Fix audit follow-up gates
- remove gray-matter and use local YAML frontmatter handling
- upgrade DOMPurify and clear production advisories
- make CLI/MCP smoke skip cleanly without VK_API_KEY
- reduce initial JS below the Mantine QA budget
Closes#753Closes#754Closes#755
* build(desktop): isolate local release staging
* Require Apple Silicon for local macOS smoke
---------
Co-authored-by: bradgroux <brad@digitalmeld.io>
## Summary
- adds a v5 permission coverage manifest with classifications, required permissions, denial reasons, and review justifications across REST, WebSocket, CLI, MCP, workflow, transition hook, command palette, and background job surfaces
- adds a Node-based coverage checker that fails when tracked surfaces are missing from the manifest or when REST route prefixes drift from the shared permission map
- wires the checker into CI and documents the manifest gate in the security guide
Closes#420.
## Verification
- `node scripts/check-permission-coverage.mjs`
- `./node_modules/.bin/prettier --check package.json .github/workflows/ci.yml scripts/check-permission-coverage.mjs docs/security/permission-coverage.json docs/security.md`
- `git diff --check`
- `pnpm lint:budget`
- `pnpm build`
- `pnpm audit --prod --audit-level=high` (passes high gate; 3 existing moderate findings)
- GitHub Actions: Build, Lint & Type Check, Security Audit, Workspace Unit Tests
Add release validation and scheduled QA workflows.
Harden webhook URL handling, API helper edge cases, and runtime version reporting.
Split heavy web bundles, centralize view metadata, and stabilize full-suite tests.
- Add squad-post.sh for regular agent messages
- Add squad-event.sh for lifecycle events (spawned/completed/failed/status)
- Add model field to squad messages (types, server, UI, scripts)
- System events render as divider lines in squad chat panel
- Model attribution displays next to agent names in UI
- Full protocol documented in SQUAD-CHAT-PROTOCOL.md
- Updated CONTRIBUTING.md, README.md, and all SOPs
- Added VK_HOST/VK_PORT env vars to .env.example
4-check cross-model review: 10/10 (Code/GPT-5.1, Func/Grok, Perf/Grok, Sec/GPT-5.1)
Agents: R2-D2 (feature), TARS/CASE/Ava/K-2SO (reviews)
- Added run.started, run.tokens, run.completed events for every completed task
- Token estimates based on time tracked and task complexity
- Metrics tab now displays agent run data for all historical tasks
- Added create-review-tasks.sh script
- Updated activity and status history
- Add digest service for 24h activity aggregation
- Add GET /api/digest/daily endpoint (JSON and Teams format)
- Add GET /api/digest/daily/preview for testing
- Add scripts/daily-digest.sh for cron scheduling
- Skip empty digests when no activity
Content includes:
- Tasks completed/created/in-progress counts
- Agent runs with success rate by agent
- Token usage by agent
- Top accomplishments (recently done tasks)
- Failed runs and blocked items
- Created useTaskMetrics hook to fetch and aggregate telemetry events for a task
- Built TaskMetricsPanel component with:
- Summary cards for total runs, success rate, duration, tokens, cost
- Last run status display
- Expandable per-attempt breakdown with full details
- Integrated as new 'Metrics' tab in TaskDetailPanel
- Fetches via GET /api/telemetry/events/task/:taskId endpoint
- Create useRealtimeAgentStatus hook with WebSocket subscription
- Subscribe to agent:status events as primary transport
- Fall back to polling every 10s when WebSocket disconnects
- Auto-reconnect on WebSocket disconnect (via useWebSocket)
- Stale detection marks agent as idle after 5+ min without updates
- Memoized return value to prevent unnecessary re-renders
- Full TypeScript types for AgentStatusData, SubAgent, AgentStatusState
- Maintain backwards compatibility with useGlobalAgentStatus (polling-only)
