fix: security hardening, path traversal, code injection, auth bypass, repo hygiene, test cleanup

.gitignore

@@ -1,8 +1,8 @@
+dist/
 # Dependencies and build outputs
 node_modules/
 
 # Build outputs
-dist/
 build/
 out/
 .next/
@@ -75,7 +75,6 @@ __pycache__/
 .Python
 build/
 develop-eggs/
-dist/
 downloads/
 eggs/
 .eggs/
@@ -328,7 +327,6 @@ coverage/
 .parcel-cache/
 .next/
 .nuxt/
-dist/
 build/
 out/
 .DS_Store
@@ -377,7 +375,6 @@ build/Release/
 .parcel-cache/
 .next/
 .nuxt/
-dist/
 build/
 out/
 # Runtime data and test artifacts
@@ -394,5 +391,9 @@ var/
 # Auto-generated performance baselines
 performance-baselines.json
 
+# Temp session files
+context-ses*.json
+
 # Version manager backups
 backups/
+ci-test-env/

.opencode/.strrayrc.json

@@ -1,7 +1,7 @@
 {
   "framework": {
     "name": "StringRay Framework",
-    "version": "1.15.17",
+    "version": "1.15.18",
     "buildMode": "production",
     "logLevel": "info"
   },

.opencode/codex.codex

@@ -1,5 +1,5 @@
 {
-  "version": "1.15.17",
+  "version": "1.15.18",
   "terms": [
     1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60
   ],

.opencode/command/dependency-audit.md

@@ -69,7 +69,7 @@ Comprehensive dependency analysis and security audit for all project dependencie
   "vulnerabilities": [
     {
       "package": "lodash",
-      "version": "1.15.17",
+      "version": "1.15.18",
       "severity": "high",
       "cve": "CVE-2021-23337",
       "description": "Command injection vulnerability"
@@ -85,14 +85,14 @@ Security-focused format for CI/CD integration:
 
 ```json
 {
-  "version": "1.15.17",
+  "version": "1.15.18",
   "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
   "runs": [
     {
       "tool": {
         "driver": {
           "name": "Dependency Audit",
-          "version": "1.15.17"
+          "version": "1.15.18"
         }
       },
       "results": [...]

.opencode/enforcer-config.json

@@ -1,6 +1,6 @@
 {
   "framework": "StringRay 1.0.0",
-  "version": "1.15.17",
+  "version": "1.15.18",
   "description": "Codex-compliant framework configuration for Credible UI project",
   "thresholds": {
     "bundleSize": {
@@ -220,7 +220,7 @@
       }
     },
     "codex": {
-      "version": "1.15.17",
+      "version": "1.15.18",
       "terms": [
         1,
         2,

.opencode/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opencode/OpenCode",
-  "version": "1.15.17",
+  "version": "1.15.18",
   "description": "OpenCode framework configuration",
   "main": "OpenCode.json",
   "scripts": {

.opencode/strray/codex.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.15.17",
+  "version": "1.15.18",
   "lastUpdated": "2026-03-09",
   "errorPreventionTarget": 0.996,
   "terms": {

.opencode/strray/config.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./config.schema.json",
-  "version": "1.15.17",
+  "version": "1.15.18",
   "description": "StringRay Framework - Token Management & Performance Configuration",
 
   "token_management": {

.opencode/strray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "1.15.17",
+  "version": "1.15.18",
   "description": "StringRay Framework - Unified Feature Configuration",
   "token_optimization": {
     "enabled": true,

.opencode/strray/integrations.json

@@ -4,19 +4,19 @@
     "openclaw": {
       "enabled": false,
       "type": "external-service",
-      "version": "1.15.17",
+      "version": "1.15.18",
       "config": {}
     },
     "python-bridge": {
       "enabled": false,
       "type": "protocol-bridge",
-      "version": "1.15.17",
+      "version": "1.15.18",
       "config": {}
     },
     "react": {
       "enabled": false,
       "type": "framework-adapter",
-      "version": "1.15.17",
+      "version": "1.15.18",
       "config": {}
     }
   }

CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Conventional Commits](https://www.conventionalcommits.org/).
 
+## [1.15.18] - 2026-03-29
+
+### 🔄 Changes
+
+### 🐛 Bug Fixes
+- fix: state persistence path, enforcer blocked logic, console bleed, test fixes, subagent enforcement (#12) (044a0e3)
+
+### 🔧 Maintenance
+- chore: rebuild dist after console.* cleanup (07e4a68)
+
+---
+
 ## [1.15.17] - 2026-03-29
 
 ### 🔄 Changes