AndyMik90 · AndyMik90 · Jan 1, 2026 · Dec 31, 2025 · Dec 31, 2025 · Dec 31, 2025
diff --git a/.github/workflows/pr-status-gate.yml b/.github/workflows/pr-status-gate.yml
@@ -2,7 +2,7 @@ name: PR Status Gate
 
 on:
   workflow_run:
-    workflows: [CI, Lint, Quality Security, CLA Assistant, Quality Commit Lint]
+    workflows: [CI, Lint, Quality Security]
     types: [completed]
 
 permissions:
@@ -36,7 +36,7 @@ jobs:
             // To find check names: Go to PR → Checks tab → copy exact name
             // To update: Edit this list when workflow jobs are added/renamed/removed
             //
-            // Last validated: 2025-12-26
+            // Last validated: 2025-12-31
             // ═══════════════════════════════════════════════════════════════════════
             const requiredChecks = [
               // CI workflow (ci.yml) - 3 checks
@@ -49,11 +49,7 @@ jobs:
               'Quality Security / CodeQL (javascript-typescript) (pull_request)',
               'Quality Security / CodeQL (python) (pull_request)',
               'Quality Security / Python Security (Bandit) (pull_request)',
-              'Quality Security / Security Summary (pull_request)',
-              // CLA Assistant workflow (cla.yml) - 1 check
-              'CLA Assistant / CLA Check',
-              // Quality Commit Lint workflow (quality-commit-lint.yml) - 1 check
-              'Quality Commit Lint / Conventional Commits (pull_request)'
+              'Quality Security / Security Summary (pull_request)'
             ];
 
             const statusLabels = {

diff --git a/.husky/pre-commit b/.husky/pre-commit
@@ -36,14 +36,44 @@ if git diff --cached --name-only | grep -q "^package.json$"; then
       echo "  Updated apps/backend/__init__.py to $VERSION"
     fi
 
-    # Sync to README.md
+    # Sync to README.md - section-aware updates (stable vs beta)
     if [ -f "README.md" ]; then
       # Escape hyphens for shields.io badge format (shields.io uses -- for literal hyphens)
       ESCAPED_VERSION=$(echo "$VERSION" | sed 's/-/--/g')
-      # Update version badge - match both stable (X.Y.Z) and prerelease (X.Y.Z-prerelease.N or X.Y.Z--prerelease.N)
-      sed -i.bak "s/version-[0-9]*\.[0-9]*\.[0-9]*\(-\{1,2\}[a-z]*\.[0-9]*\)*-blue/version-$ESCAPED_VERSION-blue/g" README.md
-      # Update download links - match both stable and prerelease versions
-      sed -i.bak "s/Auto-Claude-[0-9]*\.[0-9]*\.[0-9]*\(-[a-z]*\.[0-9]*\)*/Auto-Claude-$VERSION/g" README.md
+
+      # Detect if this is a prerelease (contains - after base version, e.g., 2.7.2-beta.10)
+      if echo "$VERSION" | grep -q '-'; then
+        # PRERELEASE: Update only beta sections
+        echo "  Detected PRERELEASE version: $VERSION"
+
+        # Update beta version badge (orange)
+        sed -i.bak "s/beta-[0-9]*\.[0-9]*\.[0-9]*\(--[a-z]*\.[0-9]*\)*-orange/beta-$ESCAPED_VERSION-orange/g" README.md
+
+        # Update beta version badge link (within BETA_VERSION_BADGE section)
+        sed -i.bak '/<!-- BETA_VERSION_BADGE -->/,/<!-- BETA_VERSION_BADGE_END -->/s|releases/tag/v[0-9.a-z-]*)|releases/tag/v'"$VERSION"')|g' README.md
+
+        # Update beta download links (within BETA_DOWNLOADS section only)
+        for SUFFIX in "win32-x64.exe" "darwin-arm64.dmg" "darwin-x64.dmg" "linux-x86_64.AppImage" "linux-amd64.deb" "linux-x86_64.flatpak"; do
+          sed -i.bak '/<!-- BETA_DOWNLOADS -->/,/<!-- BETA_DOWNLOADS_END -->/{s|Auto-Claude-[0-9.a-z-]*-'"$SUFFIX"'](https://github.com/AndyMik90/Auto-Claude/releases/download/v[^/]*/Auto-Claude-[^)]*-'"$SUFFIX"')|Auto-Claude-'"$VERSION"'-'"$SUFFIX"'](https://github.com/AndyMik90/Auto-Claude/releases/download/v'"$VERSION"'/Auto-Claude-'"$VERSION"'-'"$SUFFIX"')|g}' README.md
+        done
+      else
+        # STABLE: Update stable sections and top badge
+        echo "  Detected STABLE version: $VERSION"
+
+        # Update top version badge (blue) - within TOP_VERSION_BADGE section
+        sed -i.bak '/<!-- TOP_VERSION_BADGE -->/,/<!-- TOP_VERSION_BADGE_END -->/s/version-[0-9]*\.[0-9]*\.[0-9]*\(--[a-z]*\.[0-9]*\)*-blue/version-'"$ESCAPED_VERSION"'-blue/g' README.md
+        sed -i.bak '/<!-- TOP_VERSION_BADGE -->/,/<!-- TOP_VERSION_BADGE_END -->/s|releases/tag/v[0-9.a-z-]*)|releases/tag/v'"$VERSION"')|g' README.md
+
+        # Update stable version badge (blue) - within STABLE_VERSION_BADGE section
+        sed -i.bak '/<!-- STABLE_VERSION_BADGE -->/,/<!-- STABLE_VERSION_BADGE_END -->/s/stable-[0-9]*\.[0-9]*\.[0-9]*\(--[a-z]*\.[0-9]*\)*-blue/stable-'"$ESCAPED_VERSION"'-blue/g' README.md
+        sed -i.bak '/<!-- STABLE_VERSION_BADGE -->/,/<!-- STABLE_VERSION_BADGE_END -->/s|releases/tag/v[0-9.a-z-]*)|releases/tag/v'"$VERSION"')|g' README.md
+
+        # Update stable download links (within STABLE_DOWNLOADS section only)
+        for SUFFIX in "win32-x64.exe" "darwin-arm64.dmg" "darwin-x64.dmg" "linux-x86_64.AppImage" "linux-amd64.deb"; do
+          sed -i.bak '/<!-- STABLE_DOWNLOADS -->/,/<!-- STABLE_DOWNLOADS_END -->/{s|Auto-Claude-[0-9.a-z-]*-'"$SUFFIX"'](https://github.com/AndyMik90/Auto-Claude/releases/download/v[^/]*/Auto-Claude-[^)]*-'"$SUFFIX"')|Auto-Claude-'"$VERSION"'-'"$SUFFIX"'](https://github.com/AndyMik90/Auto-Claude/releases/download/v'"$VERSION"'/Auto-Claude-'"$VERSION"'-'"$SUFFIX"')|g}' README.md
+        done
+      fi
+
       rm -f README.md.bak
       git add README.md
       echo "  Updated README.md to $VERSION"
@@ -72,20 +102,25 @@ if git diff --cached --name-only | grep -q "^apps/backend/.*\.py$"; then
   fi
 
