What's in v0.5.12: • Telegram guests: a tag in a chat the bot was never invited to runs the same tool surface, live status block and rich rendering as a normal turn, with one cancellable turn per guest session and rate limiting (#2087, #2109, #2133, #2135, #2138, #2143) • Guest safety: the tool set is capped at what a stranger should reach, and a reply no longer carries the answer twice (#2113, #2134) • Plan gate: a turn that crosses a threshold of tool calls must stop and write a plan before it continues (#2128) • browser_act gained an upload action that attaches local files to a file input without putting their bytes in the context (#2112) • bash refuses sleep while a detached task is running and names the task it is waiting on (#2123) • TUI: the transcript survives a session switch, because the fold map is keyed by a stable anchor instead of a UUID minted per render (#2155) • Headless installs provision the built-in provider the way the TUI already did (#2151) • Phantom detection: a contraction, a question, a sign-off after a halt, or a denied tool call is no longer read as a promised action (#2083, #2090, #2110, #2122) • Security: every outbound channel path sanitizes at one chokepoint, the http body is capped and its read bounded, string slicing cannot land mid-character, and a config or keys write that would not parse is refused (#2099, #2102, #2104, #2124) • Release packaging ships OpenCrabs.app and a Linux desktop entry with a full size icon ladder (#2115, #2116, #2117, #2119) 6 CONTRIBUTORS • 78 COMMITS • 46 FIXES • 8 FEATURES • 11,091 TESTS