Real scanners
gstack’s /cso eval cells run the real scanners again
Paid /cso eval cells were quietly falling back to a static-only review, because the scanner launcher couldn't reach Docker inside Claude Code's sandbox. The launcher now runs outside it, and every other command stays sandboxed.
Time to finish
The agent gets five more minutes to write its report
Agents were killed at the exact budget, just before they could write their report. Now they get five extra minutes to finish it. Evidence after the deadline is still refused, so the measured budget doesn't change.
Spend kept
A failed cell still records what it spent
A cell that failed used to leave no receipt, so its spend showed up as zero. Now it writes a failed receipt with its tokens, estimated cost and turns. That holds for a failed check and for a timeout, and it never counts as a success.
Fixes
Three false failures are gone
.mcp.json left in the sealed sourceCHANGELOG.md · What this means for youfull detailsClaude no longer leaves an empty config file in the sealed source. The helper's own run names stop reading as phone numbers or wallet addresses. And every failure names the check that broke. Details are in the changelog.
