Changelog — Fixes

Bug fixes and regressions resolved. — Page 2

All Releases Features Fixes Improvements

fixApril 21, 2026

CodePulse v2.3.113 — em-dash parse bomb + AST CI gate

Build-support-email.ps1 failed to parse because a UTF-8 em-dash inside a double-quoted string was misread as a closing quote under PS 5.1's ANSI fallback. All installer .ps1 files scrubbed + CI now runs [Parser]::ParseFile before every release.

Install Script Parse Bomb, Round 2 (TAB-588 — second hotfix)

Parse bomb class #2 — UTF-8 em-dash misread as CP1252 closing quote — PS 5.1 reads BOM-less .ps1 files as the CP1252 ANSI codepage. The UTF-8 em-dash — has byte sequence E2 80 94, and 0x94 maps to a curly closing double-quote (") in CP1252, which terminated the string mid-expression. The v2.3.112 hotfix had actually added a new em-dash while fixing the $Script: bomb — a textbook example of an in-repo encoding regression that neither tsc nor unit tests could catch.
All 10 installer .ps1 files scrubbed + CI AST gate — Em-dashes, en-dashes, arrows, and box-drawing characters were replaced with ASCII equivalents across every install/**/*.ps1 file. A new CI gate in release.yml runs PowerShell's built-in [System.Management.Automation.Language.Parser]::ParseFile plus a BOM/ASCII scan in ~3 seconds before the 10-minute build step — any future encoding or syntax regression is now caught before the installer binary can be produced.
Write-InstallLog fallback — Added a no-op Write-InstallLog stub to install.ps1 and added logger.ps1 to the preflight required-files list, so a missing logger no longer crashes the installer before it can write any diagnostics.

fixApril 21, 2026

CodePulse v2.3.112 — $Script parse bomb (install.ps1)

Install.ps1 failed to parse on every machine — PS 5.1 treated $Script: as a scope modifier. Exit code 1 with no output. Fixed by wrapping in $($Script) subexpression.

Install.ps1 Parse Bomb (TAB-588 — first hotfix)

$Script: inside a double-quoted string was parsed by PS 5.1 as a scope-qualifier prefix expecting a variable name after the :. A space followed instead, which raised a ParserError at script load time — before any install logic could run — and produced exit code 1 with zero log output and no visible error to the user. Every v2.3.111 install failed silently. The fix wraps the bare $Script reference in a $($Script) subexpression to suppress scope-modifier interpretation.
Mailto encoding regression — build-support-email.ps1 switched from HttpUtility.UrlEncode (which encodes spaces as + and violates RFC 6068) to Uri.EscapeDataString (correct percent-encoding for mailto:). An explorer.exe fallback for Start-Process was also added to handle machines where no default browser is registered for the mailto: scheme.

fixApril 20, 2026

CodePulse v2.3.110 — grammY shutdown timeout + Stop button deadlock fix

Two production-blocking issues resolved: sendToAllUsers now has a 3s timeout so shutdown can't hang forever, and the Stop button no longer deadlocks waiting on PowerShell cold-start. Force Kill escalation added.

Shutdown & Stop Reliability (TAB-585, TAB-586)

grammY shutdown timeout (TAB-585) — sendToAllUsers previously awaited grammY's HTTP call with no timeout, so a network hiccup or rate-limit could block the SIGTERM handler indefinitely and leave the process alive until an external taskkill. Every sendToAllUsers invocation is now wrapped in a Promise.race with a 3-second bound, and a 10-second master hard-exit timer is armed at SIGTERM entry so the process exits regardless of handler completion.
Stop button deadlock (TAB-586) — kill_process_tree in the Tauri backend used to spawn PowerShell to terminate the service. PowerShell cold-starts take 1-3s on loaded machines, so the Stop button appeared to freeze with the UI stuck in "Stopping…" indefinitely. It now issues a raw TCP graceful-shutdown to the service's management port, then escalates to taskkill.exe /F /T /PID — no PowerShell in the hot path. A burst-poll loop (500ms x 20) drops the Running-to-Stopped display lag from ~11s to ~2s, and a Force Kill button appears after a timeout so the user always has a one-click escape hatch.

fixApril 15, 2026

CodePulse v2.3.104 — Park UltraPlan command, revert v2.3.103 experiment

Parks the UltraPlan command path because the underlying CLI lacks the --remote flag required for cloud sessions. Reverts the v2.3.103 raw keyword detection experiment.

UltraPlan (TAB-580)

Park the command, revert the experiment — The v2.3.103 raw keyword detection change is reverted, and the UltraPlan command itself is parked because the Claude Code CLI does not yet expose a --remote flag needed to target cloud execution sessions. Restores the prior XML-wrapped, plan-mode routing so the remaining UltraPlan features keep working unchanged while we wait for upstream CLI support.

fixApril 14, 2026

CodePulse v2.3.102 — Exempt .example/.sample from Safety Check

Files ending in .example or .sample are now exempt from the excluded path safety check. This prevents false positives when working with template configuration files.

