v4.15.2 — CodeQL Alerts #99-#107 + ClawHub Clean Scan
Fixed
- CodeQL #107 — Bad HTML filtering regexp (\security.ts): Changed </script>\ to </script\s*>\ to match browser-accepted variants like </script >\ per HTML spec.
- *CodeQL #99 — Unused variable \startTime* (\lib/agent-runtime.ts): Removed.
- *CodeQL #100/#104 — Unused loop variable \ arget* (\lib/strategy-agent.ts): Renamed to _target.
- *CodeQL #101 — Unused imports \AgentPool, \WorkloadPartitioner* (\ est-phase9.ts): Removed.
- *CodeQL #102 — Unused function \�ssertThrows* (\ est-phase9.ts): Removed.
- *CodeQL #103 — Unused variable \echoCmd* (\ est-phase9.ts): Removed.
- ClawHub suspicious flag — Excluded \scripts/postinstall.js\ from Python skill bundle via .clawhubignore; updated \skill.json\ description to acknowledge TypeScript engine.
Full test suite: 2,357 tests across 25 suites, all passing.