* fix(javascript): keep export bindings out of module views
Exported symbol bindings reuse the javascript-module node kind, so the modules collection counted one row per export alongside the owning module. On a CommonJS or ESM file with N exports, inspect_analysis_view reported N+1 module units, module pages listed indistinguishable rows sharing the module path, and item selection by selector.path failed with "Multiple modules have path".
Treat a node whose observations carry semantic_role export-binding as an export of its owning module, not a module unit, and exclude it from module entries. Export bindings remain distinct graph entities for export-shape comparison and version matching.
Validation: a domain regression in analysisView.test.ts and a CLI acceptance regression over a real CommonJS analysis both fail on main and pass with this change. Also ran the analysis view, MCP boundary, CLI boundary and JavaScript acceptance suites (125 tests), npm run check:fast, and the MCP catalog schema test after regenerating .cache/mcp-tool-catalog.json.
* test(javascript): run the export-binding view case on the shared CLI
The case starts a compiled CLI process for each of its three commands,
paying startup and tool registration three times per run. The fixture
already provides a file-scoped process for calls with no stdin or explicit
timeout, so use it.
* style(javascript): format the constructed-evidence type in the module-view case
The acceptance case's inline graph type did not match what oxfmt emits for the
80-column limit, so `format:check` refused the tree. Reflow only; the assertions
are unchanged.
* style(cli): wrap the native data type path description
The `inspect-native-data-type` argument description line is 82 columns, over the repository's 80-column `.oxfmtrc.json` limit, so `npm run format:check` fails on main and on every branch merged from it. It came in with #9465 and the following commits to this file did not touch it. Reformat the one call the formatter objects to; no behaviour change.
---------
Co-authored-by: 2SinceJuly <202121119+2SinceJuly@users.noreply.github.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
* fix(elf): qualify Linux CORE notes by the declared ABI
* test(mcp): cover source fitting and omitted delivery budgets
---------
Co-authored-by: hhang <169027046+xu91102@users.noreply.github.com>
* fix(doctor): probe providers with the selected client's registration environment
rea doctor read provider settings only from the terminal running it. A client
registration that carries GHIDRA_INSTALL_DIR or REA_JADX_MCP_CONFIG under its
own env block therefore looked unconfigured: doctor answered not_configured
while the server that client starts inherited the settings and worked. This is
the recovery command the docs point agents at, so the false negative sent them
back to re-apply fixes that were already in place.
When the caller names exactly one client, read that registration's effective
environment and hand it to the provider checks. Terminal variables that
providers resolve outside server config (PATH, SYSTEMROOT) stay inherited, and
running doctor without --client still reports this terminal. A registration the
loader cannot read keeps its own registration check as the answer instead of
being re-reported as four missing providers.
Fixes#9102
* fix(doctor): keep setup's terminal settings and a failed close on the host
Greptile found two regressions in the selected-client environment read.
Provider probes now start from the terminal and overlay the selected
registration, instead of replacing the terminal with the registration
alone. `rea setup --client` passes its own client selection through the
same doctor call, so on a first run with GHIDRA_INSTALL_DIR exported and no
registration yet, the replacements made setup report providerConfigured:
false and offer Hopper over the selected BYO provider. The registration
still wins for every value it records.
The registration read now runs inside the caller's resource scope and, when
the close of the configuration file fails, retains the returned owner there
so host.close() retries it. Dropping that owner left an unretired handle
with no way to report the unfinished cleanup.
* fix(doctor): leave a registration's expression settings unknown
Greptile found the previous fallback filling a name the selected client
records as a Cordis expression with the terminal's value. `dsh` keeps such
a value as `!!js ...`, which is not a literal; the parser reports the name
in `unresolvedSettings`, and merging the terminal into it then made probes
certify a setting the client owns and this process cannot read.
Unresolved names are now removed after the overlay, and an unreadable,
malformed, or unresolvable registration returns no environment at all, so
the caller keeps the terminal instead of a partly-known one. Provider checks
report those settings as unconfigured, which is the honest answer for a
chain that resolves outside REA.
dsh's missing registration still inherits the terminal, which is the case
`rea setup` depends on.
* fix(doctor): fold registration settings by platform identity
`selectedProviderSettings` overlaid a selected client's registration on the
terminal with an object spread. On Windows a registration can record
`ghidra_install_dir` while the terminal exports `GHIDRA_INSTALL_DIR`; the spread
kept both spellings, and since provider checks read the canonical uppercase
names, doctor either certified the terminal's install or reported the setting as
unconfigured. An expression the registration marks unresolved was skipped under
one spelling while its terminal value survived under the other.
