behavior change.
• Hygiene ratchet (tests/hygiene/archived-predicates-single-projection.test.js). A direct call to an archived/held predicate outside the projection and the helpers it wraps now fails CI. The remaining partition-level and app-DB write-guard call sites are allowlisted with exact counts and reasons.
• One lock primitive. New companion/lib/lock.js replaces 12 hand-written cross-process locks: swarm-guard, repair-on-reload, settings, recovery per-id, supervisor sweep, ingest (plus its orphan sweep and legacy probe), migrate, pull/wake-watch, the store journal, log rotation and retention. It keeps recovery.js's design: write-then-link publish, with an O_EXCL fallback on filesystems without hard links (SMB/exFAT), atomic rename-aside reclaim, and token-checked release. It adds a host-scoped owner record, an mtime torn-read guard, and per-caller steal policy. Each caller keeps its timeouts, stale windows, retry budgets and fail-open/fail-closed contract.
• A hygiene ratchet (tests/hygiene/lock-single-primitive.test.js) forbids new O_EXCL, linkSync or lock-unlink code outside lock.js.

Fixes

• Lock reclaim race. Two processes that judged the same dead or stale lock holder both deleted it. The second deletion removed the first process's fresh lock, so both ran the critical section. Affected: supervisor sweep, migrate, pull/wake-watch, retention, log rotation, store journal (duplicate dedupe rows), ingest (two monitor consumers), settings (lost key), swarm-guard (spawns past the cap) and repair-on-reload (two doctor --repair spawns).
• Lock torn-read steal. An empty lock file is normal while its live holder is still writing it. The supervisor sweep, retention, settings and repair-on-reload locks read that empty file as ownerless and stole it.
• Lock blind release. The settings lock released by deleting the file without checking the owner token, so it could delete a successor's lock. It now checks the token.
• Ingest orphan-sweep race. The ingest orphan sweep and legacy-lock probe re-read a lock and then deleted it. A fresh lock published between those two steps was deleted. Both now reclaim atomically.
• Lock three-way reclaim race. Two processes could judge the same stale holder. A reclaimed and published, then B renamed A's live lock aside and C published into the empty path. B's restore then failed, so B deleted A's lock and A and C both held it. Reclaimers are now serialized by an O_EXCL <lock>.reclaim sidecar. It uses the same publish path, so it works without hard links, and it goes stale after 5 s or when its pid is dead. Under the sidecar the holder is re-read and re-judged before any rename.
• Lock hostname drift. macOS renames the host when the network changes, so a live local lock holder was treated as belonging to an unknown machine. Migrate and pull could then steal it once it was stale by age, and recovery and the supervisor lost the immediate dead-holder reclaim. Lock records now carry the boot time and, on Linux, the pid namespace. A holder with a different hostname but a matching boot time and namespace is on this machine, so its pid is checked. Holders on other machines are still judged by age only.
• Lock scratch sweep covers every lock directory. doctor --repair removed leftover lock scratch files only from devswarm/locks/. The shared lock primitive also leaves *.lock.tmp-*, *.lock.reap-* and heartbeat .hb. temp files in ~/.anti-hall/, logs/ and the store journal directories. The sweep now covers all of these plus the .reclaim sidecar. It removes only lock scratch files older than 15 minutes and lists every file it removed.
• Handover's terminal line is now trigger-aware, not an unconditional compact signal. HANDOVER.md must record a Trigger: line (auto-threshold / user-request / restart-pending / task-boundary, plus context % from the statusline or ~/.anti-hall/auto-handover/<tag>.json's firedPct). The terminal line only claims "🟢 HANDOVER COMPLETE — GOOD POINT TO /compact NOW" for auto-threshold or an explicit compact/clear request; any other trigger below the threshold gets a neutral "📝 Handover saved (proactive, ...): no need to compact now" line instead. Fixes a field incident where a proactive handover below the 85% auto threshold was misread as a signal to stop/compact. Mirrored in the Codex port (plugins/anti-hall/codex/skills/anti-hall-handover/SKILL.md).
• shell-scan-differential.test.js no longer misreads a timed-out/killed guard spawn as ALLOW. spawnGuard compared spawnSync's res.status directly against 2 (BLOCK); under load, a child killed by the 10s timeout or a signal returns status: null, which the bare comparison counted as ALLOW, producing false "SAFETY REGRESSION base=BLOCK new=ALLOW" failures. spawnGuard now retries a null status up to 2 more times with a longer (30s) timeout, and classification is a small pure function (classifyGuardResult) that returns 'INCONCLUSIVE' — never 'ALLOW' or 'BLOCK' — for a still-null result after retries; the test then fails with an explicit "INCONCLUSIVE (timeout/killed) — not a verdict" message instead of silently misclassifying. A genuine exit-0-where-base-blocked regression is unaffected — it returns a real status on the first attempt.
• Canonical resolveHome() guard added for shared home-fallback helpers. os.homedir() is called directly at ~300+ sites across the plugin; a test that forgets to pass an explicit home/env can silently fall through to the REAL developer machine home instead of an isolated fixture (the recurring "tests never touch the real home" defect class). Added companion/lib/test-home-guard.js#resolveHome(explicitHome, env) — the same explicitHome || os.homedir() fallback in production, but it refuses (throws) under node --test (or explicit ANTIHALL_TEST=1) when that fallback would resolve to the real user home, with an ANTIHALL_ALLOW_REAL_HOME_TEST=1 escape hatch for a test that deliberately needs it. Migrated hooks/lib/settings.js (homeDir/homeFromEnv) and hooks/lib/jev-assist.js (homeDir) — the two shared helpers most other hooks/companion code routes settings/jev config reads through — to use it. Added tests/hygiene/homedir-call-site-ratchet.test.js, which counts remaining direct os.homedir() call sites and fails if the count grows, so new code can't reintroduce the gap while the rest of the call sites are migrated incrementally.

