PR #4360 - callstack/agent-device

Summary

Fixes audit findings DEXEC-1/2/3/7, DSESS-1/4/6, CMD2-1 and DCORE-4 from the 2026-11-10 audit.

type (DEXEC-1/2): refuses only real snapshot refs (@e12, @e12~s3); text such as @elena or @refund is now typed. Validation runs before binding, dialog recovery and ref-frame expiry, so the fill @eN hint names a live ref. The type leg of find types its value verbatim.
trigger-app-event (DEXEC-3): reads per-platform URL templates only on ios, macos and android. The refusal hint names only the variables that are actually read.
alert (DEXEC-7): parses its subaction case-insensitively and refuses an unknown one before binding.
push (DSESS-1): inline JSON longer than NAME_MAX is parsed as JSON instead of failing as a file path. The payload is resolved once.
Relative paths (DSESS-4): install, reinstall, trace and perf resolve them against the caller's cwd (requestCwd).
clipboard write "" (CMD2-1): now reaches the daemon as the clear request.
Recorded clearing fill (DCORE-4): writes fill <selector> "".
doctor (DSESS-6): reads platform inventories concurrently.
Deferred:
- DEXEC-6 (tar on artifact listing): it needs a protocol bump or a client that tolerates a missing sizeBytes, because released CLIs print the field without a guard. The first attempt was reverted in this PR.
- DEXEC-4 (sessionless wait <ms>): it needs a selector runtime that works without a device.

About 28 files changed.

Tested SHA 12c6599: pnpm check:affected --run --head, exactCommit=true. Format, lint, typecheck, layering, fallow, build and the related tests pass. The unit suite failed only on the 7 known root-only chmod tests.
Revert head 7e3682f: the affected tests (193), pnpm check:quick and pnpm check:daemon-wire-compat pass. All wire paths are identical to main.
Risk: alert now refuses unknown subactions that it used to treat as get.

🤖 Generated with Claude Code