Merge the two layers through `mergeEnvironmentOverrides` and fold the result
with `snapshotEnvironment`, so the registration's value wins regardless of how
it spells the name and the provider sees the names it reads. Fold the unresolved
names the same way before deleting them, and export the helper so the two
platform identities can be covered directly.
* style(doctor): wrap the long import in the runtime test
oxfmt wants the three imported names on their own lines; the previous
commit left the single-line form, which fails `npm run format:check`.
* test(codebuddy): construct the registration command like its sibling clients
`npxRegistrationCommand` was removed in c77735fa ("fix(setup)!: bind managed
registrations to selected installation"). The CodeBuddy boundary test landed
after that refactor and still imported it, so `npm run typecheck` failed on
every branch that descends from merge fb841a95 — main included, where the
main push CI is still queued.
Use `currentClientRegistrationCommand()` the way the kimi, lmStudio and other
client configuration tests already do.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* fix(doctor): retain failed registration file cleanup
* fix(doctor): preserve unknown client provider readiness
* fix(doctor): scope Kuna readiness to its environment
* test(doctor): respect Kuna host support
* fix(doctor): read a registration's unresolved settings only where the probe needs them
Every setting an expression made unresolved blocked readiness, even one the provider never consults for the configuration the client supplied. With a literal JAVA_HOME and jar path, JADX resolves Java by absolute path and does not read PATH, yet a dsh registration with an expression-backed PATH skipped the probe and reported the provider unknown. Ghidra is the same when both GHIDRA_INSTALL_DIR and JAVA_HOME are explicit.
Decide per provider which unresolved setting the probe actually reads, and skip only those. Kuna's readiness list also omitted HOME and XDG_CACHE_HOME, which its cache root falls back to, so an unresolved cache input could let the probe check a fallback directory and report available without knowing the client's real cache.
* fix(doctor): stop probing a registration expression as a literal
Two findings from the review, both about handing a probe a value REA cannot interpret.
REA_KUNA_CACHE_DIR made settingAffectsProbe ignore every unresolved Kuna setting, so an expression-backed REA_KUNA_COMMAND or REA_KUNA_JOBS silently fell back to a default and the provider could report ready. Limit the exception to HOME and XDG_CACHE_HOME, the two cache-location defaults.
HOME and XDG_CACHE_HOME were also added to KUNA_DOCTOR_SETTINGS, which registrationEnvironment copies wholesale, so setup persisted ambient values a child already inherits. Split the readiness inputs from the settings setup writes.
Qwen expands $VAR and ${VAR} in a recorded env value from the environment it runs with. REA cannot predict that, but it was handing the literal to the probes, so a registration appending to PATH made JADX search for a literal ${PATH} entry. Treat such values as unresolved for that client so the affected provider reports unknown instead of probing the literal text.
* fix(registration): recognize a client's env expression at the shared reader
Doctor decided which Qwen settings were expressions after the shared registration reader had already parsed them as literals, so doctor and setup/status held two interpretations of the same file. AGENTS.md requires normalizing once at the owning boundary, so move the recognition into ClientRegistrationEnvironment and let every consumer read the facts it returns.
The reader now takes the client name, marks a variable-expanding client's $VAR and ${VAR} values as unresolved, and reports those names through unresolvedSettings. Doctor drops its own parser; setup and status pick up the same facts, which also keeps an expression-valued timeout out of the resolved budget instead of trusting the literal.
* fix(doctor): preserve unresolved typed settings
* style(cli): wrap the native data type path description
The `inspect-native-data-type` argument description line is 82 columns, over the repository's 80-column `.oxfmtrc.json` limit, so `npm run format:check` fails on main and on every branch merged from it. It came in with #9465 and the following commits to this file did not touch it. Reformat the one call the formatter objects to; no behaviour change.
---------
Co-authored-by: 2SinceJuly <202121119+2SinceJuly@users.noreply.github.com>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
* fix(javascript): analyze first-party sources before dependencies
Every source in one application analysis charges the same parent result
budget, and sources were offered in lexical inventory order. On an Electron
app.asar, node_modules/ sorts before an electron-vite out-*/ directory, so
dependency files spent the budget and every first-party main, preload, and
renderer file had its semantic analysis not started and its application
projection rejected. The summary then reported zero windows, preloads, and
bridges while electron_semantics still said "recovered".