0.109.5

Fixes

• DevSwarm MAILBOX WAKE directive now names the right id. The SessionStart and Stop-gate wake directives were telling the agent to poll an unregistered id (the raw session/builder id, or — in a repo whose Primary seat had never been registered — an id with no history at all), so the inbox check the directive told the agent to run always came back "unregistered" even though wake-watch itself had armed correctly on the real, resolved Primary id. Fixed by threading the resolved id through both directives and by registering a Primary seat on its very first use, not only when it is adopted from a previously closed one. First-use registration happens only under real DevSwarm (DEVSWARM_REPO_ID set) — forcing devswarm.supervisorMode=on alone never registers a seat.
• A corrupt Primary seat descriptor is reported, not overwritten. An unparseable workspaces/<id>.json now reads as seat state unknown with a SessionStart warning naming the file, instead of being re-registered over.
• DevSwarm wake-watch no longer needs a manual re-arm after every release. When a newer build's watcher is available, the running watcher now hands the stream off to it automatically instead of printing a re-arm instruction and stopping — Monitor keeps streaming through the handoff. Guarded so a build can only hand off to a newer version, and only once per watch chain, with a safe fallback to the old print-and-stop behavior if the handoff itself fails.
• Wake-watch handoff hardening. After handing off, the old watcher no longer overwrites the new one's seen-state on exit, exits with the new watcher's own code (128+signal when it was killed), and forwards SIGTERM / SIGINT to it so the new watcher is never left orphaned holding the lock.
• Edit guard now allows the harness plan file outside plan mode too. ~/.claude/plans/*.md is exempt from the delegation block unconditionally, not only while the session is in plan mode.
• Tasklist guard no longer blocks Stop in plan mode. Plan mode cannot write the progress file the guard was demanding, which previously caused a stuck loop.
• Speculation guard no longer flags "must be"/"should be" used as a requirement. Obligation phrasing in requirement or acceptance-criteria context (e.g. "the result must be idempotent") is exempted; real speculative claims are still caught. The exemption covers only true obligation verbs (measured/verified/tested/...): state claims like "should be done by now" or "should be deployed" are still flagged, every must-be/should-be in a reply is checked, and the requirement-label context counts only at the start of a line.
• Command guard allowlists read-only/append-only defect commands. node scripts/defect.js report|list|show no longer requires approval; rule and archive remain gated.
• Command guard's own-CLI allowlist is anchored to the segment start everywhere, not just for defect.js. jev-setup.js, settings.js, jev-report.js, doctor.js, phase.js, agent-watchdog.js, and devswarm.js previously matched anywhere in the segment, so a heavy command mentioning one as trailing args (npm run build -- node scripts/devswarm.js list) slipped through unblocked; every entry now goes through one shared anchoring helper so a future addition can't forget it.

