v6.0.1 — SkillSpector pending-path fix, CodeQL fixes, pinned launchers

ClawHub skill (SkillSpector, Excessive Agency): blackboard.py never resolves or follows pending-change paths. Containment is checked by path components (a sibling such as pendingchangesextra/ no longer passes), entries m

What's changed

Security

• ClawHub skill (SkillSpector, Excessive Agency): blackboard.py never resolves or follows pending-change paths. Containment is checked by path components (a sibling such as pending_changes_extra/ no longer passes), entries must be regular files, and every propose / validate / commit / abort / list opens pending files with O_NOFOLLOW.
• CodeQL: VsockRelay egress targets only the configured proxy origin (#193), tripwire scanning no longer runs a regex on manifest data (#194), the spool opens first and verifies the descriptor (#195), and a no-op loop condition was removed (#196).

Fixed

• Every launcher and run instruction pins network-ai@6.0.1 (.mcp.json, gemini-extension.json, server.json, .codex/config.toml, hook example, SKILL.md, CLI help, docs), as plugin marketplaces require. Docs that used npx network-ai-server fetched an unrelated package name.
• npm scripts no longer use npx; new npm run typecheck. Examples run the project's own tsc / ts-node without a shell; publish and Socket scripts pin their CLIs.
• npm run socket:check works on Windows again and reads the JSON score report.

Added

• test-skill-scripts.ts (Python skill scripts against real symlinks on Linux CI) and test-plugin-pins.ts (fails a release with an unpinned or stale launcher); both run in CI on every push.

Tests: 4,588 passing across 47 suites.

Full changelog: https://github.com/Jovancoding/Network-AI/blob/main/CHANGELOG.md