P0 — agent-mode contract:
- output.ts: make emit/emitError/emitEnvelope return Promise<void> with
  awaitable stdout writes (writeLine helper); process.exit() no longer
  races the OS pipe buffer flush on any command
- build.ts: await context.output.emit/emitError before process.exit()
- cli.ts: add exitOverride() + configureOutput({writeErr:()=>{}}) so
  Commander usage errors (missing arg, unknown option) map to exit 2
  with an ok:false USAGE envelope in --json mode instead of exit 1 + no envelope

P1 — functional bugs:
- cli.ts: fix --no-input flag (Commander stores under opts.input, not
  opts.noInput); remove bogus false default on negated option
- cli.ts + registry/types.ts: add configPath to CommandContext so
  config set --config <path> writes to the user-specified file, not
  the default location
- cli.ts + config/paths.ts: import configFile and resolve configPath
  in makeContext; commands/config.ts: use ctx.configPath in saveConfig
- core/torrent/engine.ts: replace fake StreamNetTimeoutError class with
  real StreamNetError(TORRENT_UNPLAYABLE); fix Aborted and file-not-found
  rejects — all now properly instanceof StreamNetError
- util/http.ts: re-throw StreamNetError at start of catch so HTTP errors
  from fail() are not re-wrapped as "Network error: StreamNetError: ..."
- commands/stream.ts: wrap post-startStream body in try/finally so
  info.destroy() always runs even when spawnVlc/waitForVlc throws
- core/indexers/aggregate.ts: return {results, succeededCount, failedCount}
  instead of bare array
- commands/search.ts: fail(NETWORK) when all indexers reject instead of
  NO_RESULTS (agents retry differently on network vs no-results)
- registry/build.ts: coerce ZodNumber flag values from string (Commander
  always delivers strings for non-boolean flags); fail USAGE on NaN
- test/agent-mode.test.ts: raise doctor test timeout to 15s (makes a
  live network call that can take 3-5s on loaded runners)
- test/indexers.test.ts: update to destructure AggregateResult

P2 — security:
- config/store.ts: guard setConfigValue key segments against
  __proto__ / constructor / prototype prototype-pollution walk

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Portable three-layer knowledge graph integration: SessionStart/PostToolUse/
UserPromptSubmit/Stop/PreToolUse hooks, graphify graph (auto-updates on commit),
decisions + bugs ADRs committed, runtime artifacts gitignored. No-ops gracefully
without local CKIS vault — external contributors unaffected.

Registered in Dev Brain (~/Documents/Dev Brain/); graph-report auto-synced to CKIS
02-projects/<slug>/graph-report.md on each commit.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

- Add .npmrc: ignore-scripts=true, registry pin, save-exact=true
- Patch GHSA-5xrq-8626-4rwp: vitest → ^4.1.8 (critical — arbitrary file read/exec)
- Pin all GitHub Actions to commit SHAs (not mutable tags)
- Add --ignore-scripts to all npm ci / pnpm install steps in CI
- Add explicit native module whitelist with npm_config_ignore_scripts=false rebuild
- Add npm audit --audit-level=high gate to all CI and release workflows
- Add permissions: {} (deny-all default) with per-job minimum grants
- Add persist-credentials: false to all checkout steps
- Add weekly security-audit.yml workflow (runs every Monday 09:00 UTC)
- Add SECURITY.md with supply chain security policy and vulnerability disclosure

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

…-credentials: false

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Implements the OpenSubtitles/VLSub subtitle pipeline and full-download mode
toward v1.0.0, and fixes a pre-existing flag-parsing bug surfaced during the audit.

Added
- core/subtitles/hash.ts: OpenSubtitles "moviehash" (size + first/last 64 KiB
  checksum), reading only the two windows (cheap on multi-GB files).
- core/subtitles/opensubtitles.ts: REST v1 client — hash + text search with
  ranked results (hash match > language preference > download count) and
  download-link resolution. Api-Key from config, never hardcoded.
- core/subtitles/fetch.ts: orchestrates hash -> search -> download -> write
  `<name>.<lang>.srt` beside the video, with a title-query fallback.
- commands/subs.ts: `streamnet subs <file>` (--lang, --query).
- commands/download.ts + engine.downloadTorrent(): full download to the
  configured dir with progress, auto subtitle fetch for non-MKV files.
- stream/play: non-MKV streams best-effort fetch subtitles by title and pass
  --sub-file to VLC; never fail the stream on a subtitle error.
- doctor: download-dir write check + warn-only OpenSubtitles key check
  (warnings don't flip allOk/exit code).

Fixed
- Flag arity (P0): optional/default-wrapped Zod flags were classified as
  boolean, so `--container`, `--quality`, `--indexer`, `--sub-lang`, `--query`,
  `--out` swallowed no value ("too many arguments") and numeric coercion was
  skipped on optional numbers. build.ts now unwraps Optional/Default/Nullable
  to the underlying type. Regression test in test/flag-arity.test.ts.

Tests: 49 passing (was 38). tsc/lint/build green. Subtitle and download paths
fully mocked — no live network or torrents in tests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Bump package.json 0.1.0 -> 1.0.0 and align docs for the first stable
release: promote CHANGELOG [Unreleased] -> [1.0.0], reframe README roadmap
(1.0.0 shipped; MCP/resolvers/binaries moved to post-1.0). Harden the two
agent-mode subprocess tests with an explicit 15s timeout so Node startup
under parallel load no longer trips the 5s default (was failing the release
gate).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The "Rebuild native WebTorrent dependencies" step uses `2>/dev/null`, which
on windows-latest runs under pwsh and is parsed as Out-File to `D:\dev\null`,
failing the step (the `|| true` can't rescue a parse-time error). Pin the step
to `shell: bash` (Git Bash is preinstalled on Windows runners) in both ci.yml
and release.yml so it behaves identically across all three OSes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

release: streamnet-cli v1.0.0 — full stream pipeline, subtitles, download

Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4.4.0 to 6.4.0.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@49933ea...48b55a0)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>