Added

• New setting: autoHandover.decisivePrompt (default true). At a turn-ending Stop point, once the current session's handover exists and is fresh, the agent is told to end its reply with one prominent line naming the exact /compact (or /clear, or Codex /new) command to run next — or, if the handover has gone stale since it was written, to refresh it first. Turn it off to revert to the plain handover wording.
• Decisive prompt freshness uses the tasklist guard's own work detection. Subagent edits and Bash writes (cp, mv, rm, > redirects, ...) after the handover now mark it stale; with no readable transcript (including Codex) the line is a neutral "📝 Handover saved at ..." instead of 🟢; and "Next action" means done only when it reads exactly none/done/complete/nothing.

0.109.4

Fixes

• DevSwarm Stop gate: archived workspaces no longer block the Primary. A workspace archived in the DevSwarm app, archived by anti-hall, or marked with archive-ignore no longer stops the Primary's turn, even if it still has unread mail. Its mail is also no longer counted toward the NEGLECT warning or escalation. At most one summary line is shown instead: "N archived workspace(s) still have unread mail (ignored)". This check also reuses the cached copy of the DevSwarm app's archived list.
• Owner-held workspaces no longer block the Primary either. An id listed in the devswarm.heldPartitions setting is skipped by the Stop gate, even when it is an old twin of the Primary. The Primary's own current mailbox is never skipped.
• "Waiting on a human answer" now requires a running session. A workspace is only reported as waiting on a human answer if its session is still running and its transcript shows the unanswered question. The gate used to report this for sessions that had already ended.
• Active workspaces are unchanged. Unread mail with no transcript still blocks the Primary, as in 0.109.0.

0.109.3

Fixed

• Silent-agent nudge no longer blocks every Stop for a finished agent. A background agent whose completion notice arrived as an attachment or queue-operation transcript entry was treated as still running and reported as "silent", and the Stop hook then blocked on every attempt. The nudge now reads all three completion shapes (reusing the idle gate's parser), treats an agent whose result was later delivered as finished, and hard-caps nudges at one per agent per session.

0.109.2

Fixes

• Heartbeats reuse a cached copy of DevSwarm's archived-workspace list instead of opening the app database on every call.

0.109.1

Fixes

• DevSwarm roster: a relaunched terminal can no longer revive an app-archived workspace. Field bug: two workspaces archived in the DevSwarm app (isActive=0, isHidden=1) had their terminal tabs left open; when the running claude process was killed, the tab's login shell relaunched claude within ~10s, and the new session's routine ensure + explicit register + heartbeat calls all flipped both rows back to active on the roster — one even broadcast "idle — awaiting task brief". Anti-hall's own resurrection guard only checks its OWN archived/<id>.json marker, which is never written when a workspace is archived from the DevSwarm app UI instead of anti-hall's own archive verb. register/ensure/ heartbeat now consult the DevSwarm app DB's own archived verdict first and refuse to reactivate a row it reports archived — "regardless of new heartbeats or registrations" (owner rule: the app DB is ground truth over anti-hall's own markers). heartbeat's base file write still always succeeds; only the liveness-verdict clear-to-alive and the mesh --summary broadcast are suppressed. The roster's archived hint gains a live session in archived workspace flag when a fresh heartbeat still exists for an archived row. If the app DB can't be read, behavior is unchanged (fail-open).
• doctor reports (never kills) a live claude session left running in an app-archived workspace. New report-only check: claude session alive in an archived workspace: <title> (pid N), resolved from the app DB's own AI-terminal session id through the same harness session-file mapping liveness.js already used elsewhere. Never kills the process, never archives or deletes anything — it names the leak and the two safe ways to close it (close the DevSwarm tab, or hivecontrol workspace archive <full id>). One aggregated WARN, never one per workspace. (Auto-archive was already unaffected: gatherCandidates only considers isActive=1 builders, so an app-archived row was never an auto-archive candidate.)

