* feat(desktop): capture, draft, export and witness a task inside a build computer
- start_build_capture runs REA's capture inside the computer through a
small controller over computer-exec, after a user-space apt-get update;
mark_build_checkpoint returns once the capture confirms the checkpoint;
stop_build_capture returns the draft between seed and end.
- export_build_environment exports with the requester's task inside the
computer and fetches the bundle through data/get in bounded batches.
- check_build_task grades a computer's data/get with REA's evaluator and,
through seed, after_edit, near_miss and after_reset stages, records a
witness with the action log and the screen recording; act_on_build_computer
gains reset.
- Capture progress lines carry window, checkpoint and refusal events; apps
start in the home; a pack script builds the runtime archive; long tools
send progress notifications.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): make build capture and witness steps retryable, and close the near-miss reset hole
- A capture whose start answer is lost is stopped at once and kept
unreleased until the stop is confirmed; a lost checkpoint answer is
recovered from the capture's own log, and draft and export use the
checkpoints its Evidence records; stop can be repeated to resume
reading its result.
- A witness can check its seed again after a failed read, and keeps its
stages in a saving state until the record is written, so a failed save
can be retried without reading the app again.
- after_edit and near_miss count only click, drag, scroll, type and key,
so a reset no longer stands in for the near-miss edit.
- A .deb build keeps its package file for capture and passes its URL to
export; bundle downloads write each checked file before fetching the
next; an apt-get update failure reports its exit code and log tail;
reset sends progress while it waits.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep the Trash out of seeds, bundle folders unwritten and first frames drawn
From the blind Inkscape rebuild:
- Paths in ~/.local/share/Trash get a desktop_trash reason and the
shared_desktop role, so a file trashed before seed is neither owned nor
seeded; the export names it in a limitation.
- The keep helper runs with PYTHONDONTWRITEBYTECODE=1, so starting a
computer from a bundle folder no longer writes __pycache__ into it.
- start_build_computer waits, bounded, until the first frame is not one
colour before returning it.
From review: a .deb that apt also offers exports from apt, since export
passes --package-url only when the capture says the package must come
from its file.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): bound the first-frame wait's retries to the time left, with progress throughout
Each retry of the drawn-first-frame wait runs under an abort that fires at
the 10 s deadline, and the latest frame is returned when time runs out.
connect takes the first frame itself while its progress heartbeat still
runs, reporting "waiting for the desktop to draw". The wait moves to
DrawnScreenshot.ts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): serialize each build computer's calls, keep one recording id, and separate unreadable checks from failures
- One queue per computer: actions, capture steps and witness checks run one
at a time, so two overlapping after_edit checks can no longer both be filed
and let the witness hold without a near miss. Close cancels the running and
queued calls; different computers still run concurrently.
- The witness keeps one recording request id per computer, so a seed retried
after a lost reply recovers the recording it started.
- A check that could not read its file is undecided, not a failure, so a
temporary read error can't satisfy seed, near_miss or after_reset; such a
stage is refused and can be checked again.
- The export's file listing is written to a file and read back in bounded
batches, so a large bundle no longer overruns exec's 1 MiB output.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): treat failures on cut views as undecided, require a decided seed failure at export, and keep a close's cancellation
- A presence check that misses its line, row or pointed value in a view cut
short is undecided rather than failed, since the data may sit in the part
left out; a witness stage can no longer be proved by such a failure.
- Export counts only decided failures on the seed, and refuses a task whose
every seed failure is undecided.