   if [ -n "$RUFF" ]; then
-    # Run ruff linting (auto-fix)
-    echo "Running ruff lint..."
-    $RUFF check apps/backend/ --fix
-    if [ $? -ne 0 ]; then
-      echo "Ruff lint failed. Please fix Python linting errors before committing."
-      exit 1
+    # Get only staged Python files in apps/backend (process only what's being committed)
+    STAGED_PY_FILES=$(git diff --cached --name-only --diff-filter=ACM | grep "^apps/backend/.*\.py$" || true)
+
+    if [ -n "$STAGED_PY_FILES" ]; then
+      # Run ruff linting (auto-fix) only on staged files
+      echo "Running ruff lint on staged files..."
+      echo "$STAGED_PY_FILES" | xargs $RUFF check --fix
+      if [ $? -ne 0 ]; then
+        echo "Ruff lint failed. Please fix Python linting errors before committing."
+        exit 1
+      fi
+
+      # Run ruff format (auto-fix) only on staged files
+      echo "Running ruff format on staged files..."
+      echo "$STAGED_PY_FILES" | xargs $RUFF format
+
+      # Re-stage only the files that were originally staged (in case ruff modified them)
+      echo "$STAGED_PY_FILES" | xargs git add
     fi
-
-    # Run ruff format (auto-fix)
-    echo "Running ruff format..."
-    $RUFF format apps/backend/
-
-    # Stage any files that were auto-fixed by ruff (POSIX-compliant)
-    find apps/backend -name "*.py" -type f -exec git add {} + 2>/dev/null || true
   else
     echo "Warning: ruff not found, skipping Python linting. Install with: uv pip install ruff"
   fi

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -25,14 +25,41 @@ repos:
               # Sync to apps/backend/__init__.py
               sed -i.bak "s/__version__ = \"[^\"]*\"/__version__ = \"$VERSION\"/" apps/backend/__init__.py && rm -f apps/backend/__init__.py.bak
 