Offer application JavaScript before JavaScript under node_modules; reported
files keep inventory order. Count Electron boundary facts only from files
whose projection was admitted, and report electron_semantics "partial" (with
a limitation naming the count) when an Electron-loading source was not fully
examined or reported.
Fixes#9321
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(javascript): treat limited Electron examination as partial coverage
A static pass can stop early at the Electron wrapper expansion budget or
another resource limit without failing the worker. Such a source carries no
analysis or projection failure, so its retained IPC or bridge facts still
reported electron_semantics "recovered". Read the owned examination status
and count a limited Electron-loading source as incomplete.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
* feat(providers): canonicalize selection diagnostics
Extend candidate statuses with selection source and stable rejections derived from readiness and target support. Automatic selection now keeps every rejected candidate attributable, while explicit and ambiguous outcomes remain fail-closed and deterministic.
* test(providers): surface typed selection errors
Follow the repository test guide: throw the typed Result error before
reading the selected value so a failure reports the provider error.
* fix(javascript): mark unisolated program-var route values unproven
`JavaScriptRouteScan.#resolve` now records the identifier whenever a value
proof depends on a program-scope `var` in a script without a proven isolated
runtime. That binding is a global-object property, so `globalThis.NAME` or an
alias can replace it after the source initializer.
The mark lives in the shared resolver, so every consumer degrades from one
fact instead of each one opting in:
- path segments and navigation destinations stop asserting the source value
and report an unknown interpretation;
- an index flag stays unproven, as before;
- a route container keeps its source route set and reports an incomplete
interpretation, so `var routes=[...]` no longer loses every route.
The source initializer is still followed, which is what lets a container
consumer keep its facts while disclosing the gap.
* fix(javascript): keep literal child routes behind an unisolated children array
Rejecting the whole children configuration marked its records as claimed
by the interpretation, so the automatic-root loop skipped them and the
literal child paths disappeared even though their absolute paths need no
parent proof. Keep the source records reachable and let the walker report
the unproven ancestry as an interpretation gap.
* test(javascript): bound the index-route CLI acceptance matrix
The flag matrix runs sixteen CLI invocations in one test and passed at 20.7 s
against a 30 s default timeout, so it timed out on a loaded runner. The same
matrix is already asserted per case in javascriptRouteScan.test.ts, where each
case is an in-process parse; this file keeps one resolved case and one
unresolved case to prove both branches of the public CLI view.
* fix(javascript): retain ownership of unproven route literals
Keep source ownership separate from runtime value proof so rejected program-var route segments cannot reappear through the generic constant pass. Cover path, route, typed and alias forms, retain navigation controls and independent literals, and verify inventory and public CLI projections.
Run the existing CLI index cases independently so repeated process startup does not consume one combined test deadline. Preserve both cases and all assertions.
* fix(javascript): keep unisolated navigation data out of route literals
An unisolated program-var slot holds data, not a route. Refusing its
runtime identity released the object back to the independent route scan,
which then reported a query payload as a nested route. Report the object
as consumed navigation data and stop following it as a path.
* fix(javascript): follow rejected navigation data without trusting it
Claiming the whole object for a rejected value also claimed its sibling
properties, so an independent route in the same object disappeared.
Keep the property selection: ownership follows the slot, and only the
route consumers refuse an unproven runtime identity.
* fix(validation): stop reporting an exclusive bound as an inclusive minimum
Input issues report minimum and maximum as inclusive bounds, as JSON Schema does, but the projection ignored Zod's inclusive flag. A .positive() field such as inspect_analysis_view view.limit or observe_native_ui pid rejected 0 and reported minimum: 0, naming the rejected value as allowed; .lt() limits had the same problem for maximum. An exclusive bound now keeps the schema's own message (for example 'expected number to be >0') instead of a false inclusive bound. Inclusive bounds are unchanged.
* test(validation): cover exclusive and inclusive bounds through MCP
* fix(cli): advertise the source-location path and URL constraints
trace-web-source-location declared manifestPath, sourceMapPath and sourceMapUrl
as bare strings, so `--schema --json` advertised them with no minLength and no
absolute-path pattern. The service then refused a relative manifest or map with
a post-parse invalid_request naming manifest_path and source_map.path, while
trace-web-module-imports already advertises those constraints from its domain
fields.