- A step whose turn was aborted by a close or the caller returns cancelled
even when its work finished, so start_build_capture no longer reports
success for a computer being removed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep a step's saved result when a cancellation arrives during its commit
Reporting cancelled for any step whose turn was aborted after its work
replaced a completed export or witness save with a bare cancellation, losing
what was saved and leaving the witness unreadable. Steps now return what they
completed; only start_build_capture, which commits nothing, checks its turn
after the post-launch screenshot and reports cancelled. Asking again for a
saved witness's final check returns its record.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): refuse a saved witness's repeated check for another folder
Asking again for the check that ended a witness returned its saved record
whatever directory came with it, so a caller naming another folder got
success though nothing was saved there. A different folder is now refused,
as an unfinished seed's retry already is.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(desktop): assert the facts of cut-view and undecided outcomes, not their sentences
The new cut-view, missing-value, undecided-refusal and witness tests froze
whole descriptions, so a harmless rewording broke them. They now check each
outcome's id, passed and undecided exactly and the facts its message must
carry (file, pointer, line, row, stage) separately.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(desktop): read XML with a plain DOCTYPE, and check an element's whole text
- Both readers accept a DOCTYPE with only a name and an optional PUBLIC
or SYSTEM identifier, record it as the view's doctype, and never fetch
the DTD or expand entities beyond XML's five; an internal subset, an
external entity and a parameter entity stay refused alike.
- text_equals and text_contains compare the concatenated text of the
element (or text node or attribute) a pointer reaches, as XPath
string() does, with optional normalize_whitespace; both evaluators
agree, and a text check on a truncated element is undecided.
- Whitespace-only text between elements is dropped only when the element
holds no other text, so text split into runs keeps its spaces.
- The draft suggests text_equals for an element whose text changed.
So an AbiWord .abw reads as XML, and its paragraph's text is checked
whole however AbiWord splits it into <c> runs, as Writer's spans are.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): draft whole-text checks on the paragraph, read only text as text, and skip asctime stamps
- A changed value is read at both ends, so text that became a run still
marks its paragraph, and the drafted text_equals moves up out of mixed
content to the nearest ancestor named by an attribute, such as
AbiWord's p by its xid.
- Text checks accept only a text node or an attribute value; element
names and doctype fields fail, in both evaluators.
- isTimestamp also recognises asctime dates (Www Mmm dd hh:mm:ss yyyy).
- XML files are drafted with the keyed diff the archive entries use, so
no suggestion reaches an element by position; the shared logic moves to
appTaskDraftNamed.ts.
- Text-check tests assert facts, not whole sentences.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep checks on a changed attribute inside a paragraph whose text check replaces its runs'
A drafted whole-text check on a paragraph hid every change inside it, so a
link whose label and href both changed drafted only the paragraph's text and
the new destination went unchecked. The text check now covers text and runs
added or removed whole; a changed name or attribute of an element both
versions hold keeps its own check.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): read an attribute called name or attributes as an attribute when the draft keeps its check
The owner of `.../attributes/name` was taken as `.../attributes`, so a
changed `name` attribute inside a paragraph with a text check was dropped
again. The owner is now read by segment, attributes first.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): draft text checks from text in runs added whole, and name a text element by its own id before its container
Text typed into a run the diff lists whole was never read, so the draft kept
only a presence check on the run, which wrong text also passed. Such text now
marks the nearest element both ends hold, or, when none can take the check,
the added element's own text. The climb also names an element by an
identifier of its own (id, xml:id, xid) before a larger container, so a
headline under a long layer keeps a whole-text check that survives re-split
runs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(desktop): expect the whole-text check where #8988's pairing test meets text checks
On this branch a changed element's text is drafted as `text_equals` on the
element, so the identity pairing test now expects that check, under the
same `[@role=body]` key.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(skills): build a computer-app environment from a request
The product skill gains references/desktop-build.md, a procedure that
takes Claude from a request such as "an Inkscape environment where the
agent changes a poster's headline" to a witnessed bundle and a report,
through start_build_computer, act_on_build_computer, the build capture
tools, export_build_environment and check_build_task: questions asked
once upfront, pauses only when blocked, a seed made in the app, content
checks by selector, a witness with a near miss and a reset in a fresh
computer, and solver runs only within a budget. setup installs the new
reference; skillVersion 61.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(skills): fold the blind Inkscape rebuild's friction into the build skill
