• Merged PR #23: Harden server auth, logging, and stream concurrency (by @wildthink)
  • Fix streaming semaphore leak (slot released when stream completes, not when handler returns)
  • Gate /v1/logs and /v1/logs/stats behind --debug
  • Only retain request/response bodies in logs with --debug
  • Clamp /v1/logs?limit= to 1-1000
  • Require token auth for /health on non-loopback binds (--public-health to opt out)
  • Handle CancellationError with 499 status
• Cherry-picked PR #21: Use Transcript.Instructions for CLI system prompt (by @NickBusey)
  • Unifies CLI and server code paths for system prompt handling