* fix(process): report a deadline that elapses during final cleanup as a timeout
runOwnedCommand checked its absolute command deadline before awaiting
process cleanup, but on the ordinary successful path it consulted only
the caller's cancellation signal afterwards. A command whose deadline
expired while successful cleanup was still awaited therefore resolved
as success.
After cleanup, an elapsed deadline now throws OwnedCommandFailure with
reason "timeout" and the completed snapshot, as docs/tool-design.md
requires a final signal check after the last awaited finalization step.
Existing primary failures, caller cancellation and incomplete-cleanup
classification keep their precedence.
Fixes#7369
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(process): drive the cleanup-deadline regression with controlled time
The regression test gave output collection 100 ms of real time before
the deadline. On a busy worker the deadline could expire during
collection instead, taking a different failure path and failing the
test even with the fix. Use fake timers, wait until cleanup has
started, then advance past the deadline and release cleanup, so the
ordering no longer depends on worker speed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(adb): name unexecutable adb paths in readiness refusals
When REA_ADB_PATH or the PATH-resolved adb is a directory or a file the
host refuses to execute, the version probe fails at spawn with EACCES or
EPERM. That fell through to the generic "did not report a usable version"
refusal, which named neither the path nor the cause.
Classify those spawn errors as binary_not_executable (provider rejection
executable_missing), name the selected path and errno, and give
remediation for the environment, PATH and host-policy cases. The generic
fallback now names the selected path too.
Fixes#5689
* fix(process): admit synchronous spawn errors as captured failures
Node throws spawn errors other than EACCES, EAGAIN, EMFILE, ENFILE and
ENOENT synchronously from execFile. execFileBytes called execFile inside
its Promise executor, so ENOTDIR or EPERM became a rejection without
capture fields and execFileOutputFailure returned undefined. Consumers
that classify by failure code, such as the adb version probe, could not
see the code, which left the adb EPERM branch unreachable.
Catch synchronous spawn errno errors at the capture boundary and attach
the same empty capture an asynchronous spawn failure carries. Argument
validation errors stay unadmitted.
The adb version probe now reports an ENOTDIR selected path, such as a
REA_ADB_PATH whose parent is a regular file, as a missing binary with
the filesystem error code instead of the generic version refusal.
* fix(process): expose spawn failures from the capture owner
execFileBytes knows when a command never started, but
ExecFileOutputFailure did not say so, so consumers reread raw syscall
and code fields and disagreed. Mark both the synchronous throw and an
asynchronous `spawn <path>` error with `spawnFailed: true`, and set
`path` on the synchronous error to match the asynchronous shape.
Argument validation errors stay unadmitted.
Consumers now use the owner field:
- inspectAdbClient never reports a spawn errno as `exit_code`. ENOENT,
ENOTDIR, ELOOP and ENAMETOOLONG are `binary_missing`; EACCES and EPERM
stay `binary_not_executable`; any other spawn errno, such as EINVAL,
is `binary_not_executable` with a path-naming "could not be started"
message. Each records `filesystem_error` and `path_source`. EACCES
remediation also names parent directory search permission, and EPERM
remediation no longer names host policy as the only cause.
- DarwinProcessRunTokenReader tags every not-started compiler as
`spawn_failed`, not only ENOENT. EACCES, EPERM and ENOTDIR were
previously `failed`.
- NativeDmgArtifactReader uses one not-started rule for both
`processNotStarted` (previously `spawn ` only, so synchronous errors
were missed) and the ENOENT unavailable/io split (previously any
`spawn` prefix). Its fake hosts now reject with real execFileOutput
spawn failures.
* fix(process): classify spawn failures consistently across consumers
Admit synchronous and asynchronous spawn errnos through one helper that
requires an errno and a `spawn` or `spawn <path>` syscall. The
synchronous shape now also gains `spawnargs`, so both shapes match.
Use the owner's `spawnFailed` fact in the remaining consumers:
- inspectAdbClient reports exhausted host capacity (EAGAIN, EMFILE,
ENFILE, ENOMEM) as a host failure to retry and no longer tells the
caller to change REA_ADB_PATH. Path-resolution errnos come from a
predicate the filesystem owner exports.
- runAdbCapture says adb could not be started instead of claiming an
exit code for a process that never ran.
- The Darwin compiler probe words every spawn_failed outcome as a start
failure, not a compilation failure.
- Asset catalog inspection treats any assetutil that never started as
unavailable, not only ENOENT.
* fix(process): report host spawn capacity as a retryable constraint
Spawn errnos that report exhausted host capacity (EAGAIN, EMFILE, ENFILE,
ENOMEM) were classified by adb readiness alone. assetutil reported them as
an unavailable tool, which marked inspect_asset_catalog unavailable in the
session, and adb commands reported them as protocol failures.
Classify them once in the process capture owner and report a retryable
capacity constraint with recovery advice from assetutil and adb commands.
* docs(adb): describe host capacity failures from device operations
* fix(adb): report exhausted host spawn capacity as runtime unavailability
A host that cannot start adb for lack of process, memory or descriptor
capacity is not a configuration problem. Give it its own failure code and
map it to the runtime_unavailable provider rejection instead of
not_configured.
* fix(adb): report probe-time host capacity as a retryable constraint
A device operation whose adb version probe could not start for lack of host
capacity was refused as capability_unavailable without retryable. It now
reports the same retryable capacity constraint as a later adb command.
* fix(adb): keep the selected adb path in probe-time capacity errors
The retryable capacity constraint raised at the version probe dropped the
selected_binary and path_source diagnostics the refusal used to carry.
* refactor(adb): keep the spawn-failure fact to adb consumers
Restore the DMG reader, Darwin compiler probe and assetutil to main. The
capture owner still marks a never-started command, including the spawn
errors Node throws synchronously, and only the adb readiness probe and
adb commands read that fact.