key takes an array of one chord's keys; check for a text cursor before
typing in apps with single-key shortcuts; in Save As, click Documents and
type only the file name; anything saved before seed, the Trash included,
is part of the seed; dismiss first-run dialogs before seed; a bundle's app
starts with the seed's files but need not open the document; Inkscape's
window class is Inkscape.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(skills): fold the held-out AbiWord build's friction into the build skill
Name the act fields and link the guide; a region screenshot becomes the
latest frame; a drawn caret is not focus; confirm dialogs with Return;
check the dialog's folder when the app shows only a name; an XML file the
draft shows as lines was read as text, so use short line checks; and keep
text checks to the value the edit types, since some apps save a reloaded
document differently. Later witness stages take no directory.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(skills): state the export's seed rule, the Trash exception and draft refusals exactly
The export refuses a task unless at least one check fails on the seed and
every check passes at the end; a file moved to the Trash is left out of
the seed, so trash a stray file rather than starting over; a null draft
names its cause in draft_refusal; and a line check on a format read as
text only approximates a value, so bound it and call it approximate.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(skills): teach the build skill to use DOCTYPE and whole-text checks
The skill now checks text an app splits into runs whole with text_equals or
text_contains, finds an AbiWord paragraph by its xid, and drops the Writer
revision-id workaround.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(skills): point text checks at the paragraph, and say what the scrub replaces
From the AbiWord rebuild: point a text check at the paragraph or another
element the edit keeps, never at a run a reopened document splits; how to
name an unchanged element; the export replaces the host name, user@host
and home path while a bare user name stays; AbiWord's entry and class.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep every text check on a cut element undecided, in both evaluators
The XML reader drops text deeper than its depth limit but keeps later
siblings, and an element's whole text joins both sides, so a text_contains
on a cut element could match text the file never holds ("at 3" + deep
"WRONG" + ":30 PM" read as "at 3:30 PM"). Any text check on an element of a
cut view is now undecided again, as #9050 had it, in REA's evaluator and the
exported verifier; a text node or attribute value stays decided. The text
check tests assert facts rather than sentences.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep a reset applied when the screenshot asked after it fails
Once data/reset and the ready wait succeed, act_on_build_computer's reset
is applied in the action log and returns success; a screenshot asked of it
that is then refused or throws is named in the result's screenshot_error,
with no frame, so the next after_reset stage is not refused. Cancellation
still propagates.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep checks for elements without text beside a text edit, and normalize DOCTYPE system id line endings
A review found two gaps.
- A paragraph's whole-text check covered every element added or removed
inside it, including ones holding no text: an image frame, a line break.
A solver who typed the text but never inserted the image passed. Such an
element now keeps its own presence or absence check.
- The Python reader kept a DOCTYPE system literal's CRLF where TypeScript
normalizes it to LF. Both now report LF.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): wait out long build commands, fail a reset that restores nothing, and tie the witness to its bundle
A review found five gaps.
- Commands in the computer answer only when they end, but fetch stops
waiting for headers after 300 s. So a slow export, draft or start always
failed. A command with its own deadline now waits on node:http, bounded
by that deadline.
- after_reset held whenever some check failed, so a reset that changed
nothing passed on the near-miss state. Each check must now come out as it
did at the seed.
- A failed or partial apt-get update left lists that looked complete, so a
second start skipped the update. The update is now recorded only when it
succeeds, and rerun otherwise.
- A witness on a bundle computer graded whatever task it was given. Its
seed stage now refuses a task whose steps or checks differ from the
bundle's.
- A task too large for one command argument (96 KiB) is refused before the
export runs, instead of failing with E2BIG in the computer.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): advertise a checkpoint-name pattern that compiles in every JS regex mode
main's advertised-pattern test compiles every input schema pattern in v
mode, which refuses an unescaped hyphen in a character class. The
checkpoint name's hyphen is now escaped, and it means the same in u mode.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(desktop): import textSyntaxFormat once in the state format tests
main's mixed-case JSON suffix fix and this branch both added the import,
and the merge kept both.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep a completed reset, an unread seed, and a failed apt update
A cancel after data/reset no longer drops the restore from the action log,
so a near miss cannot treat the restored seed as an edit. An unreadable
seed check that later passes leaves after_reset undecided instead of
failing the witness. apt-get update is kept only when Error-Mode reports
success and a package list was fetched. The controller reply schema lives
with the controller, and capture progress lines are read by their domain
parser.
