feat: v0.15.0 — CLI compatibility and read-only agent tools

[subinium]

Summary

Implement the requested items 1, 2, 4 and 5 from the AGF compatibility plan.
The release is 0.15.0. No Copilot scanner or browser port is included;
the existing 14 providers remain.

Changes And Effects

Issue	Change	Verified effect / boundary
#83	Shared provider root resolution, independent Codex SQLite storage, exact argv/cwd/env resume plans and absolute executable selection	Custom roots remain consistent across scans/fingerprints/resume/deletion; changing cwd cannot rebase storage roots or select a different relative-PATH executable. Only storage env variables are forwarded. Codex user config is covered, not its project/profile/managed stack.
#84	Gemini JSONL plus legacy JSON, current-format migration dedup, bounded metadata recovery, Cursor explicit executable override and path classification	Current Gemini sessions are discoverable without truncated IDs; malformed/oversized records remain bounded. Generic agent binaries are not assumed to be Cursor. Gemini direct deletion is disabled in favor of native sidecar-aware cleanup.
#85	Versioned read-only JSON search/show/resume-plan/capabilities, a shared stdio MCP adapter and portable Skill	Exact identities, scoped results, bounded fields/pages, typed errors and explicit non-execution. Metadata/summaries remain untrusted. MCP uses official rmcp 3.2 and both modern and legacy lifecycle tests.
#86	SLT 0.24.0, full-target Rust validation, I/O/settings/platform hardening and release verification	MSRV 1.88 retained. BrokenPipe is separate from other I/O errors; corrupt settings are preserved; Watch distinguishes unknown from idle and retains unfiltered cache data. No blanket latency/memory improvement claim.
#87	Bounded Qwen/Prime UTF-8 prefix recovery	A cap inside a final multibyte scalar does not discard valid envelope/activity data; malformed interior bytes remain rejected.
#88	Yolop I/O failure propagation and followed-file-symlink fingerprints	Failed refreshes preserve stale rows for retry; external target changes invalidate caches; directory symlinks are not recursively followed.
#89	SQLite title bounds before aggregation	OpenCode/Hermes parent and child title materialization is bounded while ordering, literal delimiters and intended dedup semantics are preserved.
#90	Browse viewport/hit limits, unavailable Cd handling and grapheme cursors	Footer/separator clicks cannot select hidden sessions; tiny/resize viewports remain bounded; CJK/combining/ZWJ cursors use graphemes.

Review Corrections

• Reject option-like/control-character session IDs before plan creation, common
  discovery, cached TUI selection and direct CLI resume. Shell quoting alone is
  not protection against native option parsing.
• Configuration parse errors no longer expose raw TOML snippets or unrelated
  secret values through API warnings/errors or settings diagnostics.
• Preserve provider storage roots across cwd changes using a scoped environment
  map. POSIX assignment-prefix invocation requires no external env helper;
  PowerShell restores previously set/unset variables.
• Freeze the selected executable to its absolute first PATH match. The PTY
  fixture uses a relative PATH valid only before changing cwd, with no env
  binary, to verify real handoff behavior rather than command-string appearance.
• An official checksum-verified PowerShell 7.6.5 portable runtime reproduced a
  native failure being masked after finally cleanup. Dedicated child shells
  now preserve native failure codes and report PowerShell errors; parent-shell
  wrappers remain a separate path.
• Non-Unicode canonical project paths return a typed error instead of panicking
  during JSON serialization. Pure path checks cover Unix/Windows; the actual
  invalid-byte filesystem fixture is Linux-specific because APFS rejects it.

First CI Follow-Up

Run 33980938025 exposed two test-harness defects; neither is waived or skipped:

• Linux rendered All (0) and then updated only its digit to 1. Matching an
  ANSI-stripped transcript could not recognize the correct All (1) screen.
  The PTY harness now uses pinned pyte/wcwidth terminal parsing and snapshots
  only completed synchronized frames. Eight deterministic regressions cover
  the original count update, partial/stale frames, coexisting anchors, resize
  invalidation and bytewise UTF-8. The original anchors and deadlines remain.
• Windows fixture expectations confused native absolute paths with equivalent
  canonical verbatim paths. Test-only comparisons now require absolute paths
  and equal existing canonical identities. First-executable/root selection,
  quoting, scoped environment and missing-executable fallback checks remain.
  The production part of src/config.rs is byte-identical to the first CI run.