Bind the three positionals to webSourceLocationInputSchema so the domain field
owns the bounds, format and help, matching the rule in cliDecimalField that the
domain field owns bounds, defaults, nullability and help. The CLI now refuses a
relative or NUL-bearing value at its own boundary with a field-level message
instead of surfacing a service-level failure.
Add a boundary test that compiles the advertised args schema and asserts the
shared path and non-empty URL constraints, next to the existing sibling case.
* test(cli): isolate the NUL rejection from the absolute-path check
The boundary case for trace-web-source-location used "manifest\0.json", which is
also a relative path. The absolute-path constraint alone rejects it, so the case
would still pass if schema conversion dropped the NUL pattern. Use an absolute
path with an embedded NUL instead, and add the same case for sourceMapPath.
* style(test): wrap input schema assertions for oxfmt
The two unknown-byte cases exceeded the line width and tripped
format:check in CI. No assertion changes.
* fix(cli): admit native data type selectors before opening a target
* fix(cli): advertise the native data type selector choice
* test(cli): reject invalid native data type selectors before target access
* test(cli): cover native data type selector discovery
* fix(cli): reject an empty native data type target before resolution
inspect-native-data-type still declared its positional target as a plain
string after #7956 moved its sibling local-file commands to
localPathStringSchema, so an empty target passed validation and resolved
to the working directory. Use the shared schema and cover the command in
the empty-target admission table.
* refactor(cli): share native data type selector guidance owner
* test(cli): bind native data type selector checks to owning contracts
* fix(wasm): admit compatible 1.0.x WABT releases
REA_WABT_BIN_DIRECTORY admission compared each --version banner to the
literal 1.0.42, so a Homebrew or rolling-distribution WABT that advanced
past that build was refused even though wasm-validate, wasm-objdump and
wasm2wat accept the same flags and emit the same output shape. Callers had
to keep a hand-extracted 1.0.42 tarball alongside the system package.
Admission now accepts the release range ^1.0.42 and records the observed
banner, matching how the Wakaru adapter already admits compatible builds.
The verified release stays the reference: a banner other than 1.0.42 is
retained as tool_profile.release and provider.version and the report states
that only 1.0.42 was verified. All three tools must report the same release,
since one directory is one installation. Managed downloads stay pinned.
Fixes#9197
* fix(wasm): bound WABT admission to releases the report schema accepts
WABT_ACCEPTED_RANGE was "^1.0.42", which also admits 1.1.0 and later 1.x
releases, while wasmArtifactSchema only accepts 1.0.x banners. A configured
tool reporting 1.1.0 therefore passed version admission, ran the inspection,
and then failed at report parsing. Use the explicit ">=1.0.42 <1.1.0"
range so admission and the schema agree, and test the boundary.
Also carry the compatible-release warning into both partial-Evidence
builders. Previously only successful reports stated that REA verified
1.0.42, so a validation rejection or later read failure under a
compatible release silently dropped the uncertainty that a success reports.
Share the text through wabtReleaseLimitation so both paths stay aligned.
* fix(wasm): stop claiming the 1.0.42 commit for a newer admitted release
A caller-supplied 1.0.43 or 1.0.44 was admitted with the observed banner in
tool_profile.release, but source_commit still carried the 1.0.42 revision,
which is a claim about a build that did not run. Emit null for any release
other than the verified 1.0.42; the observed release and each executable
digest still identify what actually ran.
Also spell the accepted range as it is defined (>=1.0.42 <1.1.0) in the guide
and the failure fixture instead of ^1.0.42, which in semver admits 1.1.0.
---------
Co-authored-by: 2SinceJuly <202121119+2SinceJuly@users.noreply.github.com>
* fix(objdump): reflect observed launch failure in discovery availability
Distinguish a statically registered standalone command from an executable
whose launch has failed in the active server session. Discovery leaves
unprobed commands optimistically available, reports an observed launch
failure as provider_unavailable with the command remediation, keeps the
tool callable for retries, and clears the failure after a subsequent
successful launch.
Fixes#8826.