* fix(desktop): keep a whitespace-only run under the paragraph text check
A run whose only text is whitespace is still text the paragraph check
reads. It no longer gets its own presence check, which a later save of
the same words without that run would fail. Images and breaks, whose
text is empty, still keep their own checks.
* fix(desktop): keep an unread reset and a cut text check undecided
after_reset stays undecided when any check was not read, even if another
check still fails and the unread result's boolean matches the seed. A
text check for a child past a truncated view is undecided in both
evaluators. A reset whose reply is lost blocks a near miss until a later
input or a reset whose reply arrives.
* fix(desktop): retry a witness recording and a published record's cleanup
A recording that fails to end or download is not written into the witness
folder, and a manifest already received is fetched again without ending
the recording twice. A folder that is published while its handles fail to
close keeps that record and retries the same cleanup instead of writing
the folder again.
* fix(desktop): keep a published witness error and tag an app data refusal
A second failure to close a published witness returns the original error,
so its record and cleanup lease stay bound. A reset the app itself
refuses is an AppDataRefusal; only a reply that is not that refusal stays
unsettled. A missing child of a cut view is undecided with the same
description in both evaluators, and the shared cases cover it.
* fix(desktop): align a cut view's missing text with the Python check
A missing child of a truncated view is undecided for the same sentence in both evaluators, including the pointer the view does not contain.
* fix(desktop): keep one published witness cleanup across retries
A published record and its bound cleanup error stay together. A later close failure returns that error, and the unused path that built a fresh adapter error is gone.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: morluto <morluto@users.noreply.github.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
* feat(environment): report what an environment serves with an environment-coverage view
A new inspect_analysis_view kind over capture Evidence. It projects the
state an environment derives with the given template rules and reports
each tool as answered from state, replayed with its view reason, a served
write, or a withheld write with its reason, the records behind it and a
hint about what to record next. The hints cover every write reason, so a
new reason without one fails to compile.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(environment): build an environment bundle in one command
rea environment-build <capture> [directory] inspects a HAR (or reads
capture Evidence), projects the environment manifest from the in-memory
Evidence, authenticates the pair, prepares the state and writes the bundle
environment-export writes. Every bundle file is byte-identical to the
three-step path for the same capture and options.
The report adds the capture and manifest identities, the coverage summary,
warnings (a loopback capture named after its file, credential-named body
members by pointer) and the next command. --dry-run writes nothing. The
default template rules are the four the published environments use.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(environment): cover environment-build and the coverage view
Domain tests check the hint table against the state view's reasons, the
summary, and the view against the environment-state view it summarizes.
Service tests build the fixture capture and compare every file with the
three-step path, a dry run, loopback naming and the refusals. A CLI test
compares a HAR built in one step with the three CLI steps byte for byte,
and an MCP test projects the view from every source kind.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(environment): build the real-agentenv lane's bundle with environment-build
The lane now runs the command users run: it builds the Grafana-shaped HAR
with environment-build and the packed checkout, checks the report, then
runs the bundle with agent-env as before.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(environment): document environment-build and the coverage view
The agent environments guide opens with the one-step build: the report,
the hint for each withheld write reason, and what a bundle ships. The CLI
guide, the capture guide and the skill reference name the command and the
environment-coverage view.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(environment): harden environment-build after review
- The credential scan walks with its own stack, so a deeply nested body
cannot crash the build, and it also reports credential-named header
names, query names, form body members and string arrays.
- The build checks SIGINT between stages: cancelled before the bundle
stage it writes nothing, during the write it names the written bundle.
- A dry run opens the package tarball, so it refuses what a build refuses.
- Repeated template rules are refused, a HAR saved as .json gets a hint,
file-derived names follow the bundle name rules, `localhost.` counts as
a loopback origin, and the next command is shell-quoted.
- --capture-timeout-ms passes through to the HAR inspection, and a
missing directory is refused before inspection.