0.109.0

Features

• Post-handover new-work gate (on by default). Once context is past the auto-handover threshold and this session's handover has been written, the agent now sizes each new request before starting it. If the request would need more than about 5% of the context window, it offers you two choices: park it in the task list and the handover and start it after /compact or /clear, or go ahead anyway if you insist. Quick questions, finishing the task already in flight, and spawning a DevSwarm workspace pass straight through. Works the same on Claude Code and Codex.
• One-shot budget reminder after a handover. If usage grows more than the budget past the point where the handover was saved, you get one reminder per handover: refresh the handover, and offer to park the rest of the work.
• New settings: autoHandover.gateNewWork (boolean, default true) and autoHandover.gateBudgetPct (1-50, default 5), both also in /config.
• New Jev integration postHandoverGate (advisory, default off). It logs whether Jev thinks a request fits in the remaining post-handover budget; it never changes what the gate says. It has its own jevIntegrations.postHandoverGate row, like the other Jev integrations. It ships off by default: an offline benchmark (n=299) found park-recall 17.6% vs 28.8% for the agent's own size judgment plus the measured budget backstop, no gain over the baseline.
• Mechanical nudge on a silent background subagent. anti-hall already documented the heartbeat convention for a coordinator to notice and re-dispatch a stale subagent, but nothing forced it to happen and nothing wrote the heartbeat automatically. A new Stop hook (shared with the Codex port) instead watches the signal the harness always produces: every background agent launch and its eventual terminal notification. An agent counts as silent once its own output has gone stale (or never appeared) past the threshold with no terminal notification seen, and you get one nudge per stale snapshot — advisory only, it never stops or re-dispatches the agent itself. The ~/.anti-hall/agents/<id>.json heartbeat file, when a subagent does self-report it, is kept as an additional secondary signal.
• New settings: guards.silentAgentNudge (boolean, default true) and guards.silentAgentNudgeMin (minutes, default 20), both also in /config.

Changed

• DevSwarm auto-archive: a finished workspace's own status pings no longer keep it "active" forever. A done child workspace is woken periodically by its own mailbox cron, the Monitor watcher, and a Stop-hook heartbeat reminder — each wake used to reset the idle timer, so a finished child could never go idle and was never auto-archived. The idle timer now reads the child's own transcript turn by turn and skips only those wake/ping/heartbeat/status turns; any other activity (real work, read-only work included, a new direct message, or a commit) still resets the timer, and a turn that is still doing real work blocks the archive outright. If the transcript can't be read, the older, more conservative rule applies, so this change can only delay an archive, never make one happen early. Archives stay reversible, only by the exact workspace id, and never triggered from a hook.
• New setting: devswarm.autoArchive.ignorePings (boolean, default true), also in /config.
• devswarm.js spawn is faster and more deterministic. A cached workspace title from hivecontrol's raw branch-name default could clobber an already-confirmed, different title, giving a "sometimes branch, sometimes brief" spawn-title race — fixed. The roster/per-turn "finish" column now shows the actual done-rule state in plain words (done ✓ merged / done, merge unverified / done, not merged / working) instead of a raw gate-count ratio. Spawn now skips the redundant origin fetch when the remote-tracking ref is already fresh, fetches submodule updates on demand only when it does fetch, and puts a timeout on the underlying hivecontrol create call, reporting per-phase timings. It also now detects and reports (never auto-repairs) a submodule worktree that failed to create during an otherwise-successful workspace create.
• New settings: devswarm.spawnFetchTtlSec (seconds, default 300) and devswarm.spawnCreateTimeoutMs (milliseconds, default 180000), both also in /config.