* test(reverse): verify overlapping command launch dispatch ordering
* test(reverse): unblock gated test workers before awaiting service closure
* test(reverse): bound lifecycle acknowledgement and join launched workers
* fix(reverse): distinguish host capacity exhaustion from command launch failures
* fix(reverse): preserve host capacity across Linux process ownership preparation
* fix(reverse): exclude process ownership admission failures from command launch state
* fix(reverse): preserve Darwin process ownership preparation error across command launch
* fix(reverse): disambiguate cleanup declaration in provider observation
* fix(reverse): preserve command deadline timeout during Darwin ownership preparation
* fix(reverse): isolate Darwin baseline ps errors and provide platform-aware admission guidance
* fix(reverse): rely on typed baseline admission failures and use owning repair formatter in tests
* test(reverse): use owning formatters for process ownership remediation assertions
* fix(reverse): restrict Linux ownership prerequisite remediation to missing ps and preserve system error codes
* fix(reverse): retain typed process ownership prerequisite with preserved error codes
* fix(reverse): remove unvalidated error label fallbacks and keep admission tags out of system_code
* fix(reverse): keep Windows native runner failures out of command-launch state
* fix(process): preserve current_process_unreported refusal in Linux provider readiness
* fix(process): distinguish no-code ps failure from missing ps and cover rizin launch failure
* fix(windows): classify process_spawn host-control rejections as RuntimeControlUnavailableError
* fix(desktop): keep a failed library owner query unknown
dpkg-query -S exits 1 when some requested path has no owner and 2 when
it could not answer at all. LibraryPackageInventory.packageOwners only
rejected the missing and failed outcomes, so an exit of 2 with empty
stdout parsed as a successful empty owner map and every located library
was recorded in unpackaged_libraries. That turns a failed lookup into an
incorrect ownership fact and drops the reason, while the executable
owner lookup in DebianPackageInventory already treats exit codes above 1
as unknown.
Treat an exit code above 1 as a failed query for the batch, report it in
library_packages_reason, and leave the libraries it covered out of
unpackaged_libraries. Already established missing_libraries are kept.
* fix(desktop): retain completed library ownership queries
* fix(desktop): report ownership gaps per library
---------
Co-authored-by: 2SinceJuly <202121119+2SinceJuly@users.noreply.github.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
* feat(desktop): capture, draft, export and witness a task inside a build computer
- start_build_capture runs REA's capture inside the computer through a
small controller over computer-exec, after a user-space apt-get update;
mark_build_checkpoint returns once the capture confirms the checkpoint;
stop_build_capture returns the draft between seed and end.
- export_build_environment exports with the requester's task inside the
computer and fetches the bundle through data/get in bounded batches.
- check_build_task grades a computer's data/get with REA's evaluator and,
through seed, after_edit, near_miss and after_reset stages, records a
witness with the action log and the screen recording; act_on_build_computer
gains reset.
- Capture progress lines carry window, checkpoint and refusal events; apps
start in the home; a pack script builds the runtime archive; long tools
send progress notifications.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): make build capture and witness steps retryable, and close the near-miss reset hole
- A capture whose start answer is lost is stopped at once and kept
unreleased until the stop is confirmed; a lost checkpoint answer is
recovered from the capture's own log, and draft and export use the
checkpoints its Evidence records; stop can be repeated to resume
reading its result.
- A witness can check its seed again after a failed read, and keeps its
stages in a saving state until the record is written, so a failed save
can be retried without reading the app again.
- after_edit and near_miss count only click, drag, scroll, type and key,
so a reset no longer stands in for the near-miss edit.
- A .deb build keeps its package file for capture and passes its URL to
export; bundle downloads write each checked file before fetching the
next; an apt-get update failure reports its exit code and log tail;
reset sends progress while it waits.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep the Trash out of seeds, bundle folders unwritten and first frames drawn
From the blind Inkscape rebuild:
- Paths in ~/.local/share/Trash get a desktop_trash reason and the
shared_desktop role, so a file trashed before seed is neither owned nor
seeded; the export names it in a limitation.
- The keep helper runs with PYTHONDONTWRITEBYTECODE=1, so starting a
computer from a bundle folder no longer writes __pycache__ into it.
- start_build_computer waits, bounded, until the first frame is not one
colour before returning it.
From review: a .deb that apt also offers exports from apt, since export
passes --package-url only when the capture says the package must come
from its file.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): bound the first-frame wait's retries to the time left, with progress throughout
Each retry of the drawn-first-frame wait runs under an abort that fires at
the 10 s deadline, and the latest frame is returned when time runs out.
connect takes the first frame itself while its progress heartbeat still
runs, reporting "waiting for the desktop to draw". The wait moves to
DrawnScreenshot.ts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): serialize each build computer's calls, keep one recording id, and separate unreadable checks from failures
- One queue per computer: actions, capture steps and witness checks run one
at a time, so two overlapping after_edit checks can no longer both be filed
and let the witness hold without a near miss. Close cancels the running and
queued calls; different computers still run concurrently.