* test(adb): assert spawn-failure facts instead of refusal wording
The new adb tests compared complete refusal sentences and banned an old
phrase. They now check the errno, selected path, path source and the
owner's spawn-failure marker, so wording edits do not break them.
* fix(adb): own one host-capacity remediation and cover the spawn route
The host-capacity constraint and the configuration failure each carried their own remediation sentence. AdbConfiguration now owns the text and both use it, so the constraint's remediation.action equals diagnostics.remediation.
The synchronous spawn-throw test now runs on Node's execFile route and on the owned spawn route adb uses (stopSignal). The provider test covers inspect_adb_client under EMFILE next to list_adb_devices, and the docs say which operations report the retryable capacity constraint and which report runtime_unavailable.
* fix(process): report EMFILE and ENFILE spawn failures without stdio
After an EMFILE or ENFILE spawn failure Node creates no stdio, so the
owned stop-signal route threw a TypeError while reading the streams and
the later spawn error went unhandled. Attach the error listener first and
capture absent streams as empty, so adb reports retryable host capacity.
* fix(adb): keep a completed push when host capacity stops its digest check
A capacity failure starting sha256sum came back as a retryable error even
though adb push had already written the file. Repeating the request with
overwrite=false is then refused because the destination exists.
Return the receipt with an unavailable device digest and name the capacity
failure in its limitations, so the caller is told the transfer is unverified
rather than advised to retry.
* docs(adb): list host capacity as an unverified push case
---------
Co-authored-by: t <t@t>
* feat(desktop): capture a Linux desktop application in use
Add `capture-desktop-application`, a CLI-only, Linux and X11 capture that
launches an installed desktop application, watches it while it is used and
writes capture Evidence plus SHA-256 addressed content:
- inventory: desktop entry, launch command, executable, package and its
apt sources (or snap, flatpak, AppImage), Electron markers and candidate
state directories;
- session: the launched process tree, client windows from xprop with the
first application window time and a window match, and files held open;
- state: a stat walk of the home directory before launch, at checkpoints
read from stdin, at stop and after exit, with created, modified, deleted
and retyped paths and the content of changed files and state directories.
It refuses non-Linux hosts, missing DISPLAY or xprop, a non-empty output
folder and an application whose window is already open, and signals only
processes it started.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): own launched processes, confirm walk coverage and keep cancelled captures
- Launch through the owned provider path with a run token; release with
SIGTERM, then the token-verified group cleanup, after every session.
Processes without the token are never signalled; each records whether it
carries it, and the session records whether cleanup was verified.
- Report creations and deletions only where a walk listed the nearest
existing directory; count the rest as unconfirmed.
- Retain a file only when it is still the walked version, through owned
no-follow reads; charge the budget only for new content; create files
exclusively in a private output folder owned by the caller.
- Walk content roots outside the home directory, compare paths in their
physical spelling, and run executables from the caller's directory.
- Refuse when the window list cannot be read, re-evaluate window ownership
each sample, handle one queued request per sample with a bounded stdin
queue, and write the capture with end reason `cancelled` on interruption.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep owned cleanup failures and fresh digests
- Allow a capture cancelled before any requested checkpoint to hold only the
baseline.
- Retry an incomplete stop once; if cleanup is still unverified, write the
capture and fail with the run token and process group as cleanup
resources.
- Classify path changes after a walk (ENOTDIR and other selected-file
errors) as changed_since_walk instead of failing the capture.
- Treat a non-directory ancestor as proof that nothing existed beneath it.
- Report a before digest only for the file version it was read from.
- Derive stderr_truncated from stderr's own byte counts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* wip(desktop): state view over a capture folder
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep failed file-handle closes owned for retry
Content reads pass retainFailedClose, so a handle whose close fails stays
owned by the content store; the capture retries those closes after it is
written and fails with the output folder as the cleanup resource if one
still cannot be closed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(desktop): read a captured application's state
Add inspect-desktop-application-state, a CLI command that reads a capture
folder into the application's state: every retained or changed file with
its role and reasons, a typed JSON view of each version (SQLite through the
shared worker, dconf through a private dconf dump, JSON, XML, key files,
text) and the kinds of change between versions (lines, values, keys, rows).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): report process and handle cleanup failures together
When both the launched processes and a retained file's handle remain
unresolved after the capture is written, one cleanup error now lists both
reasons and both resource sets.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(desktop): export a captured application as an agentenv computer app
Add export-desktop-application, which writes an agentenv bundle with one
computer_app environment from a capture folder and its state view: the
apt package, a boot launch matched on the captured window class with a
window ready check, owned paths from the state roles, a seed of the
baseline files, data hooks that call agentenv's add/get/reset helpers
with a typed JSON view on get, a skill, a README and a deploy smoke task.
The desktop CLI commands now load their services lazily.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep state views faithful to the capture
- Read key files, XML attributes, dconf groups and SQLite tables into
dictionaries without inherited properties, so captured keys such as
__proto__ stay data.
- Version databases with their write-ahead log as of each checkpoint, and
stage only digest-verified bytes for the SQLite and dconf readers.
- Detect the format per version, report format changes, keep JSON null and
empty containers as values, keep XML text and preserved whitespace, and
mark truncated views (including XML depth) and comparisons of them.
- Number versions and changes by checkpoint index, decide baseline
presence from the captured type, and keep tagged SQLite integers, text
bytes and blobs distinct.
- Carry the capture's limitations and omitted content forward, match state
directories by their home path, index changes once per capture, keep
failed handle closes owned, and finish the CLI through the shared owner.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep coverage, logs and handles honest in the state view
- Read coverage flags only from formats whose readers write them, so JSON
fields named truncated stay data.