-              # Sync to README.md - shields.io version badge (text and URL)
+              # Sync to README.md - section-aware updates (stable vs beta)
               ESCAPED_VERSION=$(echo "$VERSION" | sed 's/-/--/g')
-              sed -i.bak -e "s/version-[0-9]*\.[0-9]*\.[0-9]*\(-\{1,2\}[a-z]*\.[0-9]*\)*-blue/version-$ESCAPED_VERSION-blue/g" -e "s|releases/tag/v[0-9.a-z-]*)|releases/tag/v$VERSION)|g" README.md
 
-              # Sync to README.md - download links with correct filenames and URLs
-              for SUFFIX in "win32-x64.exe" "darwin-arm64.dmg" "darwin-x64.dmg" "linux-x86_64.AppImage" "linux-amd64.deb"; do
-                sed -i.bak "s|Auto-Claude-[0-9.a-z-]*-${SUFFIX}](https://github.com/AndyMik90/Auto-Claude/releases/download/v[^/]*/Auto-Claude-[^)]*-${SUFFIX})|Auto-Claude-${VERSION}-${SUFFIX}](https://github.com/AndyMik90/Auto-Claude/releases/download/v${VERSION}/Auto-Claude-${VERSION}-${SUFFIX})|g" README.md
-              done
+              # Detect if this is a prerelease (contains - after base version)
+              if echo "$VERSION" | grep -q '-'; then
+                # PRERELEASE: Update only beta sections
+                echo "  Detected PRERELEASE version: $VERSION"
+
+                # Update beta version badge (orange)
+                sed -i.bak "s/beta-[0-9]*\.[0-9]*\.[0-9]*\(--[a-z]*\.[0-9]*\)*-orange/beta-$ESCAPED_VERSION-orange/g" README.md
+
+                # Update beta version badge link
+                sed -i.bak '/<!-- BETA_VERSION_BADGE -->/,/<!-- BETA_VERSION_BADGE_END -->/s|releases/tag/v[0-9.a-z-]*)|releases/tag/v'"$VERSION"')|g' README.md
+
+                # Update beta download links (within BETA_DOWNLOADS section only)
+                for SUFFIX in "win32-x64.exe" "darwin-arm64.dmg" "darwin-x64.dmg" "linux-x86_64.AppImage" "linux-amd64.deb" "linux-x86_64.flatpak"; do
+                  sed -i.bak '/<!-- BETA_DOWNLOADS -->/,/<!-- BETA_DOWNLOADS_END -->/{s|Auto-Claude-[0-9.a-z-]*-'"$SUFFIX"'](https://github.com/AndyMik90/Auto-Claude/releases/download/v[^/]*/Auto-Claude-[^)]*-'"$SUFFIX"')|Auto-Claude-'"$VERSION"'-'"$SUFFIX"'](https://github.com/AndyMik90/Auto-Claude/releases/download/v'"$VERSION"'/Auto-Claude-'"$VERSION"'-'"$SUFFIX"')|g}' README.md
+                done
+              else
+                # STABLE: Update stable sections and top badge
+                echo "  Detected STABLE version: $VERSION"
+
+                # Update top version badge (blue)
+                sed -i.bak '/<!-- TOP_VERSION_BADGE -->/,/<!-- TOP_VERSION_BADGE_END -->/s/version-[0-9]*\.[0-9]*\.[0-9]*\(--[a-z]*\.[0-9]*\)*-blue/version-'"$ESCAPED_VERSION"'-blue/g' README.md
+                sed -i.bak '/<!-- TOP_VERSION_BADGE -->/,/<!-- TOP_VERSION_BADGE_END -->/s|releases/tag/v[0-9.a-z-]*)|releases/tag/v'"$VERSION"')|g' README.md
+
+                # Update stable version badge (blue)
+                sed -i.bak '/<!-- STABLE_VERSION_BADGE -->/,/<!-- STABLE_VERSION_BADGE_END -->/s/stable-[0-9]*\.[0-9]*\.[0-9]*\(--[a-z]*\.[0-9]*\)*-blue/stable-'"$ESCAPED_VERSION"'-blue/g' README.md
+                sed -i.bak '/<!-- STABLE_VERSION_BADGE -->/,/<!-- STABLE_VERSION_BADGE_END -->/s|releases/tag/v[0-9.a-z-]*)|releases/tag/v'"$VERSION"')|g' README.md
+
+                # Update stable download links (within STABLE_DOWNLOADS section only)
+                for SUFFIX in "win32-x64.exe" "darwin-arm64.dmg" "darwin-x64.dmg" "linux-x86_64.AppImage" "linux-amd64.deb"; do
+                  sed -i.bak '/<!-- STABLE_DOWNLOADS -->/,/<!-- STABLE_DOWNLOADS_END -->/{s|Auto-Claude-[0-9.a-z-]*-'"$SUFFIX"'](https://github.com/AndyMik90/Auto-Claude/releases/download/v[^/]*/Auto-Claude-[^)]*-'"$SUFFIX"')|Auto-Claude-'"$VERSION"'-'"$SUFFIX"'](https://github.com/AndyMik90/Auto-Claude/releases/download/v'"$VERSION"'/Auto-Claude-'"$VERSION"'-'"$SUFFIX"')|g}' README.md
+                done
+              fi
               rm -f README.md.bak
 