- The witness keeps one recording request id per computer, so a seed retried
after a lost reply recovers the recording it started.
- A check that could not read its file is undecided, not a failure, so a
temporary read error can't satisfy seed, near_miss or after_reset; such a
stage is refused and can be checked again.
- The export's file listing is written to a file and read back in bounded
batches, so a large bundle no longer overruns exec's 1 MiB output.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): treat failures on cut views as undecided, require a decided seed failure at export, and keep a close's cancellation
- A presence check that misses its line, row or pointed value in a view cut
short is undecided rather than failed, since the data may sit in the part
left out; a witness stage can no longer be proved by such a failure.
- Export counts only decided failures on the seed, and refuses a task whose
every seed failure is undecided.
- A step whose turn was aborted by a close or the caller returns cancelled
even when its work finished, so start_build_capture no longer reports
success for a computer being removed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep a step's saved result when a cancellation arrives during its commit
Reporting cancelled for any step whose turn was aborted after its work
replaced a completed export or witness save with a bare cancellation, losing
what was saved and leaving the witness unreadable. Steps now return what they
completed; only start_build_capture, which commits nothing, checks its turn
after the post-launch screenshot and reports cancelled. Asking again for a
saved witness's final check returns its record.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): refuse a saved witness's repeated check for another folder
Asking again for the check that ended a witness returned its saved record
whatever directory came with it, so a caller naming another folder got
success though nothing was saved there. A different folder is now refused,
as an unfinished seed's retry already is.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(desktop): assert the facts of cut-view and undecided outcomes, not their sentences
The new cut-view, missing-value, undecided-refusal and witness tests froze
whole descriptions, so a harmless rewording broke them. They now check each
outcome's id, passed and undecided exactly and the facts its message must
carry (file, pointer, line, row, stage) separately.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(desktop): read XML with a plain DOCTYPE, and check an element's whole text
- Both readers accept a DOCTYPE with only a name and an optional PUBLIC
or SYSTEM identifier, record it as the view's doctype, and never fetch
the DTD or expand entities beyond XML's five; an internal subset, an
external entity and a parameter entity stay refused alike.
- text_equals and text_contains compare the concatenated text of the
element (or text node or attribute) a pointer reaches, as XPath
string() does, with optional normalize_whitespace; both evaluators
agree, and a text check on a truncated element is undecided.
- Whitespace-only text between elements is dropped only when the element
holds no other text, so text split into runs keeps its spaces.
- The draft suggests text_equals for an element whose text changed.
So an AbiWord .abw reads as XML, and its paragraph's text is checked
whole however AbiWord splits it into <c> runs, as Writer's spans are.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): draft whole-text checks on the paragraph, read only text as text, and skip asctime stamps
- A changed value is read at both ends, so text that became a run still
marks its paragraph, and the drafted text_equals moves up out of mixed
content to the nearest ancestor named by an attribute, such as
AbiWord's p by its xid.
- Text checks accept only a text node or an attribute value; element
names and doctype fields fail, in both evaluators.
- isTimestamp also recognises asctime dates (Www Mmm dd hh:mm:ss yyyy).
- XML files are drafted with the keyed diff the archive entries use, so
no suggestion reaches an element by position; the shared logic moves to
appTaskDraftNamed.ts.
