- Add constant-time token comparison via crypto.timingSafeEqual (QwenLM#6)
- Validate lock file fields before trusting parsed JSON (#4)
- Verify daemon identity via /health API before sending SIGTERM (QwenLM#5)
- Add session idle timeout (30min) to auto-cleanup unused sessions (#1)
- Reject concurrent prompts on same session instead of overwriting (QwenLM#8)
- Add max session limit (50) to prevent resource exhaustion (QwenLM#7)
- Use server.closeAllConnections() for prompt stop() resolution (QwenLM#15)
- Register onStop callback in foreground mode (QwenLM#10)
- Fix unhandled promise in onStop callback with void (#3)
- Respect encoding parameter in captureWrite (QwenLM#14)
- Remove unnecessary env spread in fork options (QwenLM#9)
- Add tests for lock file validation and session page serving

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

GitHub renders #1, #2 as links to issues/PRs with those numbers.
Review summaries using "#1 (logic error)" link to the wrong target.
Added guideline: use (1), [1], or descriptive references instead.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Follow-up to the initial harden pass, addressing the inline review
comments on PR QwenLM#4340.

Rule #1 (worktree mandatory):
- Scope it to **same-repo PR reviews** so cross-repo PRs running in
  lightweight mode (no matching local remote, no worktree) don't read
  as a contradiction.
- Replace "Your very first action" with "After argument parsing and
  remote detection, the first command that touches code state" — the
  literal "very first" was wrong since `--comment` parsing and
  URL/remote disambiguation legitimately run before `fetch-pr`.
- Align the forbidden-command list with the Step 1 blockquote (add
  `git pull` and `git reset --hard`) so a weak model that only reads
  the Critical rules section sees the same five commands as a model
  that reaches the blockquote at the point of use.
- Add an explicit "cross-repo PRs use lightweight mode" parenthetical
  so the same model knows where to look for the alternative path.

Step 8 skip block:
- Drop the redundant third bullet ("no Critical or Suggestion findings
  with concrete, applicable fixes") — it was both logically equivalent
  to the "Otherwise" clause below and used a different qualifier
  ("concrete, applicable" vs "clear, unambiguous"), risking a weak
  model treating them as two distinct thresholds.
- "ANY of the following" → "EITHER" since only two bullets remain.
- Fold the no-findings case into the Otherwise clause as a no-op note.

…#4340)

* fix(review): harden SKILL.md against weak-model rule skipping

Weak models often skip parts of the long /review prompt and fall back
to familiar defaults — `gh pr checkout` instead of the worktree flow,
or running the autofix prompt even when the user passed `--comment`
(which means "only post inline comments, don't mutate code").

Three reinforcements, all in SKILL.md (no CLI changes):

- Promote the two most commonly violated rules to the top of the
  "Critical rules" list: worktree is mandatory for PR reviews, and
  `--comment` skips Step 8 entirely.
- Add an inline blockquote at the top of the Step 1 PR branch that
  names the specific forbidden commands (`gh pr checkout`,
  `git checkout`, `git switch`, `git pull`, `git reset --hard`).
- Add an explicit skip block at the top of Step 8 listing the three
  conditions that bypass autofix — `--comment`, cross-repo lightweight
  mode, or no fixable findings — so a weak model doesn't have to
  infer them from scattered earlier text.

* fix(review): address /review comments on rule scope + Step 8 dedup

Follow-up to the initial harden pass, addressing the inline review
comments on PR QwenLM#4340.

Rule #1 (worktree mandatory):
- Scope it to **same-repo PR reviews** so cross-repo PRs running in
  lightweight mode (no matching local remote, no worktree) don't read
  as a contradiction.
- Replace "Your very first action" with "After argument parsing and
  remote detection, the first command that touches code state" — the
  literal "very first" was wrong since `--comment` parsing and
  URL/remote disambiguation legitimately run before `fetch-pr`.
- Align the forbidden-command list with the Step 1 blockquote (add
  `git pull` and `git reset --hard`) so a weak model that only reads
  the Critical rules section sees the same five commands as a model
  that reaches the blockquote at the point of use.
- Add an explicit "cross-repo PRs use lightweight mode" parenthetical
  so the same model knows where to look for the alternative path.

Step 8 skip block:
- Drop the redundant third bullet ("no Critical or Suggestion findings
  with concrete, applicable fixes") — it was both logically equivalent
  to the "Otherwise" clause below and used a different qualifier
  ("concrete, applicable" vs "clear, unambiguous"), risking a weak
  model treating them as two distinct thresholds.
- "ANY of the following" → "EITHER" since only two bullets remain.
- Fold the no-findings case into the Otherwise clause as a no-op note.