CHANGELOG promotion was a manual operator step that was never run, so 463 fragments for work already shipped in <=1.3.1 accumulated in .changeset/. Their notes were already hand-curated into the dated [1.2.0]/[1.3.0]/[1.3.1] CHANGELOG sections (#690 backfill, PR #694). Rendering them now would duplicate and mis-attribute shipped work. Move them to .changeset/archived/ (read non-recursively by all changeset tooling, so never rendered), keeping only the 3 genuinely-unreleased fragments at the top level. Prep for wiring `render` into the release finalize job (#690 follow-up). Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
484 B
484 B
type, pr
| type | pr |
|---|---|
| Fixed | 3269 |
Workstream name normalization — workstream names are now consistently validated across CJS and SDK layers, accepting alphanumeric, hyphens, underscores, and dots (e.g. v1.0); path traversal via .. sequences is blocked in both layers. The model_profile: 'inherit' sentinel no longer leaks as a literal model ID in session-runner. SDK writeActiveWorkstream now validates that the target workstream directory exists before writing the pointer.