nyldn/claude-octopus v9.61.2

on GitHub

Fixed

• Careful-mode destructive guards gate on executable context and command boundaries (hooks/careful-check.sh). SQL-looking text in read-only source searches and output commands (grep truncate, rg "DROP TABLE", printf "TRUNCATE users") stays quiet; direct destructive statements and statements executed by known SQL clients still ask for confirmation. The rm guard now needs a word boundary (so charm -rf/farm -rf no longer match while ;rm -rf/sudo rm -rf still do), and git checkout/restore . requires the . to be the whole-tree path rather than a dotfile or ./src subpath. Fixes #835.

• Existing Codex marketplace installs can update again. The Codex adapter
  preserves its original claude-octopus marketplace identity instead of
  borrowing Claude Code's separate octo selector. Shared-marketplace release
  sync now validates both host manifests, preventing stale Codex bundles from
  being stranded behind an identifier mismatch. (#818)

• Ollama, Copilot, and Vibe now honor model pins and allowlists. get_agent_model() had no case arm for these three providers, so OCTOPUS_OLLAMA_MODEL / OCTOPUS_COPILOT_MODEL / OCTOPUS_VIBE_MODEL were silently ignored and dispatch always fell through to the hardcoded default. (#816) validate_model_allowed() had the same gap one function over — OCTOPUS_OLLAMA_ALLOWED_MODELS / OCTOPUS_COPILOT_ALLOWED_MODELS / OCTOPUS_VIBE_ALLOWED_MODELS fell through to the unknown-provider "allow" default, so the model restriction never applied. (closes #817, #819)

• Provider availability now fails closed without disabling supported seats.
  Unknown agent IDs no longer default to available; Grok, Command Code, Atlas
  Cloud, and Vibe have explicit contracts. Atlas Cloud requires a key and
  model, while Vibe requires CLI plus nonblank auth with quote-aware config
  parsing. This addresses the optimistic-predicate portion of #799; the broader
  provider detection/auth-parity work remains open. (#842)

• Smoke-failed providers are excluded from the current workflow fleet.
  Full, minimal, and smart dispatch honor the shared provider-health marker;
  a later passing smoke test clears both marker and expiry metadata immediately
  so repaired credentials or model configuration recover without a stale
  one-hour lockout. (closes #840, #843)

• Lifecycle observer timeouts now reap the hook's entire process group without pkill or wall-clock deadlines. The built-in fallback uses an independent, reaped sleep watchdog on minimal and macOS-style environments where GNU timeout and pkill are unavailable, so timed-out observers cannot leave descendants running and host clock jumps cannot fabricate timeout failures. Regressions require the timeout exit, dead process evidence, watchdog creation/kill/wait cleanup, true monotonic test timing, and the symlinked install path. (closes #827, #828, #832, #837, #844)

• Council approval gates no longer prompt in non-interactive sessions. PTY-backed automation can carry inherited terminal signals even when no user can answer; the shared session-interactivity detector now prevents those false prompts while preserving real interactive approval gates. (closes #825, #826)

Internal

• Skill-template tests generate into an isolated temporary copy instead of rewriting the live checkout, permanently removing a test-side source of hook and working-tree noise. (closes #822, #824)
• Release validation now recognizes nested SKILL.md directories instead of
  falsely reporting registered skills as missing during a release. (closes
  #829, #830)
• The CI unit matrix now has a 25-minute budget and a regression floor after
  the 248-suite macOS job exhausted the old 15-minute ceiling while tests were
  still passing. (closes #846)

Documentation

• The update guide now surfaces Claude Code's host-managed auto-update opt-in for the third-party nyldn-plugins marketplace, retains the manual recovery commands, and explains how to reload the updated plugin. The plugin never rewrites its own loaded cache or user enablement state. (closes #836)