v0.4.5

Security

• escapeHtml extended to the full OWASP attribute-value set (&, <, >, ", ', /, backtick), closing escape gaps that surfaced with French apostrophes breaking the placeholder attribute.
• Gemini API key moved from the URL query string to the x-goog-api-key request header so the key no longer leaks into browser history, proxy logs, or Referer headers.
• Provider error responses sanitized before display: formatApiError() maps 401/429/5xx to friendly strings, strips HTML tags, and truncates unknown bodies to 300 chars — Cloudflare/proxy HTML interstitials no longer reach ui.notifications.error.
• API key setting hint strengthened to surface the direct-browser-access caveat. Users are now advised to use a provider-scoped, spend-limited key.

Fixed

• 60 s AbortController timeout added to all three LLM providers. Stuck requests now fail cleanly instead of leaving the UI in "Generating…" indefinitely.
• Anthropic max_tokens raised from 1024 to 4096. Long NPC responses no longer get truncated mid-JSON.
• applyRandomCharacteristics now returns a new object instead of mutating its argument.
• Weapon range enforced as a finite integer or null for melee — string units can no longer slip through.
• Single quotes added to escapeHtml; placeholder attribute switched to double quotes so French strings render correctly.

Changed

• Module compatibility bumped: FoundryVTT minimum v13, verified v14. CoC7 system minimum v8.

Full Changelog: v0.4.4...v0.4.5