• refactor(oauth): align box chars with CCS standard and add JSDoc
• fix(dashboard): detect popup blocked during OAuth flow
• fix(jsonl): add explicit UTF-8 BOM stripping
• fix(websearch): normalize double-slash paths in hook detection
• fix(quota): add explicit 429 rate limit handling
• fix(websocket): add maxPayload limit to prevent DoS attacks
• fix(dashboard): cross-browser OAuth with manual callback fallback (#417) (#423)
• test(websearch): add unit tests for hook-utils module