- The no-observation hint covers updates and deletes of entities the state
never held; the coverage view states that it does not apply the
serve-time admission checks; the inspect_analysis_view description
names the view.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(environment): state the build's conditions and record its verification
The guides now state when the one-step bundle equals the three-step one,
which headers inspection excludes, what the credential warning scans, how
cancellation behaves, and that the coverage view does not apply the
serve-time admission checks. The spec folder records the census, the end
to end runs, the gates and the review.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(environment): dispatch a pending interrupt before each build stage check
The manifest, state and coverage stages run synchronously, so a SIGINT
that arrived during them was only dispatched once the bundle write had
begun. Each check now yields first, so an interrupt before the bundle
stage cancels the build with nothing written.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(browser): send declared requests from a scenario page with a request step
A capture_browser_scenario step `request` sends one declared HTTP request
through the page's own fetch, with its cookies and session, the way the
application's frontend would, and reads the whole response so the capture
records the transaction like any other. The path must resolve to the start
URL's origin, and the page must be on that origin when the step runs.
Query values and header values may be literals or declared secrets, and a
header may read its value from a cookie or a local storage entry, which is
then redacted from later records like a declared secret. `expected_status`
fails the step on any other status. Scenarios without a request step are
unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(browser): verify request steps in a real browser through to a built environment
verify:browser:request records a write session against a fixture item API
that refuses writes without its CSRF cookie header and stored bearer
token. It checks that every request lands in its own step, that the page
values authenticated each write and appear in no record, header or body,
that an unexpected status fails the step and cancels the rest, and that
environment-build serves the recorded create, update and delete.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(environment): export environment bundles over MCP
export_environment_bundle writes the bundle environment-build writes, from
capture Evidence retained in the session or one capture Evidence file,
into an absolute output directory that must not exist and whose parent
must exist, as extract_firmware and export_web_scripts require; it never
creates the parent or reuses a directory. It returns the same report,
whose schema now lives in the domain so the CLI and the tool share it, and
dry_run reports without writing. A loopback capture without a file needs a
name. The build's refusal messages no longer name CLI flags.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(environment): scan scenario credentials, own the dry-run tarball and serialize Evidence once
A browser scenario's retained header values and the query parameters of its recorded URLs are scanned for credential
names as a HAR's are, through a review projection of its records. A dry run admits and releases the package tarball
through the export's regular-file scope, so a close it cannot confirm keeps its owner, and checks for cancellation
after that last await. Evidence is written into one exactly sized buffer instead of chunks joined by a copy.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(environment): record the review round's checks
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(skill): build agent environments from a prompt with request steps and the bundle tool
Add the environments reference to the skill and install it with setup: record
against a disposable instance, sign in through the UI, write with request
steps and read each write back, check coverage, re-record by withheld reason
and export the bundle. Route it from SKILL.md, name agent environments in the
skill description, and document the request step, the export tool and
recording writes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor(browser): split the request lane and header resolution into smaller functions
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* style(environment): format the build spec
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(environment): say when an untimed capture learns no write clock
Coverage of a capture whose records are not all timed, which includes every
browser scenario capture, now states that the state learns no clock, so an
update stamped with a server-set modification time stays unexplained-change
however often it is recorded.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(skill): give agents a whole scenario shape with step timeouts
Agents guessed the scenario schema field by field and two hung on steps
without timeout_ms. The reference now starts from a complete scenario with a
timeout on every step, and says a scenario capture cannot serve updates the
application stamps with a modification time.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(browser): keep request steps on their origin and their page values redacted
- Follow no redirects: a redirect fails the step and nothing reaches the
location it names (checked in real Chrome), and check the page's origin
again in the page as the request is sent.
- Send nothing once the step's time has run out or it was cancelled while
header values were read; the in-page deadline is what remains of the step's.
- Keep every page value redacted under a repeated or colliding label, keep a
value's first marker when it is read again, and leave values shorter than
8 characters unredacted rather than rewriting ids, ports and hosts.
- Refuse a header name given twice, User-Agent (Chrome drops it) and line
breaks in literal values and prefixes; fail before sending when a secret or
page value holds them.
