Review follow-ups to #945: a listener caveman did not start this run and
cannot prove it owns (foreign process, or a proxy binary too old to
answer) now launches direct, and the direct-launch strip removes the
agent-attributed /w/<agent> route as well as the bare gateway URL, so a
leaked outer route never reaches the child. Qwen's ACP and extension
listing guards accept yargs camelCase spellings. Proxy-aware fetch no
longer sets an IP literal as TLS servername (rejected on Node 26). The
conformance-pin test fixture follows the pinned-upstream-binary job.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
A foreign listener on 127.0.0.1:8787 used to get the banner but still
receive the routed launch, which would send the operator's provider
keys to a process caveman does not own (#945). Treat it like a gate
mismatch and fall back to a direct launch.
Also: Claude Code refuses Remote Control behind any non-first-party
ANTHROPIC_BASE_URL, so `caveman claude remote-control` launches direct
and the limitation is documented (#947); caveman-compress reads the
first text block instead of content[0] so a leading tool_use block no
longer crashes after a paid call (closes#932's report); hook checksum
manifest regenerated after #794.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Bare start never stamps global recovery; the banner now says which
sessions compress (those whose agent carries caveman_retrieve) and the
status mcp-missing row keys off any installed MCP marker.
Qwen: refuse extension, ACP, session-restore, control-command, and
enforced-auth surfaces that could reactivate a provider route outside
the locked session; replace modelProviders/providerProtocol wholesale
in the routed profile; keep web search and workflows off via env.
Kilo: daemon and console launch direct since they outlive the wrap.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Julius Brussee