Unix CI installs the pinned Python test dependencies; they are not application
runtime dependencies. The screen regressions also run from normal Cargo tests.

Validation

All 18 local gate stages passed on an unchanged source snapshot using
Rust 1.98.1, plus explicit Rust 1.88 check and all-target Clippy:

• Debug 266/266, release 266/266, no-default 255/255 tests; no ignored cases.
  Each Unix suite includes the eight deterministic terminal-screen replays
  through one Cargo integration test, plus two actual native PTY scenarios.
• All-target/all-feature check and warning-denying Clippy, minimal-feature check
  and Clippy, fmt, RustSec, warning-denying rustdoc and package verification.
• Actual installed binary JSON/MCP smoke, four registry-verifier unit tests,
  actionlint and diff checks.
• Official Skill validator passed in an isolated PyYAML environment.
• PowerShell 7.6.5 process checks ran from a checksum-verified portable tool,
  without installation or modification of user shell profiles.

Exact-head remote CI 33982178200 passed 9/9 on
975ab5e3d3646977d7a4c611923c486485a03715: Linux, macOS, Windows,
no-default features, MSRV 1.88, Clippy, formatting, package and security audit.
The previous Linux screen-matching and Windows path-spelling failures are
resolved by the test-only corrections above; neither was skipped.
The native PTY tests use a disposable HOME and a synthetic provider, never a
real account/session. They cover populated rendering, resize, UTF-8/paste,
single-Escape exit, terminal/fd restoration and exact argv/cwd/env handoff.
Darwin's kernel-written fd bookkeeping flag is measured by a same-binary
--version control; flags are compared exactly, not masked.

MCP tests cover current 2026-07-28 discovery and legacy 2025-11-25 /
2025-06-18 lifecycles, scope enforcement, four read-only tools, errors,
oversized/partial input, cancellation capacity and EOF. This is bounded stdio
interoperability, not blanket conformance or live invocation by every client.

The release workflow reuses quality checks before artifact builds and makes
registry publication/provenance and an installed JSON/MCP consumer mandatory
before GitHub release creation. Homebrew checksums are updated after the actual
release archives exist, never invented before publication.

Remaining Boundaries

• Physical OS IME and real provider execution are not claimed by synthetic
  protocol/PTY fixtures. Windows console PTY behavior is separate from Windows
  Rust/CLI tests.
• Oh My Pi profile/XDG extensions and the full Codex layered configuration model
  remain outside this release's validated root-resolution scope.
• CSV intentionally preserves source values; spreadsheet consumers must import
  untrusted values as text.
• Remaining shell-setup writer coordination and metadata-preserving replacement
  edge cases in hardening: post-v0.14 I/O, setup, and edge-case follow-ups #79 are not declared fixed. Session-title UX session names/titles #48 is not included.

Fixes #83. Fixes #84. Fixes #85. Fixes #86.
Fixes #87. Fixes #88. Fixes #89. Fixes #90.
Refs #75, #79.

[subinium]

Release verification complete: v0.15.0 is published at https://github.com/subinium/agf/releases/tag/v0.15.0 . Release workflow 33982590150 passed 17/17 jobs, including exact crates.io archive provenance and a registry-installed JSON/MCP smoke. All five public archive checksums passed; macOS ARM64 JSON/MCP and Linux x86_64 version/capabilities were also executed independently. Homebrew follow-up #92 is merged, the public tap is updated, actual formula install/test and installed JSON/MCP smoke passed. Final main bc49196 passed CI 33983718119 (9/9). Physical OS IME and real provider-account execution remain outside the automated fixture evidence; remaining #75/#79 scope is recorded separately.