- Text-check tests assert facts, not whole sentences.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep checks on a changed attribute inside a paragraph whose text check replaces its runs'
A drafted whole-text check on a paragraph hid every change inside it, so a
link whose label and href both changed drafted only the paragraph's text and
the new destination went unchecked. The text check now covers text and runs
added or removed whole; a changed name or attribute of an element both
versions hold keeps its own check.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): read an attribute called name or attributes as an attribute when the draft keeps its check
The owner of `.../attributes/name` was taken as `.../attributes`, so a
changed `name` attribute inside a paragraph with a text check was dropped
again. The owner is now read by segment, attributes first.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): draft text checks from text in runs added whole, and name a text element by its own id before its container
Text typed into a run the diff lists whole was never read, so the draft kept
only a presence check on the run, which wrong text also passed. Such text now
marks the nearest element both ends hold, or, when none can take the check,
the added element's own text. The climb also names an element by an
identifier of its own (id, xml:id, xid) before a larger container, so a
headline under a long layer keeps a whole-text check that survives re-split
runs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(desktop): expect the whole-text check where #8988's pairing test meets text checks
On this branch a changed element's text is drafted as `text_equals` on the
element, so the identity pairing test now expects that check, under the
same `[@role=body]` key.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(skills): build a computer-app environment from a request
The product skill gains references/desktop-build.md, a procedure that
takes Claude from a request such as "an Inkscape environment where the
agent changes a poster's headline" to a witnessed bundle and a report,
through start_build_computer, act_on_build_computer, the build capture
tools, export_build_environment and check_build_task: questions asked
once upfront, pauses only when blocked, a seed made in the app, content
checks by selector, a witness with a near miss and a reset in a fresh
computer, and solver runs only within a budget. setup installs the new
reference; skillVersion 61.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(skills): fold the blind Inkscape rebuild's friction into the build skill
key takes an array of one chord's keys; check for a text cursor before
typing in apps with single-key shortcuts; in Save As, click Documents and
type only the file name; anything saved before seed, the Trash included,
is part of the seed; dismiss first-run dialogs before seed; a bundle's app
starts with the seed's files but need not open the document; Inkscape's
window class is Inkscape.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(skills): fold the held-out AbiWord build's friction into the build skill
Name the act fields and link the guide; a region screenshot becomes the
latest frame; a drawn caret is not focus; confirm dialogs with Return;
check the dialog's folder when the app shows only a name; an XML file the
draft shows as lines was read as text, so use short line checks; and keep
text checks to the value the edit types, since some apps save a reloaded
document differently. Later witness stages take no directory.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(skills): state the export's seed rule, the Trash exception and draft refusals exactly
The export refuses a task unless at least one check fails on the seed and
every check passes at the end; a file moved to the Trash is left out of
the seed, so trash a stray file rather than starting over; a null draft
names its cause in draft_refusal; and a line check on a format read as
text only approximates a value, so bound it and call it approximate.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(skills): teach the build skill to use DOCTYPE and whole-text checks
The skill now checks text an app splits into runs whole with text_equals or
text_contains, finds an AbiWord paragraph by its xid, and drops the Writer
revision-id workaround.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(skills): point text checks at the paragraph, and say what the scrub replaces
From the AbiWord rebuild: point a text check at the paragraph or another
element the edit keeps, never at a run a reopened document splits; how to
name an unchanged element; the export replaces the host name, user@host
and home path while a bare user name stays; AbiWord's entry and class.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep every text check on a cut element undecided, in both evaluators
The XML reader drops text deeper than its depth limit but keeps later
siblings, and an element's whole text joins both sides, so a text_contains
on a cut element could match text the file never holds ("at 3" + deep
"WRONG" + ":30 PM" read as "at 3:30 PM"). Any text check on an element of a
cut view is now undecided again, as #9050 had it, in REA's evaluator and the
exported verifier; a text node or attribute value stays decided. The text
check tests assert facts rather than sentences.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(desktop): open the seed's document at launch, and say when a seed was made for the task
An exported app now opens the seed's one document at launch when its desktop
entry's Exec takes files, so a solving agent starts in the document rather
than on the app's start screen; a command that already names a file is kept,
and several documents or an Exec without a file code keep the launch and say
why. `--synthetic-seed`, which the build export passes, words the README and
limitations for a seed made in the build computer instead of asking to keep
the user's data local.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): count only a document the launch names, absolute or from its working directory, as already opened
A settings path under the home, such as geany's --config, kept the seed's
document from opening, and a relative document argument was missed and
appended again. An argument now counts only when it resolves, from the
captured working directory, to a file the capture gave the document role.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(desktop): check the seed and launch wording against their formatters, and the facts on their own
The tests froze the README's and limitations' sentences, so a harmless
rewrite broke them. The wording now comes from exported formatters
(`seedWording`, `seedLimitation`, `launchDocumentNote`,
`NO_LAUNCH_DOCUMENT`), the tests compare against those, and check the facts
separately: which document opens, the respelled path in the command, the
README naming it, `--synthetic-seed` and the Evidence's `synthetic_seed`.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor(desktop): plan the export's seeds and launch in their own module
The merged export module passed the file and function size limits; the seed
digests and the launch command now come from `DesktopExportLaunch.ts`.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep a reset applied when the screenshot asked after it fails
Once data/reset and the ready wait succeed, act_on_build_computer's reset
is applied in the action log and returns success; a screenshot asked of it
that is then refused or throws is named in the result's screenshot_error,
with no frame, so the next after_reset stage is not refused. Cancellation
still propagates.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep checks for elements without text beside a text edit, and normalize DOCTYPE system id line endings
A review found two gaps.