- Append query entries after the path's literal query without re-encoding it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(environment): document request step limits and word bundle refusals for both surfaces
Document redirects, timeouts, page value redaction, HttpOnly cookie sources
and header refusals for request steps. Refusals shared by environment-build
and export_environment_bundle no longer name CLI flags, and the retained
loopback refusal no longer prints an empty file name. The skill reference
asks for read-backs after each write, shows the coverage view's source, names
package_tarball for unreleased builds and the browser path a scenario ships.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(environment): scan every form occurrence and MIME-less scenario bodies
The build's credential scan collapsed form bodies with Object.fromEntries, so a
repeated field kept only its last occurrence: `api_key=secret&api_key=` warned
about nothing although the Evidence ships the value, and repeated values were
undercounted. Form fields are now scanned as ordered name/value pairs, as
headers and query strings already are.
The review projection of a capture_browser_scenario dropped a request body
recorded without a media type, so the scan never saw it. Review keeps such a
body's text with an empty media type; the manifest projection still reads only
bodies it can classify.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(browser): close request step edge cases from the second review
- Append query entries correctly after a path ending in "?", "&" or "#".
- Refuse 3xx expected statuses, which an unfollowed redirect can never
report, and say a redirected write may already have been applied.
- Redact a page value also as fetch sends it, without surrounding spaces
and tabs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(environment): document page value body costs, redirects and MCP dry runs
Document that reading a page value shrinks the bodies a capture keeps under
the default allocation limit, that redirected writes may have landed, that
the MCP dry_run still checks its output directory and which refusals name
the tool, and keep the .har hint in the HAR-as-JSON refusal for both
surfaces.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(environment): record the prompt-to-environment verification
Gates, the real-browser lanes, five environments built from prompts by an
agent on disposable VMs and evaluated with two models, and the two reviews.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(skill): count rollback failures from the managed skill files
The environments reference made the skill eight files, so the recovery tests now derive the counts they expect from
MANAGED_SKILL_FILES instead of fixing them at six and seven.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(adb): restore the portable Java float pattern a merge rewrote
A lint autofix during a merge unescaped the hyphens in javaFloatValuePattern, which is invalid in a v-mode character
class, so the advertised start_adb_activity schema failed to compile in every JS regex mode. The file now matches main.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(browser): show the request step inside a whole scenario
Every JSON example in the browser scenario guide is a capture_browser_scenario input the catalog test parses, so the
request step example now sits in a launch scenario instead of standing alone.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(environment): scan structured HAR form params and the request side of unattributed scenario transactions
A HAR request recorded with postData.params and no text is scanned by those parameters, each occurrence counting, and
the review projection keeps the request side of a scenario transaction whose response cannot be attributed, so the
credential warning covers what evidence.json ships in both cases.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(environment): validate build paths and read dry-run tarballs
* fix(environment): report bodies too large for the credential scan
Text bodies over the scan's 4 MiB limit, including a response decoded only as a prefix, are reported as a
credential-scan-incomplete warning by record and side, never by content, so an absent credential-named-members
warning no longer reads as a complete check. The spec and agent-environments guide also state the path validation and
dry-run tarball read that e52ae1cd added.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(verification): release cold source transform services
* fix(javascript): retain capture context along covered mutation paths
* fix(environment): guard request dispatch and report export limits
* fix(environment): admit serialized exports and scan HAR form fallbacks
* fix(environment): admit in-memory build inputs against heap headroom and scan SaveHar null-text forms
The inspected HAR's Evidence and the projected manifest are checked against live heap headroom before they are
serialized, with the same check the file route uses, so a capture too large to parse and seal is refused as
resource_constraint before anything is written. A request whose postData text is SaveHar's null is scanned by its
structured params.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(environment): measure the credential scan limit in UTF-8 bytes
A body counts against the 4 MiB limit by its UTF-8 length, not its UTF-16 code units, so multibyte text over the
limit is reported as unscanned instead of parsed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(browser): send request steps only before their deadline and keep page reads on the start origin
The page receives the step's absolute deadline and a one-second start window, so a busy page that runs the request
late, or after the step is cancelled, sends nothing; local storage is read only on the start origin; the response is
drained without keeping its body; an unparseable path is a field issue; retained Evidence is refused for heap headroom
before it is serialized; and the skill says how to reach server-assigned ids.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* style: format integrated export admission
* fix(javascript): erase inline type imports before binding values
* fix(browser): run the request lane under the shared verifier command owner
The browser request lane runs each CLI call through createPackageVerifierCommands on a private runtime root, so a
timeout, output overflow or failure stops the CLI and the browser it launched before the root is removed, and a failed
stop is reported with the root retained. The verification record states the lane's current counts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(environment): scan scenario content by event and read bodies by their media type
A browser scenario's credential scan reads every retained network-content event, including a response attached
mid-flight and a transaction no record represents, with event pointers, and each transaction URL's query once; the
review record projection it replaces is removed. A body is parsed as a form or as JSON by its recorded media type,
falling back to its shape, so valid forms such as `password=x&` are scanned and sentences are not read as forms.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
Tag physical read outcomes at the owning boundary and preserve opaque caller cancellation reasons through JSON pipelines and reference imports. Share named bounded-read options across consumers and retain failed cleanup ownership for retry.