- Fail a SQLite version whose write-ahead log existed but was not retained
or does not match its digest, instead of reading the database alone.
- Close retained content on every exit, including cancellation, and report
a close that still fails together with the primary failure.
- Finish the CLI with the canonical operation name.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): export only what the computer can install and seed
- Refuse packages not from the Ubuntu 24.04 archive, since the computer
installs by name from that archive.
- Start the launch command in the captured working directory.
- Respell the home path only in files the state view read as text.
- Report files that were not retained instead of dropping them silently.
- Load captured dconf keys for apps that own no files.
- Keep home-level files as owned paths; rename reserved Python class names.
- Mark truncated SQLite and text views in the class's get view, and read
file types the way the state view does.
- Release the output tree through a resource scope, and read seeds through
an owner closed on every exit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep staged folders owned, symlinked state roots and XML values
- Stage database bytes in a private runtime root released through a
resource scope, so a failed removal keeps its owner and is reported with
the read's outcome.
- Report cleanup facts and owners from desktop failures instead of
wrapping them as a plain adapter error.
- Record the state directories as walked, in their physical spelling, and
match roles against both spellings, so files in a symlinked state
directory are not mistaken for selected documents.
- Keep whitespace-only XML leaf values; drop only formatting between
elements.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): read XML in the exported app the way the state view does
Keep whitespace-only leaf values and xml:space="preserve" text in the
generated get view; drop only formatting between elements.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): release retained handles with their owners, read older captures
- Release retained-content handles whose close failed through a resource
scope on every exit; a release that fails again reports the exact handle
owners. A read that finished keeps its bytes when only its close failed.
- Accept captures written before state directories were recorded, and say
in the state view's limitations that symlinked state directories may be
misclassed for them.
- Compute each XML element's whitespace context once instead of scanning
siblings for every text run.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): boot without the working folder, bound XML, accept mirrors
- Try the captured working directory only when an argument is relative,
and start the app even when that folder is missing.
- Cut the generated XML view at REA's node and depth limits, and keep one
unreadable file from failing data/get.
- Accept Ubuntu 24.04 mirrors, not only the canonical hosts; PPAs and
other repositories are still refused.
- Read seeds through the retained-content owner's new signature.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): state view review round
- Stage a retained -journal beside its database so the SQLite worker
accepts an inactive journal and refuses a hot one; a -wal or -journal
that existed but was not retained (including one omitted at the
baseline) makes the version unreadable.
- Keep tables that read when another fails, and let cancellation and
unfinished cleanup propagate instead of becoming view errors.
- Read text as a key file only when every line parses as one.
- Rank a file named in a window title or selected by the caller as a
document even when the application holds it open; match titles on
file-name boundaries; leave the display name out of dconf matching.
- Bound JSON and key file views (4 MiB, 500 levels, exact numbers) and
report too-large, missing and altered retained content separately.
- Add no version or change while a database stays absent.
- Read staged databases in place instead of copying them again.
- Give Evidence the same limitations as the result.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): export review round
- Load captured dconf keys without D-Bus: install dconf-cli, compile the
existing and captured key files into the user database, and warn on
failure instead of stopping the server.
- Start relative-argument launches in the captured working directory,
the home included, since the framework launches from the app folder;
respell the home itself and option values under it.
- Read views in a thread, skip files over 64 MiB, align the generated
readers with the state view's, and close SQLite connections.
- Never own the home or a shared base folder; map a symlinked state
directory's files back to their home spelling.
- Report omitted files and unretained opened folders.
- Name the module so it cannot shadow another, and keep the class off
the module's own names; derive names the bundle check accepts.
- Write seeds as they are read, and remove an unpublished bundle on
failure.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): capture review round
- Ask the launch process group and token carriers to exit before
killing them, on errors too; report incomplete cleanup with its facts.
- Count descendants of the launch as started by the capture even when
their environment cannot be read; treat a reused pid as a new process.
- Follow symlinked desktop entries; name a flatpak's state after its
application id; match flatpak windows by name only.
- Stop on end of input; refuse empty, duplicate and reserved checkpoint
names; require whitespace after the checkpoint keyword.
- Stay on each walk root's device, and never walk or retain `/` or a
directory containing the home; say so in the limitations.
- Refuse a window manager that does not publish _NET_CLIENT_LIST.
- Remove retained content when a capture fails before it is written.
- Skip reading a file larger than the remaining content budget.
- Record apt's archive origin for each package source.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): read an unset client list as no windows when supported
xfwm4 leaves _NET_CLIENT_LIST unset while it manages no windows, so the
capture refused an ordinary desktop with nothing open. Read
_NET_SUPPORTED with the list: an unset list means no windows when the
window manager supports it, and the capture is refused only when it
does not. `xprop`'s "no such atom" output now reads as unset too.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): accept packages by apt's archive origin
Accept a package source when apt reports its origin as Ubuntu for a
noble suite, so mirrors count and PPAs or other repositories that merely
have "ubuntu" in their URL do not. Captures made before origins were
recorded fall back to Canonical's own archive hosts. Seed reads report
why retained content could not be used.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(desktop): capture and export apps from vendor apt repositories
A closed-source app installed from its vendor's apt repository, such as
Typora, can now be captured and exported as a computer app.
- The capture records each non-Ubuntu repository listing the installed
version (uri, suite, components from apt's sources files, one-line or
deb822) and the key that signs it: the signed-by key, or the trusted
key that gpgv shows verifies the repository's signed index. The key
is retained with the capture.
- The capture records the packages owning the libraries the executable
loads (DT_NEEDED with RUNPATH and the linker cache, through REA's ELF
readers), since a vendor package may not depend on them.