- A paragraph's whole-text check covered every element added or removed
inside it, including ones holding no text: an image frame, a line break.
A solver who typed the text but never inserted the image passed. Such an
element now keeps its own presence or absence check.
- The Python reader kept a DOCTYPE system literal's CRLF where TypeScript
normalizes it to LF. Both now report LF.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): wait out long build commands, fail a reset that restores nothing, and tie the witness to its bundle
A review found five gaps.
- Commands in the computer answer only when they end, but fetch stops
waiting for headers after 300 s. So a slow export, draft or start always
failed. A command with its own deadline now waits on node:http, bounded
by that deadline.
- after_reset held whenever some check failed, so a reset that changed
nothing passed on the near-miss state. Each check must now come out as it
did at the seed.
- A failed or partial apt-get update left lists that looked complete, so a
second start skipped the update. The update is now recorded only when it
succeeds, and rerun otherwise.
- A witness on a bundle computer graded whatever task it was given. Its
seed stage now refuses a task whose steps or checks differ from the
bundle's.
- A task too large for one command argument (96 KiB) is refused before the
export runs, instead of failing with E2BIG in the computer.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): advertise a checkpoint-name pattern that compiles in every JS regex mode
main's advertised-pattern test compiles every input schema pattern in v
mode, which refuses an unescaped hyphen in a character class. The
checkpoint name's hyphen is now escaped, and it means the same in u mode.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(desktop): import textSyntaxFormat once in the state format tests
main's mixed-case JSON suffix fix and this branch both added the import,
and the merge kept both.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep a completed reset, an unread seed, and a failed apt update
A cancel after data/reset no longer drops the restore from the action log,
so a near miss cannot treat the restored seed as an edit. An unreadable
seed check that later passes leaves after_reset undecided instead of
failing the witness. apt-get update is kept only when Error-Mode reports
success and a package list was fetched. The controller reply schema lives
with the controller, and capture progress lines are read by their domain
parser.
* fix(desktop): keep a whitespace-only run under the paragraph text check
A run whose only text is whitespace is still text the paragraph check
reads. It no longer gets its own presence check, which a later save of
the same words without that run would fail. Images and breaks, whose
text is empty, still keep their own checks.
* fix(desktop): keep an unread reset and a cut text check undecided
after_reset stays undecided when any check was not read, even if another
check still fails and the unread result's boolean matches the seed. A
text check for a child past a truncated view is undecided in both
evaluators. A reset whose reply is lost blocks a near miss until a later
input or a reset whose reply arrives.
* fix(desktop): retry a witness recording and a published record's cleanup
A recording that fails to end or download is not written into the witness
folder, and a manifest already received is fetched again without ending
the recording twice. A folder that is published while its handles fail to
close keeps that record and retries the same cleanup instead of writing
the folder again.
* fix(desktop): keep a published witness error and tag an app data refusal
A second failure to close a published witness returns the original error,
so its record and cleanup lease stay bound. A reset the app itself
refuses is an AppDataRefusal; only a reply that is not that refusal stays
unsettled. A missing child of a cut view is undecided with the same
description in both evaluators, and the shared cases cover it.
* fix(desktop): align a cut view's missing text with the Python check
A missing child of a truncated view is undecided for the same sentence in both evaluators, including the pointer the view does not contain.
* fix(desktop): keep one published witness cleanup across retries
A published record and its bound cleanup error stay together. A later close failure returns that error, and the unused path that built a fresh adapter error is gone.
* fix(desktop): keep a bundle task read inside the witness result
A cancelled, refused, or failed read of the bundle's task files returns the witness's Result, including a cleanup lease when a handle would not close.
* fix(desktop): check build runtime export capability
* fix(desktop): provide complete runtime repack command
* fix(desktop): retain runtime probe failures
* fix(desktop): recognize captured file URL documents
* fix(desktop): render captured file URLs at launch
* fix(desktop): isolate launcher URL encoding
* test(desktop): move launch execution to boundary suite
* style: fix desktop launch test formatting
* style: format native command path schema
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: morluto <morluto@users.noreply.github.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
morluto