open/config-audit
1
0
Fork 0
Code Issues Releases 1 Activity

release: v5.12.1 — "Footgun guard" (Pattern H live-session caveat)

Browse source 
Version-sync for the Pattern H recommendation fix shipped in 45efed3:
- plugin.json 5.12.0 -> 5.12.1
- README version badge + version-history row (1297 tests)
- CHANGELOG [5.12.1] entry

Recommendation string only — no new finding ID or scanner (count stays 16,
agents 7, commands 21), no token figures changed, so --json/--raw stay
byte-stable and frozen v5.0.0 + SC-5 + default-output snapshots are untouched.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Kjell Tore Guttormsen 2026-06-24 10:15:54 +02:00
commit 0f9e319c85
3 changed files with 21 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

18
CHANGELOG.md
View file

@ -5,6 +5,24 @@ All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
## [5.12.1] - 2026-06-24
### Summary
"Footgun guard" — Pattern H (stale plugin-cache versions, `token-hotspots`) recommended deleting
stale version directories without warning that a currently-running session may still hold one of
those versions for its whole lifetime. "Stale" is judged against `installed_plugins.json` (what NEW
sessions load), so the recommendation could reproduce the exact failure that broke a live session:
deleting the directory pulls the files out from under the running session, which then breaks and
must `/exit` + restart. Recommendation text only — no new finding ID or scanner (count stays **16**,
agents **7**, commands **21**), no token figures changed, so `--json`/`--raw` stay byte-stable and
the frozen v5.0.0 + SC-5 + default-output snapshots are untouched. **1297** tests.
### Fixed
- **Pattern H live-session caveat (`token-hotspots`, `plugin-cache-hygiene`).** The stale-cache
cleanup recommendation now cautions against deleting a version a running session still uses, and
tells affected sessions to `/exit` + restart to pick up the active version — closing the footgun
that broke a live session during the C4 cache cleanup.
## [5.12.0] - 2026-06-23
### Summary