[claustrum-ci]

Merging this PR tags and publishes v1.15.0 — the signed release.yml build (goreleaser: 6 binaries + SBOM + cosign + SLSA provenance) runs on the pushed tag.

Generated by knope from the .changeset/ fragments — don't edit it by hand; add or amend a changeset on the source PR instead.

---

Features

• server.capabilities now lists process.kill.farewell, files.list.includeDotNames, process.spawn.failure_reason and server.line_end, and on Windows with jobs on it adds process.spawn.job last. (#779)
• files.list now takes an optional includeDotNames member, and with true it lists the names that start with a dot in the usual order. (#771)
• The git calls outside a repository now start from the cleaned environment and run in one folder, the version run drops the GIT_ names that point at a repository, the probe stores no unknown answer, and the excludes lookup follows XDG_CONFIG_HOME and the home folder. (#757)
• The environment filter of the git calls drops an entry with no =, the pathspec variables, relative home and certificate paths, relative Kerberos files and relative program names, keeps more list variables absolute, and counts a UNC path as absolute on Windows. A ~ include path of the repository config now takes HOME on Linux and macOS. (#749)
• The git-directory trust check now needs search access to objects and refs on Linux and macOS for a daemon that is not root, reads a commondir file as git does (only trailing CR and LF go, and a NUL ends the value), and names a damaged repository or an account that cannot open it in its refusal texts. (#773)
• process.kill and process.killAndWait take a farewell for the stdin of the child and a graceMs before the signal, and their replies end with a farewellEnd member. (#775)
• Every reply line and stream frame line now ends with an end member that holds the byte count of the line before it (len) and the bytes sent on the connection before it (at). (#767)
• On Linux and macOS the daemon now reads the login-shell PATH in the background at its start, unless CLAUDE_SSH_NO_LOGIN_PATH_WARM=1. A spawn waits for that read at most 4 s, and a later spawn tries a failed read again after 30 s and then after longer pauses. A spawn with "disableShellAgentSocket":true and the shutdown end a read that still runs. The read uses a fresh sentinel, caps the shell output and logs byte counts instead of shell output, as does the SSH agent hand-off. That hand-off runs no login shell while the read runs. On Windows the daemon now takes its own PATH at its start and removes that variable too (not measured against the reference). (#777)
• On Linux and macOS, after the repository check exits 128 and its second run exits 0, the daemon runs the check a third time with no config of the user or the system. If that run works, the reply is git could not check this repository on the remote machine with the text of the first check and a hint to fix that setting. The third run ends 30 seconds after the second run started, and a bare repository gets no third run. On Linux and macOS a git directory that fails the git-directory test right after a good check now gets the "no repository" answer. (#776)
• process.stdin with attach answers Process not found, and process.reattach with a non-empty proof answers the zero result, as the reference does for a process without a terminal. (#751)
• A refused process.spawn start now carries an error data member {"reason":"..."} with cwd_missing, cwd_unusable, launcher, not_found, not_executable or other. (#769)
• On Windows each spawned child now runs in a job. So process.kill, process.killAndWait, server.shutdown and the exit of the child end the child and the processes in its job at once. CLAUDE_SSH_NO_JOBS=1 turns the jobs off, and the daemon removes that variable from its own environment on all systems, so no child gets the daemon value. (#778)

Fixes

• On Linux and macOS, if the stdout of -bridge is closed and the daemon sends another frame, the bridge exits with code 0 and is not killed by SIGPIPE. (#772)
• The walk that finds the git directory of a folder now reads a .git file with a strict parse. The file must start with gitdir: with one blank. Trailing CRs and LFs go, other trailing white space stays, and then a NUL ends the path. A path that the NUL makes empty names the folder itself. Any other .git file means no repository. git.worktree_remove now deletes what the reference deletes on Linux for a NUL or a blank in that file. (#755)
• The repository owner probe now passes -c core.fsmonitor= with an empty value instead of core.fsmonitor=false, as the reference does on Windows. Every hardened git call passes the same empty value. (#750)
• On Linux and macOS, process.kill answers -32603 with the system error, such as operation not permitted, when the system refuses the signal, and that child gets no killedBy at its later exit. process.killAndWait logs a refused first signal and a refused group kill, and a child that still runs 7 s after its SIGKILL. (#780)
• The ldd --version libc probe of -install now runs in the folder / on Linux, with the same environment and time limits. (#747)
• The daemon log gets connection lines of its own. A connection that never shows the token logs no New connection line and a counted close line. Refusals and parse errors log by count. The address and the write and scan error texts are quoted. The exit line names this daemon as the one that asked the child to end. (#753)
• After git exits 128 on the repository check, the daemon runs the check once more with GIT_DIR set to its .probe folder, as the reference does. If that run exits 0, the method gives its "no repository" answer. If it fails or runs past 30 seconds, the reply is git could not check this repository on the remote machine with the text of the first check. git.info now runs this check on a folder whose .git file names a gone path. A failed config listing that names a git directory, as in a folder with no repository, now gets the hooks refusal after a git version call. Without such a name, the daemon's own search for a git directory gives the "no repository" answer, in any language of git. (#759)
• Before each uncached call about a repository, the daemon now cleans its own .probe folder. It removes leftover git entries and replaces a folder at HEAD. A .probe folder that cannot be prepared now refuses the request with no git call. The reference does both on Linux for the entries and the refusal that were measured. (#756)
• plugins.prune now gives the skip answer when the clientId folder of the socket is not 8 lowercase hexadecimal characters. It then deletes nothing, and root is "" and minAgeDays is 0. The 8-hex rule is claustrum's own, not measured. (#783)
• The daemon now closes a connection when the write of its -32001 or -32700 reply fails, as the reference does. A failed write of any other reply keeps the connection. (#752)
• The shutdown now labels a child whose kill still waits as shutdown in the exit log line, as the reference does on Linux, and in killedBy. Before, the label stayed client. A plain process.kill keeps client. (#760)
• On Windows a daemon that is killed hard now ends the processes in the job of each child, and with -keep-children they stay alive. (#781)

[greptile-apps]

PR author is in the excluded authors list.