# 0.17.2 — 2026-07-19 — "CLI Hardening"

- **Added**: **CLI/daemon hardening pass** — daemon routes now use per-daemon `X-Kandown-Token` auth, remove wildcard CORS, cap request bodies at 10MB, and keep the daemon alive after recoverable fatal handlers.
- **Added**: **Safer persistence** — task, config, board, and daemon metadata writes now use atomic temp-file renames, with a daemon spawn lock to avoid duplicate startup races.
- **Fixed**: **CLI update policy** — update checks are skipped for daemon/shell/non-TTY flows, throttled for 24h, and handle prerelease semver comparisons safely.
- **Fixed**: **stdout/stderr contract** — machine-readable shell output stays clean on stdout while UI decorations and status logs go to stderr.
- **Fixed**: **Board/TUI resilience** — daemon startup, board scrolling, and move-target UX received stability fixes from the FABLE CLI pass.
- **Changed**: **Credits and package metadata** — license, package author, Settings links, and README credits now point to Vanessa Depraute, GitHub `vava-nessa`, and `vanessadepraute.dev`.