- check_agent() custom check_type: replace subprocess shell=True with
shlex.split + shell=False (prevents agent-registry config from injecting
arbitrary shell). Verified malicious '; touch' no longer executes.
- Add startup port guard in main: probe API port before uvicorn.run;
exit 1 with clear message if already bound (stops the double-instance
collision that caused phantom 'register does not persist' bugs).
- start_terminal_server (8082): pre-bind probe + try/except so a taken
port logs a warning instead of crashing the whole process.
- AGENTS.md single source of truth with 51+10 features
- FastAPI backend with 20+ REST endpoints
- 15 skills with self-improvement (eval + learnings)
- Web SPA dashboard with 12 pages
- Agent configs for opencode, Hermes, Gemini CLI
- APScheduler, plugin registry, standards system
- 10 prompt templates, cost analytics, backup/restore
Austin
modimihir07