- Add thread safety: _anthropic_history_lock and _send_lock in ai_client to prevent concurrent corruption
- Add _send_thread_lock in gui_2 for atomic check-and-start of send thread
- Add atexit fallback in session_logger to flush log files on abnormal exit
- Fix file descriptor leaks: use context managers for urlopen in mcp_client
- Cap unbounded tool output growth at 500KB per send() call (both Gemini and Anthropic)
- Harden path traversal: resolve(strict=True) with fallback in mcp_client allowlist checks
- Add SLOP_CREDENTIALS env var override for credentials.toml with helpful error message
- Fix Gemini token heuristic: use _CHARS_PER_TOKEN (3.5) instead of hardcoded // 4
- Add keyboard shortcuts: Ctrl+Enter to send, Ctrl+L to clear message input
- Add auto-save: flush project and config to disk every 60 seconds