Bug Fixes

Exempt .example/.sample files from excluded path check — The safety module's excluded path check was flagging files like .env.example and config.sample as sensitive, preventing Claude from reading or modifying them. These template files are safe to access (they contain placeholder values, not real secrets), so the check now exempts paths ending in .example or .sample.

fixApril 14, 2026

CodePulse v2.3.101 — UltraPlan UI Cleanup

Removed the dead 'Open in Browser' text button from UltraPlan cards. The URL button now only appears when a session URL is actually available.

Bug Fixes (TAB-580)

Remove dead "Open in Browser" text button — The UltraPlan card included a plain-text "Open in Browser" button that was never functional (Telegram requires URL buttons for external links). Removed the dead button and ensured the URL button variant only renders when a valid session URL is available.

fixApril 14, 2026

CodePulse v2.3.100 — Escape All Angle Brackets in User Prompts

All angle brackets in user prompts are now escaped, not just the 5 previously allowlisted tags. Closes a potential prompt injection vector via crafted XML-like input.

Security Fix (TAB-581)

Escape ALL angle brackets in user prompts — The previous implementation only escaped 5 specific allowlisted XML tags (<task>, <context>, etc.) in user input before passing it to the LLM. Any other angle-bracket content passed through unescaped, creating a potential prompt injection vector where crafted XML-like input could interfere with the system prompt structure. All angle brackets are now escaped universally, with the allowlist applied only after escaping to restore known-safe structural tags.

fixApril 14, 2026

CodePulse v2.3.98 — UltraPlan Per-User Bridge Map

UltraPlan now uses a per-user bridge map, extracts regex constants, and adds a dedicated executing keyboard to prevent cross-user session conflicts.

Bug Fixes (TAB-580)

Per-user bridge map — UltraPlan sessions were stored in a global map keyed only by session ID. In multi-user setups, this could cause one user's execution to interfere with another's. The map is now keyed by userId:sessionId, preventing cross-user conflicts.
Regex constants extracted — Inline regex patterns used for URL and plan parsing were extracted into named constants for readability and to ensure consistent behavior across the module.
Dedicated executing keyboard — Added a purpose-built Telegram inline keyboard for the "executing" state, showing a Stop button and progress indicator.

fixApril 14, 2026

CodePulse v2.3.97 — UltraPlan URL Regex Hardening

Hardened URL extraction regexes in UltraPlan, eliminated a double card edit race condition, and added a runtime guard against malformed plan responses.

Bug Fixes (TAB-580)

URL regex hardening — The regexes that extract URLs from Claude's plan responses were too greedy, matching partial URLs and markdown syntax as part of the URL. Tightened the patterns to correctly handle parentheses, query strings, and fragment identifiers.
Double card edit race eliminated — When a plan response arrived while a previous card edit was still in flight, both edits could land out of order, showing stale content. Added a serialization queue for card edits.
Runtime guard for malformed plans — Added validation for the plan response structure before attempting to render a card. Malformed responses now show a clear error card instead of crashing the card renderer.

fixApril 14, 2026

CodePulse v2.3.94 — Stop Reply Window Expiry Notification

Users are now notified when the stop reply window expires instead of the stop request being silently dropped. Prevents confusion when stop timing overlaps with task completion.

Bug Fixes (TAB-576)

Stop reply window expiry notification — When a user tapped Stop but the reply window had already expired (e.g., the task finished between the tap and the server processing), the stop request was silently dropped. The bridge now sends a notification explaining that the task already completed, preventing user confusion about whether the stop was received.

fixApril 21, 2026

CodePulse v2.3.113 — em-dash parse bomb + AST CI gate

Install Script Parse Bomb, Round 2 (TAB-588 — second hotfix)

Parse bomb class #2 — UTF-8 em-dash misread as CP1252 closing quote — PS 5.1 reads BOM-less .ps1 files as the CP1252 ANSI codepage. The UTF-8 em-dash — has byte sequence E2 80 94, and 0x94 maps to a curly closing double-quote (") in CP1252, which terminated the string mid-expression. The v2.3.112 hotfix had actually added a new em-dash while fixing the $Script: bomb — a textbook example of an in-repo encoding regression that neither tsc nor unit tests could catch.
All 10 installer .ps1 files scrubbed + CI AST gate — Em-dashes, en-dashes, arrows, and box-drawing characters were replaced with ASCII equivalents across every install/**/*.ps1 file. A new CI gate in release.yml runs PowerShell's built-in [System.Management.Automation.Language.Parser]::ParseFile plus a BOM/ASCII scan in ~3 seconds before the 10-minute build step — any future encoding or syntax regression is now caught before the installer binary can be produced.
Write-InstallLog fallback — Added a no-op Write-InstallLog stub to install.ps1 and added logger.ps1 to the preflight required-files list, so a missing logger no longer crashes the installer before it can write any diagnostics.