               # Stage changes

diff --git a/apps/backend/__init__.py b/apps/backend/__init__.py
@@ -19,5 +19,5 @@
 See README.md for full documentation.
 """
 
-__version__ = "2.7.2-beta.10"
+__version__ = "2.7.2-beta.12"
 __author__ = "Auto Claude Team"
diff --git a/apps/backend/agents/session.py b/apps/backend/agents/session.py
@@ -21,6 +21,7 @@
     is_build_complete,
 )
 from recovery import RecoveryManager
+from security.tool_input_validator import get_safe_tool_input
 from task_logger import (
     LogEntryType,
     LogPhase,
@@ -386,41 +387,43 @@ async def run_agent_session(
                             )
                     elif block_type == "ToolUseBlock" and hasattr(block, "name"):
                         tool_name = block.name
-                        tool_input = None
+                        tool_input_display = None
                         tool_count += 1
 
+                        # Safely extract tool input (handles None, non-dict, etc.)
+                        inp = get_safe_tool_input(block)
+
                         # Extract meaningful tool input for display
-                        if hasattr(block, "input") and block.input:
-                            inp = block.input
-                            if isinstance(inp, dict):
-                                if "pattern" in inp:
-                                    tool_input = f"pattern: {inp['pattern']}"
-                                elif "file_path" in inp:
-                                    fp = inp["file_path"]
-                                    if len(fp) > 50:
-                                        fp = "..." + fp[-47:]
-                                    tool_input = fp
-                                elif "command" in inp:
-                                    cmd = inp["command"]
-                                    if len(cmd) > 50:
-                                        cmd = cmd[:47] + "..."
-                                    tool_input = cmd
-                                elif "path" in inp:
-                                    tool_input = inp["path"]
+                        if inp:
+                            if "pattern" in inp:
+                                tool_input_display = f"pattern: {inp['pattern']}"
+                            elif "file_path" in inp:
+                                fp = inp["file_path"]
+                                if len(fp) > 50:
+                                    fp = "..." + fp[-47:]
+                                tool_input_display = fp
+                            elif "command" in inp:
+                                cmd = inp["command"]
+                                if len(cmd) > 50:
+                                    cmd = cmd[:47] + "..."
+                                tool_input_display = cmd
+                            elif "path" in inp:
+                                tool_input_display = inp["path"]
 
                         debug(
                             "session",
                             f"Tool call #{tool_count}: {tool_name}",
-                            tool_input=tool_input,
-                            full_input=str(block.input)[:500]
-                            if hasattr(block, "input")
-                            else None,
+                            tool_input=tool_input_display,
+                            full_input=str(inp)[:500] if inp else None,
                         )
 
                         # Log tool start (handles printing too)
                         if task_logger:
                             task_logger.tool_start(
-                                tool_name, tool_input, phase, print_to_console=True
+                                tool_name,
+                                tool_input_display,
+                                phase,
+                                print_to_console=True,
                             )
                         else:
                             print(f"\n[Tool: {tool_name}]", flush=True)

diff --git a/apps/backend/agents/tools_pkg/models.py b/apps/backend/agents/tools_pkg/models.py
@@ -216,8 +216,9 @@ def is_electron_mcp_enabled() -> bool:
     # QA PHASES (Read + test + browser + Graphiti memory)
     # ═══════════════════════════════════════════════════════════════════════
     "qa_reviewer": {
-        # Read-only + Bash (for running tests) - reviewer should NOT edit code
-        "tools": BASE_READ_TOOLS + ["Bash"] + WEB_TOOLS,
+        # Read + Write/Edit (for QA reports and plan updates) + Bash (for tests)
+        # Note: Reviewer writes to spec directory only (qa_report.md, implementation_plan.json)
+        "tools": BASE_READ_TOOLS + BASE_WRITE_TOOLS + WEB_TOOLS,
         "mcp_servers": ["context7", "graphiti", "auto-claude", "browser"],
         "mcp_servers_optional": ["linear"],  # For updating issue status
         "auto_claude_tools": [