- The export declares a verified vendor repository as an AptSource with
its key, installs a vendor package's library packages, and adds
--no-sandbox to an Electron app's launch, since a container denies
Chromium's sandbox.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): report a locked database at once in data/get
A database the running app holds locked made each data/get wait sqlite's
five-second busy timeout before reporting it. Record the Typora run in an
agentenv computer in the verification.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf(desktop): detect key files without splitting the whole text
Read lines one at a time and stop at the first that a key file view
would drop, instead of splitting a file of up to 64 MiB into arrays
before its format is known.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep symlinked homes and state folders under the home in exports
- Respell a path under its state folder's logical spelling only when that
spelling is under the captured home, so a symlinked HOME keeps its
files; pair walked and logical state folders only when the capture
lists the same number, and match the innermost folder first.
- When two files map to one home path, keep the one present before the
capture and name the other in the limitations.
- Read key files in the generated data/get with the state view's rule,
checked against it by running the helper under python3.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): end captures on zombies and keep cleanup owners
- A zombie or dead process no longer keeps the session open.
- Remove only the partial capture file this run created.
- Keep the exact owners of handles and processes whose cleanup failed on
the returned error, so a retry can release them; test the published
capture's cleanup-failure branch with mixed outcomes and retries.
- Release the application once even when the exit checkpoint fails.
- A cancellation before the capture is written removes what it retained.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): vendor package review round
- Match apt sources through `apt-get indextargets`, which covers flat `./`
and `/` suites and gives each release file and sources entry.
- Accept a key whose signature verifies even when the release carries
another signature without a key here; keep only the verifying key from
a keyring holding several (OpenPGP packet splitter).
- Install the package from its repository's release (`name/<release>`),
declare one source per URI and suite, support only the capture host's
architecture, and refuse Ubuntu Pro repositories.
- List only library packages the computer can install; walk libraries only
for vendor installs, with RPATH inherited as ld.so does, normalized
paths, and DT_NEEDED bounded while reading.
- Put --no-sandbox after the program an env wrapper launches; keep the
gpgv folder's owner when its removal fails; respect --max-file-bytes for
keys; wait 0.25 s on a busy SQLite database in data/get.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(desktop): keep the vendor spec's gpgv command on one line
A code span broken across lines left `<binary keyring>` for VitePress to
read as an unclosed HTML tag, so the docs build failed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(desktop): add a validated task to exported desktop applications
Each capture can now yield one agentenv task in its exported bundle. An
agent writes the task (a prompt plus declarative checks over the app's
data/get views); REA validates it and stays model-free.
- `describe-desktop-application-task` summarises a capture's net change
per file (role, format, views before and after) and drafts checks.
- Checks: file presence, lines present/absent/counted, JSON-pointer values,
SQLite rows and counts. REA keeps a task only if a check fails on the
seed and every check passes on the captured end state; a file that was
not retained at the baseline counts as absent, as the computer starts.
- `export-desktop-application --task` writes tasks/NAME.json (deploy,
agent, skills, recording, prompt, verifier), a compiled verify.py that
reads data/get, and an eval. A boundary test runs the verifier under
python3 and checks it agrees with REA's evaluator on every check kind.
- Docs, spec and skill guidance, with the solve-rate recipe.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(desktop): keep the seed test in its own block
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(desktop): record the task verifier driven in an agentenv computer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(desktop): record the Typora task run in an agentenv computer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep task checks bounded, complete and attributable
- line_count counts lines holding a substring (contains) instead of
matching a regular expression, which could stall the verifier on
agent-written text and read differently in Python.
- value_equals of a whole object or array is undecided on a truncated
view.
- The draft keeps a database whose rows changed under an unchanged hash,
and a file whose truncated views match while it changed.
- A task file that cannot be read keeps the reader's detail, and a failed
cleanup keeps the read failure as its primary.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): leave a file with one version out of the task draft
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(desktop): update the task verification's test counts
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(desktop): record the task solve rate with Claude Code and Sonnet 5.5
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(desktop): capture and export apps installed from a downloaded .deb
capture-desktop-application --package-file reads the file's control fields
with dpkg-deb and records its SHA-256, size and dependencies when it holds the
installed package; the file itself is never kept. The library walk now also
runs for local installs.
export-desktop-application --package-url declares agentenv's
Download(url, sha256) for that file, its dependencies and library packages as
apt packages, and a run script that installs it with dpkg.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): seed app-named dotfiles and respell UTF-16 seeds
The capture now treats dotfiles in the home named after the application
(.varicad-cfg.ini, .notesrc) as state roots, so a file the app only reads
during the capture is still seeded. The exported seeding respells the
captured home in UTF-16 text files with a byte-order mark, keeping the mark.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): hold readiness until the app's own window shows
An exported app is ready only once a window of its class that the taskbar
lists is shown, so a splash screen of the class, which skips the taskbar, no
longer counts as the app being up.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(desktop): record VariCAD captured, exported and run in an agentenv computer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep exported views strict JSON for infinite and inexact numbers
The exported data/get spells infinite and negative-zero SQLite reals as REA's
SQLite reader does ("Infinity", "-Infinity", "-0"), and refuses a JSON file
holding a number that reading would change (1e999, integers past 2^53, -0,
rounded fractions) with the state view's own error, instead of a view with
an infinity in it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep package-file facts tied to one file and URLs unechoed
- A --package-url refusal never repeats the URL, and credentials are checked
before the scheme.
- The package file's identity must hold between dpkg-deb's read and the hash.
- A failed close keeps its cleanup owner even when the capture is cancelled.