Fixes

• The DevSwarm ingest daemon no longer freezes, dies silently, or reads healthy while a slow hivecontrol drains nothing. Under heavy machine load the monitor call timed out (spawnSync … ETIMEDOUT), but spawnSync's timeout only sends SIGTERM and then keeps blocking until the child actually exits. A hivecontrol that was slow to die froze the whole daemon, heartbeat included, for minutes. The daemon (companion/devswarm-ingest.js) now runs each monitor call with a non-blocking child_process.spawn: SIGTERM at the hard timeout, SIGKILL after a grace period, and a hard upper bound after that. While a call is in flight, a timer keeps the lock and liveness heartbeat fresh. The heartbeat is also written on the backoff paths that skipped it before (a blocked delivery WAL, a retryable store error), and it carries a new lastMonitorAttemptMs. Transient failures back off exponentially (2s, 4s, 8s …) up to a 5-minute cap instead of retrying every 2s. Every exit now leaves a reason in ~/.anti-hall/devswarm-ingest.log: SIGTERM/SIGINT/SIGHUP are logged (and the in-flight hivecontrol child is killed), as are uncaught exceptions and unhandled rejections (with the stack) and the final exit code. An exit with no line at all is now the signature of a SIGKILL. Health (monitorFaultFor / daemonHealth): when no monitor poll has succeeded since the daemon started, or since the last success, for longer than the new devswarm.monitorNoOkFailMin window (default 10 minutes), health reads FAILING even when no failures have been counted. That was the field case: lastMonitorOkMs stayed null with 0 failures for 15+ minutes and read as healthy. Inside that window a freshly started daemon reports "starting up" (startingUp: true, status still healthy, so no repair restarts it). The failing banner now says which condition tripped, the heartbeat age, and the last error in plain words.
• New setting: devswarm.monitorNoOkFailMin (minutes, default 10), also in /config.
• doctor --repair no longer reinstalls a healthy-but-slow ingest daemon, and the installer stopped churning launchctl on every workspace spawn. A monitor fault only fires once the daemon's base liveness signals already passed, so a merely slow/timed-out hivecontrol call (ETIMEDOUT, no resolvable spawn-error code) is a live daemon, not a broken one — doctor --repair used to reinstall/restart it anyway, which only interrupts an otherwise-healthy process. isMonitorConfigFault() now reinstalls only for a genuine config fault (ENOENT/EACCES/ENOTDIR); a slow/transient fault is reported via the new monitorSlowReason() and left alone — a genuinely dead daemon still reinstalls either way. Separately, install-devswarm-ingest.js (which runs on every DevSwarm workspace spawn) no longer unloads already-reaped legacy per-worktree launchctl units it never installed, and skips the unload+load of the live per-project unit entirely when the on-disk plist already matches what would be written and the label is already loaded.
• jev report's triage rows leaked across --project/--by groups, and a settings write could slip past its own risky-change lock. jev-report.js filtered triageRows by time window only, never by the same groupKeyOf() used for every other row, so every project's or session's triage counts showed every OTHER project's/session's triage decisions mixed in; a project-less triage row now buckets under unknown like any other row instead of leaking everywhere. settings.js set()'s locked-key risky-change check read settings.json and decided before acquiring withSettingsLock — the same TOCTOU reset() already had fixed — so a concurrent writer could change settings.json between that stale read and this call's own write, letting a risky change through unconfirmed; the check now runs inside the same lock, reusing the same load.
• The silent-background-agent nudge could stay silent, and the handover scan it triggers is no longer a full recursive walk. silent-agent-nudge.js's terminal-status match lacked a case-insensitive flag, so a differently-cased status was misread as still-silent; its task-id/status parsing was first-match-only against the whole text leaf, so when several agents finished together in one leaf only the first agent's id/status pair was ever read and every later agent stayed flagged as silent. Each <task-notification> block is now parsed separately, paired with its own id and status, and the displayed nudge is deduped by agent id across the transcript and heartbeat sources so an agent visible through both never produces two lines for the same thing. Separately, the handover lookup this nudge (and the post-handover gate) relies on used to do a full recursive walk of .anti-hall/handovers — every date dir × every session dir × every file — just to find one session's own handover; it's now bounded to <date>/<sessionId>/ per date dir via the new findNewestHandoverForSession(). findNewestHandover()'s cross-session fallback (used by handover-resume and the pre-compact snapshot) is unchanged.
