- inject_message now uses session's event_bus (BOSS_TURN reaches WebSocket/SSE)
- asyncio.get_running_loop() replaces deprecated get_event_loop()
- API keys masked in /api/providers response
- ServerSession (renamed from Session) with cleanup() for handler teardown
- Path traversal protection in _resolve_scenario_path
- XSS fix: escapeHtml(d.name) in web UI
- Duplicate imports removed, os/json moved to module level
- WebSocket handler restructured for reliable cleanup
- New tests: cleanup, provider masking, path traversal
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- config.py: extracted load_config(), find_workspace_config(),
load_discussion_config() from cli.py; fixed Windows root detection
- cli.py: run_discussion() now creates DiscussionEngine + EventEmitter,
subscribes to events with ANSI-color output (identical to before),
delegates to engine.run()
- backends/custom/run.py: deprecation shim with DeprecationWarning,
delegates to DiscussionEngine
- 16 new config tests, all 184 tests passing
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- api_client.py: APIClient class with ProviderConfig types,
chat_stream() returns str instead of printing,
module-level wrappers for backward compat
- tools.py: ToolRegistry class with instance methods,
pure Python list_files (os.walk) and search_in_files (re.search)
replacing find/grep for Windows compat,
English tool descriptions and error messages,
module-level wrappers for backward compat
- 74 new tests (21 api_client + 53 tools)
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>