- Readiness also ignores windows typed as splash screens.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): record database logs and keep state changes distinct
- A selected path that is not a directory brings its -wal and -journal as
content roots, so the capture records whether they exist and retains them.
- The state view treats a file as absent only under recorded content roots
and refuses a database whose log presence is unknown.
- JSON changes list containers too, so an array that becomes an object with
the same members is a change.
- Key file entries escape the key as a JSON pointer segment, so [a/b] c and
[a] b/c stay apart.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep watching through unread samples and late workers
- An unreadable window list is unknown, not zero windows, and is named in
the limitations.
- Before ending the session, live run-token carriers no parent link reached
are tracked; an unreadable process table leaves the exit unknown.
- An env prefix's assignments find the program and name its XDG folders.
- flatpak run options that take a value are skipped with it, -- is honoured
and a /arch/branch suffix is dropped from the id.
- State directories include the entry's full id.
- Path options refuse empty values; roots count toward the entry limit.
- A capture file whose close failed stays owned and is retried on discard.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): bound apt sources, keep older captures and cleanup owners
- Sources files parse into one stanza per line or deb822 paragraph with its
URIs and suites kept as lists, so no URI x suite product is built.
- Repository architectures and release are optional, so captures written
before they were recorded parse; the export treats them as unrestricted
and unknown.
- Library sources are matched against every index of a declared
repository's URI, suite and components.
- Two failures side by side keep both causes and both cleanup owners, and a
host file whose close fails reports a lease on its handle.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): match escaped key file entries and suggest containers through members
- The draft's key file lookup uses the state view's escaped `group/key`, so a
key holding `/` or `~` still gets its suggestion.
- JSON and XML changes now list containers too; the draft suggests an added
or removed container through its listed members, and a container only
when none of its members is listed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): read relative PATH entries from the launch folder
A program, or an empty or relative PATH entry, is resolved from the folder the
program starts in, as the launch does, so `env PATH=. app` with the entry's
Path still finds the app.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf(desktop): compare JSON views on one shared path
JSON and XML changes are found by walking both trees with one shared pointer
path, building a pointer only for a listed value, so memory follows depth
rather than every container's full path. A pointer over 4096 characters is
counted but not listed. A 256-level document with 4000-character keys went
from about 251 MiB of heap to under 1 MiB.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep JSON Lines as text in the exported reader
The exported reader parses the whole text before an inexact number makes it
JSON with an error, so JSON Lines with an integer above 2^53 stay text as in
REA. Over-long integer spellings are unsafe without converting them. The
guide no longer claims large integers keep their value.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep the state-path help free of dash-led words
The CLI alias check reads `-wal` and `-journal` in help text as short flags,
so the help names the write-ahead log and rollback journal instead.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): never record or export apt source credentials
- Source URIs lose any user name and password as they are parsed, the way apt
splits them, and so do index-target URIs and descriptions and the sources
apt-cache policy lists, so matching works whether or not apt prints them.
- A repository whose entry held credentials is marked
`uri_credentials_removed`, and the export refuses it, or an older capture
whose URI still holds them, with a reason that names no URL.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): look programs up without normalizing their paths
Program paths and PATH entries are joined rather than resolved, so `..` after
a symbolic link means what it means to the launch. The lookup moves to its own
module.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): note inexact JSON numbers with a flag, not a list
The exported reader only needs to know whether any number was inexact, so it
keeps a boolean instead of every rejected spelling.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): refuse older captures that still hold apt credentials
A capture written before credentials were removed counted the credentialed
repository's libraries as installable, so the export refuses it whole and asks
for a new capture rather than declaring packages no source offers. Recorded
policy sources are redacted in export messages too.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(desktop): keep the credential fixture on an example host
A login on a real host reads as a secret to the commit scanner, so the older
capture's fixture uses apt.example.com like the other credential tests.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): tidy looked-up paths and search relative entries only for env
Empty and `.` segments are dropped from a looked-up program path, which keeps
`/snap/bin/` entries recognisable as snaps, while `..` is still left for the
kernel. Relative and empty PATH entries are searched only in the PATH an `env`
prefix sets, which travels with the exported launch; the host's own PATH does
not.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep excluded and unwalked database logs unknown
The capture records the paths every walk left out, and the state view treats
a log as absent only under content roots the baseline walked completely and
outside those exclusions, so an excluded or unvisited log leaves the database
unread rather than read without it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): judge JSON numbers after duplicate keys settle
The exported reader marks an inexact number instead of flagging it during the
parse, then looks for marks in the parsed value, so a number a later duplicate
key overwrote no longer refuses the file, as in REA.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): redact a repository's policy source when it names it
An older capture whose policy source matched no sources entry kept that text
whole, and the export named the repository by it; the export now names it
without any user name or password.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): never signal the launch group on unknown membership
When the current read cannot observe a carrier's process group, the carrier
is signalled on its own instead of letting an older process-table row grant
a group-wide SIGTERM.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): look programs up in the launch's order and refuse host-relative finds
The lookup searches PATH as the launch does, an empty entry meaning the
launch folder, so inspection and launch name the same program. A program found
only through a relative or empty entry of the host's own PATH is refused,
since the exported computer would not have it; an env prefix's PATH travels
with the command.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): count unchecked paths and keep logs behind them unknown
Each walk counts the paths it could not stat and the directories on another
device it did not enter, and the checkpoint records it as `unchecked_paths`.
