Changelog — Fixes

Bug Fixes (TAB-573)

• Delegate session scoping — The deferred approval pipeline was incorrectly activating for interactive terminal sessions (started via codepulse directly), causing the terminal to pause and wait for Telegram approval on every tool call. Added a session-type check so only delegate-spawned sessions (triggered via Telegram) enter the defer flow.

Bug Fixes (TAB-573)

• hookEventName added to defer response — The CLI's hook protocol requires a hookEventName field on every response to identify which hook event is being answered. The defer response builder was omitting this field, causing the CLI to ignore the defer signal and fall through to the default "allow" behavior. Now included on all defer responses.

Bug Fixes (TAB-573)

• DeferKey shortened for Telegram — Telegram enforces a strict 64-byte limit on callback query data. The original deferKey format included the full session ID and tool call ID, often exceeding this limit. Shortened to a compact hash-based key that fits comfortably within 64 bytes while remaining collision-resistant.

Bug Fixes (TAB-573)

• Session expiry card — When a deferred approval's backing CLI session is terminated before the user responds, the system now detects the dead session and updates the Telegram card with an expiry notice instead of leaving it in a "waiting" state forever.
• Permission mode compatibility — Deferred approvals now respect the session's permissionMode setting, ensuring that auto-approve rules are checked before deferring.
• Eviction guard — A TTL-based eviction mechanism cleans up deferred entries that were never resolved, preventing memory leaks in long-running bridge processes.

Bug Fixes (TAB-562)

• Validate optionIndex before deleting pending entry — When a stale Telegram callback arrived after a session had already been cleaned up, the bridge would attempt to delete an entry at an invalid index, leaving the HTTP connection hanging until timeout. The bridge now validates the index exists before deletion, preventing orphaned connections.

Bug Fixes

• Execution timeout added to plan sessions — Plans that run longer than the configured limit are now gracefully terminated with a timeout card instead of hanging indefinitely. A TTL extension mechanism keeps active plans alive during legitimate long-running operations.
• Strict userId guard — Plan state is now scoped to the originating user. Cross-user access to pending plan sessions is blocked, preventing accidental interference in multi-user setups.

Security (TAB-562, TAB-563, TAB-564)

• Secrets redacted from plan text — Plan output is now scrubbed before display to prevent inadvertent leakage of tokens or keys captured during planning.
• XML prompt-injection sanitization applied to plan inputs — Hardens against <system> and similar tags embedded in user-supplied text.

Correctness

• Session isolation tightened — Plans for one user can no longer leak into another user's session state.
• Abort-signal race fixed — Cancelling a plan mid-generation no longer leaves the CLI in a hung state.
• Re-execution guard — Prevents the same plan from being executed twice on a fast double-tap.
• View Changes metadata + pendingStops hang-timer inclusion + userId null-bypass guard — Three more high-severity fixes that close edge cases surfaced by the adversarial review.

Bug Fixes (TAB-547)

• Fixed: Name-mismatch bugs silently blocked MCP tools — The previous implementation used a static TOOLS_FULL constant plus a hardcoded CLAUDE_NATIVE_MCPS array of 12 names plus discoverMcpToolPrefixes() called once at startup. A subtle name mismatch (linear-global vs mcp__linear) silently blocked Linear MCP across five separate fix attempts — the static list made the mismatch invisible until a diagnostic log was added. Replaced all three layers with a single buildAllowedTools(projectDir?) function called fresh on every CLI spawn. It reads three sources: .claude.json mcpServers at the user level (respecting CLAUDE_CONFIG_DIR), .mcp.json mcpServers at the project level, and permissions.allow from settings.json. All server names are auto-derived — zero hardcoded names remain. A diagnostic log is emitted at spawn time showing exactly which prefixes were discovered. Per-spawn discovery adds minimal I/O overhead and provides a correctness guarantee the static approach could never match: the whitelist is always current, never stale after a config change.

Bug Fixes (TAB-546)

• Added local Linear MCP variants to the allowedTools whitelist — Claude Code's cloud MCP path (mcp__claude_ai_Linear) does not connect in stream-json mode due to known Claude Code bug #37105 — the cloud MCP server handshake silently times out. Local HTTP MCP servers are the reliable path. Added mcp__linear, mcp__linear-server, mcp__cloudflare-bindings, mcp__chrome-devtools, and mcp__auggie to the whitelist so any of these configurations resolve correctly at spawn time. This is a follow-up patch to TAB-546 — the full dynamic discovery fix arrived in v2.3.61.

Bug Fixes (TAB-539)

• Fixed: Voice auto-confirm timer was too short — The 20-second default introduced in v2.3.54 was still being overridden in the wild by installed .env files that contained an older VOICE_AUTOCONFIRM_SECONDS=10 value. Explicit .env values always override code defaults, so users saw 10-second timeouts regardless of the code. Updated all three layers to 40 seconds: the config.ts default, the voice-engine.ts fallback, and .env.example for new installs. Users with a hand-set VOICE_AUTOCONFIRM_SECONDS in their .env must manually change it to 40 to benefit from the longer default.