v0.18.6 — Migration, provider & sandbox hardening

Two adversarial reviews — of the migration/kanban/CLI and the providers/sandbox/scrape surfaces — found fifteen real bugs the tests missed, including a CRITICAL taint-laundering, an SSRF hole, and a provider-secret leak. All fixed and regression-tested. (Seventh review; 60 bugs across ten surfaces so far.)

Security

• CRITICAL — migration no longer launders foreign content as trusted. Imported memory was stored provenance="clean" and imported skills copied verbatim, so another agent's untrusted facts recalled as verified and a foreign provenance: clean skill was admitted active. Imported memory is now tainted and each imported SKILL.md is taint-stamped at the import boundary.
• SSRF guard on the scrape tools (scrape/extract/map/crawl/firecrawl): every fetch — and each redirect hop — is checked against private/loopback/link-local/reserved ranges (blocks 169.254.169.254 cloud metadata and internal services); only http/https allowed.
• The default LocalSandbox no longer inherits provider secrets — an injected echo $OPENROUTER_API_KEY could exfiltrate them; secret env vars are now scrubbed from the child env.
• Docker sandbox timeout now stops the container (--name + docker kill) instead of leaving it running on the daemon.
• Non-UTF-8 import files degrade instead of crashing; skill copies preserve symlinks instead of dereferencing host files.

Fixed

• LocalSandbox timeout kills the whole process tree (start_new_session + killpg).
• Completion cache: the key folds in the other response-affecting params (no collision); a hit reports 0 fresh tokens (honest, with the count under cache_read_tokens); a fallback answer is no longer cached under the primary's key; unique temp file.
• Fetch bodies capped at 10 MB (streamed); migrate --apply honors the configured memory backend + embedder; the kanban board is crash-safe (atomic save) and resilient (skips a malformed card).

Gate: ruff + mypy clean, 1403 passed / 3 skipped. pip install -U chimera-agent