The state view treats a log as absent only when the baseline left nothing
unchecked, so a log whose stat failed stays unknown.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf(desktop): scan parsed JSON with one iterator per level
The check for marked numbers walks the parsed value with an iterator per
nesting level instead of copying each container's children; a million-entry
array went from about 15.7 MiB to 8.1 MiB of peak traced memory.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): start a relative program from its captured folder
An exported launch whose program path is relative, such as `./app` from an
entry's Path, now changes to the captured working directory first, as it
already did for relative arguments.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(debugger): let REA exit when a debugger could not be stopped
`rea debug-with-gdb` and `rea debug-with-rizin` printed cleanup_incomplete
and set exit status 1, but the retained child and its pipes kept the event
loop alive, so the process never exited. A stdio MCP server whose client
disconnected hung the same way.
closeOwnedDebuggerSessions is the owner both managers finish through. It now
unreferences retained sessions, as supervised providers already do after
incomplete cleanup, restores the references on retry, and names the retained
process IDs. The one-shot commands report those IDs, since no later command
can retry. Debugger ownership, signals and detach behavior are unchanged.
GDB cleanup requests also no longer hold the host until their 120 s command
deadline, because cleanup already bounds its own wait.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(debugger): name retained debuggers when an MCP server shuts down
An MCP server that exits with a retained debugger logged only "REA provider
cleanup failed" and "could not close cleanly", so nothing named the process
left for the caller to check. The PIDs were on OwnedDebuggerCleanupError, but
each shutdown reporter read only the outer aggregate's message, and the debug
failure_cause description dropped the field too.
The failure type now lives in its own dependency-free module with one reader
that walks composed failures. The shutdown report, the server's onclose log,
the debug description and the one-shot CLI all use it, and the shutdown report
writes the same remediation the CLI returns.
The fake debuggers now model each request exactly, with real reply shapes, and
a request they do not model fails the test.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(debugger): compare retained-debugger guidance with its formatter
The new checks froze the wording "Check process ... and its target".
docs/testing.md asks guidance checks to compare with the owning formatter,
alongside independent checks of the facts. They now do, and each still proves
the process ID is named, because a formatter comparison alone would pass if the
formatter dropped it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(process): re-read unreadable tokens before signaling and name the process
Darwin KERN_PROCARGS2 samples a process's argument length and stack top
before it reads the address space, and exec publishes the new length
before it copies the new strings out (xnu sysctl_procargsx,
exec_copyout_strings). A read during exec can return a zero-filled or
stale strings area, and exec keeps the PID and start time that bracket
the read. The final sweep already re-read such tokens, but the
pre-signal group check read each member's token once, so one transient
read of a live group member failed the whole cleanup.
Move the bounded re-read into one shared fact-reading helper and use it
for both the sweep and the pre-signal group check. The group check binds
re-reads to the generation it first observed, so a reused PID stays
unresolved; the sweep keeps classifying the PID's current process.
An unreadable-token failure now carries the native identity read after
the token and the summary names the candidate by its native name,
parent, group and start identity. The Darwin helper and Linux procfs
reader report the short native process name (p_comm/comm) for display.
Fixes#8337
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(process): refresh other pre-signal members after token re-read waits
The pre-signal group check re-read only members whose token was
unavailable, so a readable member kept the relation it had before the
retry waits. A member that moved to another process group during those
waits could be validated on its old group, and the old group signaled
while the moved member kept running.
After any retry wait, the shared re-read helper now reads every other
live pre-signal fact once more with the same generation binding. A moved
member then takes the existing changed-group path, which retains its
ownership evidence and fails cleanup. An inconclusive refresh replaces
the stale fact so it fails closed. Nothing changes when no re-read ran,
and the sweep keeps classifying current processes because every group
it finds is revalidated before signaling.
Also cover PID reuse that happens before the re-read starts, where both
re-read identities agree and only the first-read generation rejects the
replacement's token.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(process): keep known identity changes final across token re-reads
The pre-signal re-read treated a first read without a same-generation
identity as unbound and replaced it with the re-read. On Linux the first
read can already establish PID reuse (an ESRCH token whose exit check sees
another generation); the re-read then classified the replacement, so a
zombie replacement could let cleanup succeed.
A pre-signal check now re-reads only same-generation facts. Changed,
exited, exiting and foreign-token facts are final. Each attempt also
re-reads the group's owned members instead of one separate refresh after
the loop, so a member that moves groups or turns unreadable while another
waits is seen within the same bound. The caller's run token selects the
owned members, and the sweep keeps classifying current processes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(cli): describe one-shot timeouts for an invocation whose session has ended
A one-shot CLI analysis that reached a provider deadline told its caller
that the Ghidra session remained usable and reported a runtime-editable
limit applying to the next operation, although the command had already
released its provider session and runtime.
The shared error projection now takes an explicit caller lifetime.
Providers keep guidance that holds only for a continuing caller (session
reuse, same-session runtime updates) apart from the request outcome, and
the presentation adds it only for a continuing caller. One-shot owners
(runDirectAnalysis, runProviderAnalysis, finishAnalysisCommand and the
JavaScript application command) project for the invocation: details.limit
reports scope rea-invocation, applies_at next_invocation and the launch
environment seed, and the remediation leads with that setting for a new
invocation. MCP output keeps its runtime-update and same-session guidance.
Covers the Ghidra decompile timeout, decompiler failure, regex stack
exhaustion and startup timeout, the shared regex deadline, the Kuna
decompile timeout and the Hopper startup timeout.
Fixes#8311
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(cli): project composed child failures for the caller lifetime
Cleanup composition embedded its primary and cleanup failures as
continuing-caller projections, and baked the primary's message and the
cleanup's remediation into the composed error. A one-shot command whose
Ghidra startup timed out while shutdown also failed therefore still
reported a rea-runtime limit and update_analysis_settings in
details.diagnostics.primary_error.
childFailureDiagnostics now snapshots each embedded child at composition
for both lifetimes when its projection depends on the caller, so cleanup
history keeps its composition-time state and the final projection selects
the caller's form. composedCallerGuidance re-attributes message and
remediation with their continuing-only parts kept separate. Error copies
and redaction keep the invocation diagnostics. The Hopper startup timeout
now carries its continuing guidance on the error like the other producers.