• The DevSwarm auto-archive idle gate could archive a workspace mid-work, or never fire at all. A safety review of the 0.109 idle gate found it treated every wake/ping turn as proof of idleness, when a false "ping" archives a child mid-work (an extra reset only delays, so every doubt now counts as real work): a background Agent/Bash launch with no matching final <task-notification> (completed/failed/stopped, matched by task id or tool-use id), or a turn_duration pending-background-agent count above zero, now blocks archive outright, and a ping turn never hides it. The mailbox-ping classifier first went too strict (a bare allowlisted node devswarm.js inbox|heartbeat|roster|mesh command, nothing else) — since real children pipe their pings through grep/head/tail/wc, that made the gate inert in practice, every wake turn counting as real work — so it now also accepts exactly one 2>&1 plus a chain of those read-only filters with plain-word arguments only; anything with a file redirect, <(, $(, a pipe reader like python3/ sed/awk/jq/tee/xargs, or a shell chain still counts as real work. Native mailbox-drained rows (no mtype) now count toward the inbound floor, and a cron-wake flag now only ever attaches to the very next meta prompt so a human prompt can't be misclassified as a wake. The wake text asks children to run mailbox commands plain, with no pipes or filters.
• 6 DevSwarm spawn-review fixes: timeout detection, freshness, submodule fetch, and an honest merge label. A real spawnSync timeout (ETIMEDOUT, SIGTERM, null status) never reached cmdSpawn's timeout detection because the error branch returned before the signal check ran; it's now propagated with an explicit timedOut flag, and a timeout now reports plainly, including that a partial workspace may already exist for the branch (never auto-cleaned). Remote-ref freshness no longer consults FETCH_HEAD (it moves on ANY fetch of ANY ref), only the ref's own reflog/loose-ref mtime. A submodule-recursive fetch that fails now retries once with --no-recurse-submodules before being reported as failed. The submodule-worktree-failure regex now only matches fatal: lines actually tied to submodule worktree creation, instead of sweeping in an unrelated fatal error. The roster/finish-column label now distinguishes "done, merge unverified" from "done, not merged" instead of collapsing both into the same dishonest label.
• DevSwarm no longer flags an ordinary process restart as a concurrent-instance split. The instance-split check only confirmed each instance nonce had a row somewhere in the 15-minute freshness window, not whether two nonces were ever alive at the same time — and a nonce legitimately changes on every restart, so an ordinary restart (old process's last heartbeat still under 15 minutes old, new process's first heartbeat landing minutes later) always read as two concurrent instances even though only one was ever alive. Each nonce's activity span is now padded by 60s and swept for the peak number of nonces overlapping at any point in time; only that peak counts toward instances/instance-split, shared identically by the roster and diagnose paths.
• .anti-hall/handovers|progress|history paths could double when the session's cwd was already inside one of those directories. precompact-snapshot, handover-resume, tasklist-guard, task-lifecycle-log, progress-prune, and migrate-state all joined .anti-hall/... onto the raw session cwd instead of the git toplevel, so a cwd already under .anti-hall/handovers/ (or any repo subdirectory) doubled the path and handover-resume could never find what precompact-snapshot had just written. All of them now resolve through the repo's git toplevel first (a submodule and a DevSwarm child worktree each keep their own state), falling back to the raw cwd outside a git repo.
• mcp-reaper can now also detect abandoned Codex app-server-broker.mjs helpers — report-only, never killed. These are spawned detached and unref'd on purpose, so PPID 1 is normal for a live one — not evidence of death like it is for the reaper's ordinary MCP-server matcher — so a helper is only listed as abandoned once its --cwd directory no longer exists, or no live claude/codex process's cwd is equal to, an ancestor of, or a descendant of it (realpath'd, and excluding the broker's own child processes; so a session at a workspace root still owns a broker whose --cwd is inside a submodule beneath it), and only once it's older than the new minimum age. Matched by an exact script-name + codex-plugin-path signature, kept fully separate from the reaper's generic MCP parent-death matcher so that invariant never loosens. Detected brokers are listed in the reaper log only — the reaper never terminates them. Opt-in, and only takes effect when the companion reaper is installed and running.
• New settings: guards.reaperCodexBroker (boolean, default true; report abandoned brokers) and guards.reaperCodexBrokerMinAgeS (seconds, default 1800), both also in /config.
