Deep Code Review — 6 rounds, 82 issues fixed
Fixed
- Cost tracking silently broken for all sessions —
$HOMEinside single quotes prevented bash expansion - Workflow deadlock reported as false success instead of error
- Startup commands
&&chain silently prevented agent launch on setup failure - Implicit PTY exit force-discarded isolated worktrees (data loss)
- Project deletion with active sessions orphaned worktrees
- Loop counter reset affected sibling loop edges
- Agent updater hardcoded
.jsbin entry suffix - Timer TOCTOU race in CostTracker, registry leak for deleted worktrees
- 10+ additional memory leak, state cleanup, and UI fixes
Security
- SAFE_ID_RE validated consistently across all 53 IPC channels
- Shell injection hardening (shellQuote, path traversal normalization)
- Renderer log data bounded, agentFlags validated, wsl.exe
--separators
Performance
- Titlebar narrow selector (prevents re-renders at PTY data rate)
- Concurrent workflow file reads, async worktree registry I/O
- O(1)
isDone()in edge-scheduler, O(1) agent metadata lookup - Cached accent RGB, static position arrays, filename-based prune sort
611 tests, 0 lint warnings. Full changelog in CHANGELOG.md.