Invocation limits keep agent_editable and rea_restart_required, with
values that hold for a new invocation, so only scope and applies_at
change and environment is added.
In existing-project mode a decompile timeout or a cancelled session now
says the next session copies and opens REA_GHIDRA_PROJECT_PATH again
rather than repeating import and analysis.
Tests compare delivered guidance with the owning formatters and constants
instead of freezing prose.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Scheduled deep static checks on main fail knip because the
DarwinHelperCache type alias added in #8318 has no consumer. Remove
the alias; callers already use createDarwinHelperCache's inferred
return type.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* perf(process): reuse a verified Darwin ownership helper across processes
Every REA process on macOS compiled the Swift ownership helper into a fresh
temporary root and then paid macOS's first-launch assessment of that new
executable: 408 ms + 325 ms of a 1.4 s `rea inspect-macho /bin/ls`.
With the default xcrun compiler and module cache, the reader now keeps one
content-addressed copy under ~/Library/Caches/rea/process-helper/<key>/.
The key covers the helper sources, toolchain selection, architecture and
Darwin release. A copy is executed only after the cache root, entry and
files are verified as current-user owned, not group- or world-writable,
not links, and digest-matched to the entry manifest. Malformed entries
owned by the user are removed and rebuilt; linked or foreign entries are
left untouched and the per-process compile runs as before. Any cache
failure falls back to that compile, so the cache never fails an ownership
operation.
A miss compiles exactly as before, then publishes a copy through an atomic
rename, keeping the first concurrent publisher, and runs the shared copy.
That way its first-launch assessment is paid once. Per-run roots keep their
existing cleanup; published entries are never removed by close or exit.
An explicit REA_DARWIN_SWIFTC_PATH or REA_DARWIN_MODULE_CACHE_PATH keeps the
per-process compile and writes nothing to the cache. `rea uninstall
--purge-data` removes the namespace.
Fixes#2483
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(process): harden the shared Darwin helper cache
Address review findings on the shared ownership-helper cache:
- Verify every real parent of the cache root: each must belong to the user
or root and not be writable by others (sticky root-owned directories
excepted), so no other user can rename a verified entry. Execute through
the real path.
- Open manifest and helper through the owned non-blocking regular-file
reader, so a FIFO cannot block preparation, and retain handles whose close
fails.
- Key entries on the swiftc and SDK that xcrun itself resolves, including
their real paths, sizes and modification times. DEVELOPER_DIR, TOOLCHAINS,
xcode-select and in-place updates therefore select new entries.
- Never remove or replace an invalid or published entry. Removal could race
another process that has verified or is running that path, so such an
entry falls back to the per-process compile.
- Give the cache a close() that retries retained staging removals and
handle closes and reports ProviderCleanupError while any remain. The
reader closes it with its per-run root.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(process): keep cache lookups owned and fall back from unlaunchable helpers
Address the second round of review on the shared ownership-helper cache:
- Pass the preparation signal to both xcrun toolchain lookups, and wait for
every started lookup before reporting the first failure. Cancellation and
close then stop a stalled lookup instead of waiting out its deadline.
A failed or cancelled key computation is retried by the next lookup.
- When the verified shared copy cannot launch (EACCES, EPERM, ENOEXEC,
ENOENT or an unrequested SIGKILL, for example from a noexec home volume),
the reader stops using the cache. It reuses its own compiled helper or
compiles one, and retries the read once.
- Anchor the cache's returned cleanup errors as cleanupRoot does, so every
error returned while cleanup was pending resolves after a retry succeeds.
- Build the cache path with appendCallerPath, so a home with symlinks and
`..` keeps the caller's meaning instead of being normalized lexically.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(process): keep concurrent fallbacks and dual cleanup failures
Each helper read now records before awaiting whether it launched the shared
copy, so a concurrent read's fallback cannot hide its own. When the per-run
root and the cache's retained resources both fail one close, the returned
error composes both. It stays incomplete until both owners recover.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(process): refuse shared helpers that an ACL lets others write
macOS ACLs can grant writes that the POSIX mode bits do not show. On
Darwin, lookup and publication list the real ancestors, the entry and its
files with `ls -lde`, and refuse sharing when any ACL entry allows a
write-class right. The default `group:everyone deny delete` entries on
macOS home folders are unaffected. The unlaunchable-helper test now removes
the execute bit from a verified copy, which refuses launch on both Linux
and macOS.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(debugger): share GDB and Rizin session caps as REA_ settings
Move the duplicated deadline guidance into the owned debugger helper and
replace the shared session, queue, output, and 120s command caps with
launch settings that name their value, source, and range.
* test(gdb): assert the command-output setting on truncated exit evidence
The retained-output limitation now names REA_DEBUGGER_MAX_COMMAND_OUTPUT_BYTES
instead of the old fixed-cap sentence.
* test(gdb): assert command-output limit fields on truncated exit
A truncated GDB exit now carries the command-output setting, value, and
source on the cleanup error. The coverage test reads those fields.
* fix(debugger): keep control replies and evidence hashes inside their budgets
Point the session-cap mutation target at DEFAULT_DEBUGGER_MAX_SESSIONS.
Give startup and cleanup replies a fixed 16 MiB budget so a small caller
output cap cannot truncate them. Lower the command-output maximum so
escaped Evidence JSON stays under Node's string ceiling, and keep GDB
startup timeout diagnostics when the error is rebuilt.
