v3.14.1 — audit fixes (security + correctness)

Security and correctness fixes identified by 4-agent parallel audit.

Fixed

Shell injection

• kill.md + resume.md: $DIR was interpolated bare into node -e single-quoted string literals — a session ID containing ' could break out. Fixed: pass via CLI_DISPATCH_SESSION_DIR env var.
• kill.md: pgrep self-exclusion filter had typo grep -v "^$$\$" → grep -v "^$$".
• resume.md: silent fallback to deepseek when backend field missing from metadata → now emits a warning.

Worktree / crash propagation

• cx-worktree-run.sh: missing _cleanup + trap ERR INT TERM (ds/ag had this since 3.14.0; cx was missed). Also remove || true from cx-stream call so crashes propagate to babysitter.

Wrong error messages

• ag-agent + cx-agent: "run /cli-dispatch:ds-setup" → /cli-dispatch:setup.

Stale / factually wrong hints

• sessions.md / ds-sessions.md: claude-ds-stream --resume → /cli-dispatch:resume <id> <follow-up>.
• ag-sessions.md: ag-stream --resume (this flag does not exist) → /cli-dispatch:resume.
• cx-sessions.md: cx-stream --resume (this flag does not exist) → /cli-dispatch:resume.

doctor.md completeness gaps

• DeepSeek section: add chk claude-ds (was checking only ds-agent + claude-ds-stream).
• Antigravity section: add chk ag-stream.
• Codex section: add chk cx-stream.

watch.md

• No guard for empty $ARGUMENTS → added usage hint + early exit.

v3.14.0 — doctor, kill, help, resume + worktree crash fix

New commands

• /cli-dispatch:doctor — full health check: all 6 CLIs on PATH, API keys, auth state, ~/.local/bin PATH check. Green ✓ / red ✗ per item. Ends with a smoke-test hint.
• /cli-dispatch:kill <session-id> — stop a running worker session: sends SIGTERM, marks status.json state as killed.
• /cli-dispatch:help — one-screen grouped command cheat sheet (Setup, Delegate, Monitor, Housekeeping).
• /cli-dispatch:resume <session-id> <prompt> — continue any session with a follow-up; auto-detects backend (DeepSeek / Antigravity / Codex) from status.json.

Bug fixes

• ds-worktree-run.sh / ag-worktree-run.sh: removed || true from worker call (crash now propagates to babysitter); added trap _cleanup ERR INT TERM — leaked worktrees are removed automatically on crash or signal.
• watch.md: removed stale claude-ds branding — the command works for all backends; updated follow-up hint to /cli-dispatch:resume.

v3.13.4

Fixed

• cx-runner / ag-runner / ds-runner: enforce delegation — babysitter must not edit files directly. Added a CRITICAL block to all three runner agents explicitly forbidding the babysitter from using Edit, Write, cat >, sed -i, or any other direct file mutation. The worker CLI (cx-agent / ag-agent / ds-agent) must do the actual coding; the runner only invokes, monitors, verifies, and reports.
• cx-runner: remove bogus --version check. cx-agent has no --version flag; running it would exit non-zero and mislead the agent. Prerequisite check is now command -v cx-agent only.

v3.13.3

Changed

• Dashboard: the worker "Task / instruction" panel now starts collapsed (click to expand), matching the Subagents/Worker-sessions panels.

v3.13.2

Changed

• Dashboard: the pinned task/instruction panel scrolls instead of burying the flow. Full prompts can be large (5k–25k+ chars); the "Task / instruction" panel now caps at ~38vh and scrolls, so the flow stays reachable.

Docs

• Updating note: /plugin update refreshes commands/skills only — it does not reinstall the worker wrappers in ~/.local/bin. After an update that changes a wrapper (e.g. the new prompt.txt field from 3.13.0), re-run /cli-dispatch:setup once. (README EN+TR.)

v3.13.1

Docs

• README overhaul (EN + TR). The Features section was stale (DeepSeek-only) — rewritten to cover all three backends, the dashboard, native balance (aggregate + per-backend), clean/clean-schedule, the Codex real-OS sandbox, the ds/ag/cx-runner subagents, Markdown rendering, and stale-worker detection. Also refreshed the intro, Usage intro, Session-tracking (added the prompt.txt row), Security/egress (per-provider), and Architectural-role sections to be backend-neutral.

v3.13.0

Added

• Dashboard: the worker's task/instruction is pinned at the top of its page. A worker detail page rendered only the flow (newest-first), so the original instruction was buried or off-screen. It now shows a pinned "Task / instruction" panel (Markdown-rendered) above the flow, always first regardless of flow order. /api/worker/:id/flow now returns prompt (+ model/cwd/startedAt).
• The pinned instruction is the FULL prompt — no truncation. Previously only meta.json's 120-char promptPreview existed. The stream wrappers (cx-stream, claude-ds-stream, ag-stream + the .ps1 variants) now write the complete prompt to prompt.txt in the session dir; the dashboard serves that in full, falling back to the 120-char preview for older sessions that predate this.

v3.12.0

Added

• Dashboard: Markdown rendering for message/prompt text in the flow. Assistant messages and prompts (which workers emit as Markdown) now render headings, bold/italic, inline code, fenced code blocks, lists, and links — instead of raw text. Tool lines stay plain. The renderer is a tiny XSS-safe one (no deps, stdlib-only ethos): it escapes ALL input first, then applies a fixed whitelist of transforms and never passes raw HTML through; link hrefs are sanitised (only http(s)/relative — javascript: etc. become #). Verified: <script> is escaped, javascript: links are neutralised.

v3.11.2

Changed

• Dashboard: the "Worker sessions (ds/ag/cx)" panel now starts collapsed too. It defaulted to open; like the Subagents panel it now defaults to closed.

v3.11.1

Changed

• Dashboard: the inactive "Subagents" panel now starts collapsed. The session view's non-active subagents panel defaulted to open; it now defaults to closed (the "Active subagents" panel stays open). A manual toggle is still preserved across live refreshes.