• DevSwarm's wake-watch/doctor re-arm could name a path that doesn't exist on disk. The version check that picks the "newest" build took the max across the installed plugin list, the newest cache directory, and the marketplace clone's own plugin.json — but the marketplace clone can fast-forward before that new version is actually mirrored into the plugin cache, so the re-arm command it printed could point at a cache directory that was never created, crashing the moment it ran. Both the wake-watcher's version check and doctor's shared version-check helper now verify the target script file actually exists on disk before returning a path; when a newer version is merely known but not yet cached, they print an update-available notice once and keep running instead of exiting with nothing left watching.
• A settings reset() could silently disarm a safety guard under a race, and a DevSwarm supervisor blocker label could go silently blank. settings.js reset now re-checks the safety-switch confirmation gate inside the same lock it uses for the write, closing a window where a concurrent writer could arm a guard and have reset quietly disarm it without --confirmed. Separately, the DevSwarm supervisor's blocker-label dedupe now reads back the mode field it already writes; previously that field was dropped on read, so every deduped (skipped) re-ask treated an already-promoted label as unset, silently blanking it for the rest of the re-ask interval.
• Jev's own triage integration was invisible in jev report, and its agree% swung wildly across identical time windows. Triage decisions were logged to a separate file with a different schema, so the report's per-integration table never showed them at all rather than showing them with a bad value — they now appear as their own triage row. The agree% denominator now counts distinct, fresh decisions only (a cache-hit retry of the same decision no longer adds an extra vote), which was the actual cause of agreement swinging between 99%/77.5%/37% across windows on the same underlying data; the table now also prints the sample size inline. The same blocker-label read-back fix noted above is included here too, proven with a fixture repro (10 sweeps: label once, then null the other nine before the fix).
• The DevSwarm ingest daemon now keeps hivecontrol's error output when a monitor call fails or is killed. The daemon used to run each monitor call with stderr discarded (stdio: [..., 'ignore']), so a non-zero exit or an external signal (not the daemon's own timeout kill, which already had its own stable message) carried no diagnostic text at all. Stderr is now piped and kept as a bounded last-2 KB tail, folded into the resolved error message on a non-zero exit or a signal with no prior spawn error; the existing ok/fail classification is unchanged, only the missing diagnostic text.
• The progress/history guard now names the absolute path in its block message. The Stop-hook guard reads and writes the root-joined absolute .anti-hall/progress|history path, but its block message named the bare relative path — from a repo subdirectory cwd, following that message literally wrote into the subdirectory instead, a location the guard never checks. The message now names the absolute path.
• Repo-root resolution no longer climbs to a parent repo when the session cwd was deleted, and no longer resolves to the home folder when ~ is itself a git repo. A cwd that no longer exists (for example a removed nested worktree) used to climb to a surviving ancestor repo and write that session's state there; it now falls back to the raw, nonexistent cwd like any other unresolvable case. Separately, a dotfiles repo checked out at $HOME could resolve its toplevel to the home directory itself, which would redirect every write into anti-hall's own global ~/.anti-hall/ store; that case now also falls back to the raw cwd.
• Correction: Jev integration postHandoverGate defaults to off, not shadow. Replace the earlier "New Jev integration postHandoverGate (shadow only, default shadow)" bullet: the row exists (jevIntegrations.postHandoverGate), but it ships off. Set it to shadow to log Jev's view without changing what the gate says.
• DevSwarm parent Stop gate: "busy" now needs real evidence. A child with unread mail only gets the non-blocking busy, N queued line when its own transcript was written in the last devswarm.parentGateBusyFreshMin minutes (default 5) and its latest turn is real work. A live process or a fresh heartbeat no longer counts, so an idle child sitting at its prompt with old mail blocks and escalates again. A missing or unreadable transcript (including a Codex child) also blocks.
• Waiting children always block. A child stuck on an unanswered question, a plan approval (ExitPlanMode), or any tool call while its transcript has gone quiet (a permission prompt or a hung tool) blocks with a "waiting on a human answer" line. In a family of twin descriptors, one waiting member makes the whole family block.
• Age cap on the busy advisory. Even a busy child blocks once its oldest unread is older than devswarm.parentGateBusyMaxAgeMin (default 60): "