* test(debugger): throw typed Result errors before success checks
Success cases no longer assert ok and return. They throw the typed
error first, then check session, deadline, and close fields.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* refactor(admission): own inspector, web, and CLI state per host
Replace the process-global inspector, web-bundle, guidance, and JavaScript
counters with objects a host passes in, so independent instances do not
share admission or cleanup.
* fix(admission): keep worker and file cleanup on the host
Web-bundle and JavaScript workers retry only their host registry, and
each Inspector admission authorizes and closes its own file scope.
Browser providers can share one web-bundle admission.
* test(inspector): gate one admission's file cleanup
The isolation test delayed the first ArtifactResourceScope.retryCleanup
call, so a second call on a shared ElectronFileScope still finished.
Hold first.files.retryCleanup until the other admission's close
finishes, then release and join before restoring the method.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(firmware): preserve symlink target bytes
* fix(apple): preserve undecodable dylib link targets
* style(tests): fix CI formatting
* test(firmware): select the named contract directly
* test(firmware): record raw bytes for a decodable symlink target
* test(mcp): assert bundle path issues by field
compare_bundles reports each relative path as an invalid_format issue
instead of one joined diagnostic sentence.
* test(firmware): stat raw links without following them
access follows a symlink, so a published dangling raw-link still looked
absent. lstat and readlink inspect the link itself.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(process): corroborate Linux exits after procfs environ read races
A token read failing with ENOENT/ESRCH may race with process exit while
native identity observation still sees a live PID. Recheck native lifetime
and accept absence only when corroborated; keep unverifiable or reused
PIDs fail closed.
Refs #7790
* fix(process): recheck Linux exit after final token retry
A process can exit after the final retry of a failed procfs environment
read. Re-observe native identity before producing final cleanup failures,
and keep PID replacement and uncertain identity fail-closed.
Add five integration-facing sweep regression cases for absence, live,
unavailable, replaced and zombie-replaced candidates.
Refs #7790
* fix(process): bound native exit settlement for token-open races
After a terminal ENOENT/ESRCH run-token read, allow a tightly bounded
native-only settlement window to corroborate pending Linux process exit.
Retain an explicit failure for live/unavailable or changed PID identities,
without inferring exit from the token error itself.
Cover delayed absence, delayed replacement and bounded live retries.
Refs #7790
* fix(process): share native token exit settlement
* fix(process): signal only groups with validated members
* fix(process): retain lineage through exit settlement
* fix(process): type mixed identity observations in exit checks
Map inference collapsed a readable/absent union onto the absent
overload after main tightened ProcessIdentityObservation.
* fix(process): refresh groups whose members exit during revalidation
A same-group child forked after the revalidation snapshot is not an
empty group, so cleanup reads the table again before skipping the signal.
* test(process): arm group-refresh exit from the revalidation snapshot
The regression follows the table read after planning observed the
launcher token, and requires a later refresh to see the forked child.
* test(mcp): assert bundle path issues by field
The compare_bundles rejection reports each relative path as an
invalid_format issue instead of one joined diagnostic sentence.
* test(mcp): assert field issues for bundle paths and Dart ABI
Relative bundle paths and rejected ABI selectors are reported as
input issues on those fields, not as one joined diagnostic sentence.
---------
Co-authored-by: Harshit Sharma <66710144+harshitethic@users.noreply.github.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(process): normalize descendants of slash-spelled directory roots
A working directory or observation path ending in / or /. kept its
trailing separator as the alias, so descendant paths never met the
delimiter lookahead and stayed literal. Strip those spellings before
building aliases and version the path normalization contract as v3.
Fixes#7584
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(process): normalize filesystem root descendants
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
Seal sensitive terminal chunks before deferred rendering, apply one bounded
capture-local literal matcher, and retain exact redacted byte accounting.
Keep private input facts in explicit fields and separate comparison policies.
Retain distinct terminal failures once and verify structured refusal facts.
Fixes#7782
BREAKING CHANGE: sensitive interaction data is empty with sensitive and input_bytes fields instead of a byte-count placeholder. Sensitive raw_data is also redacted. Read input_bytes and recapture both comparison sides when migrating older private-input Evidence.
Assisted-by: Reimu (gensokyo-skills:reimu-incident-triage)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Resolve Windows ADB, Apktool and update commands against the selected
PATH/PATHEXT before launch. Keep explicit paths and relative PATH choices,
report lookup failures, and reuse absolute batch invocation and ownership.
Add native launch/argv regressions, real npm metadata probes and focused
CI ownership so these boundaries retain Windows verification on the fast tier.
Fixes#7724
Assisted-by: Reimu (gensokyo-skills:reimu-incident-triage)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Read bounded plist format probes and Linux resource-limit reports through positive short reads before classifying their contents. Preserve explicit EOF, report capacity, physical failures and descriptor cleanup ownership.
Validated 66 focused tests and check:fast; nine new fault-injected cases fail against the previous implementation. Linux procfs was not verified on a real Linux host.
Retain file identity after Rust, web artifact, shared selected-input and historical capture reads complete before close or cancellation fails. Preserve descriptor-set snapshots in diagnostics alongside sanitized capture observations.
Classify canonical physical capture failures before cleanup composition; source permission errors and bare syscall failures keep their meaning through late cancellation and retry. Keep explicit sensitive-value redaction on retained facts.
Validation: 247 focused cases passed, two Linux-only cases skipped; build, typecheck, lint and formatting passed. Real descriptors with controlled finalization faults establish reader ownership and facts. Worker reply and multi-file database completion semantics remain separate audit work.
Keep binary_session available when Linux owned-child probes lack procps ps. Preserve typed ownership-prerequisite failures in direct execution and report per-provider readiness in status. Independently validated on latest main through real stdio MCP plus focused regression, static and documentation checks. Closes#7164.
Afloat