release: OpenMagic v0.45.0 — full audit remediation

[Kalmuraee]

Summary

This release resolves the complete OpenMagic safety and reliability audit, OM-001 through OM-033.

Major areas covered:

• Provider-bound API credentials and safe legacy-key migration
• Safe ownership and shutdown of development-server processes
• Cross-platform startup on Linux, macOS, and Windows
• Awaited and cancellable Claude Code, Codex CLI, and Gemini CLI execution
• Isolated native-agent editing with safe Git capture and rollback
• File-mode, raw-byte, BOM, line-ending, symlink, backup, and manifest safety
• Transactional patch groups and complete rollback-chain validation
• True multi-root file, grounding, patch, tool, rollback, and verification behavior
• Proxy fidelity for API errors and encoded responses
• Correct Gemini reasoning configuration and multi-image serialization
• Nested-DOM visual editing without destroying child elements
• Stronger static and runtime verification
• Screenshot text preservation, final SSE flushing, bounded conversation history, and exact paginated reads
• Improved framework grounding and static SPA routing
• Release metadata synchronized to v0.45.0

Validation completed before opening this PR

• Production build
• TypeScript typecheck
• ESLint
• Full unit and integration suite: 277/277 passing
• Edit-success evaluation: 6/6 (100%)
• CLI smoke test
• Chromium browser smoke test
• npm package dry-run inspection for openmagic@0.45.0
• Production dependency audit: 0 vulnerabilities

The PR CI additionally validates the exact branch head on Ubuntu/Node 20, Ubuntu/Node 22, macOS/Node 22, and Windows/Node 22. After merge, the independent release workflow repeats the release gates before publishing to npm and creating the GitHub release.

See AUDIT_PROGRESS.md and CHANGELOG.md for details.

[Kalmuraee]

Windows CI remediation completed

Pushed and validated on the clean PR head 662edf0580d85a88b7794fca94eddee855392599.

Fixes added

• Normalized repository-relative paths to portable / separators across file listing, grep, project grounding, symbol lookup, and multi-root resolution.
• Fixed grounding truncation markers so they cannot exceed the configured context budget.
• Reworked verification-script execution on Windows to use ComSpec safely instead of spawning npm.cmd directly.
• Added script-name validation before invoking the Windows command shell.
• Normalized verification output paths before matching errors to touched files.
• Added Windows path and npm invocation regression coverage.

Final validation

• Ubuntu / Node 20: passed
• Ubuntu / Node 22: passed
• macOS / Node 22: passed
• Windows Server 2025 / Node 22: passed
• Unit and integration suite: 281/281 passed on Windows
• Edit-success evaluation: passed
• CLI smoke test: passed on Linux, macOS, and Windows
• Chromium browser smoke test: passed
• npm package inspection: passed
• Production dependency audit: passed
• CodeQL: passed

The temporary remediation script and workflow were removed. PR #34 is clean, mergeable, and all authoritative checks are green.