Closes#5686
Route skill backup selection and verification through the shared recovery owner with the installer resource scope. Reuse verified snapshots without copying and remove duplicate selection and EEXIST handling.
Cover failed closes at first backup, recovery backup, and post-copy verification; block new descriptors while cleanup is pending and retain the exact owner through disposal retries. Related: #4592.
Validation: 158 focused tests and 511 adjacent setup tests passed; check:fast, docs:check and formatting passed. Close failures were injected on real file handles on macOS; native Windows/Linux faults were not reproduced.
Refs #4378, #4384, #4432, #4496, #4501.
Keep inaccessible MSIX targets unknown, preserve literal AppData roots, and distinguish absent skill destinations from retained files. Isolate registration tests from host provider discovery.
Windows package behavior was exercised through filesystem fixtures; the installed Windows Claude application was not verified.
Validate final selected skill roots and references before preview, approval,
and client/Hopper changes, with a repeated installation-boundary check.
Preserve interactive unselected-client choices and registration-only setup.
Share typed directory/read observations across setup, doctor, and update;
report unmanaged paths and unknown reads with actionable paths/reasons.
Retain uninstall child outcomes and ownership manifests when cleanup remains.
Shared single-pass inspection retains all unreadable paths after stale or
missing files and keeps observed metadata, without duplicate manifest reads.
Absent installed files do not depend on generated bundled bytes.
Validation: 217 related tests, 41 final CLI/MCP and filesystem checks, and all
7,446 source tests in 508 files pass (eight platform/condition skips).
Static/docs checks pass. Normal four-call
install/rerun/repair/uninstall tasks preserve results and output token counts.
No native Windows follow-up or arbitrary concurrent swap containment claim.
Fixes#3057.
Co-authored-by: geekwolf <3125615+geekwolf@users.noreply.github.com>
Co-authored-by: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: akushonkamen <74654766+akushonkamen@users.noreply.github.com>
* fix(host): separate REA host support from Hopper installer targets
LinuxDistribution.supported carried two meanings at once: that the host runs
REA, and that the automated Hopper installer is tested on it. The doctor read
the first meaning from the second, so Debian-derived hosts such as Kali
reported unsupported_host while their providers worked normally.
Rename the field to hopperSetupSupported, which only the Hopper installer and
setup planning consume, and derive host support from the package family
through supportsReaHost(). Any distribution with a recognized apt, dnf, or
pacman family is now a REA host. The tested Hopper installer list is
unchanged, so Debian and Kali keep falling back to configuring an existing
provider instead of downloading an untested package.
Verified on Kali 2026.3 (Debian testing, x86_64): rea doctor reports a healthy
environment with Ghidra 12.1.4, and analyze_function decompiles an x86_64 ELF
through the MCP server. npm run check, npm run docs:check, and the application
and Ghidra suites pass. No Hopper or IDA host workflow was exercised.
* fix(setup): stop skill checks after first drift
---------
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
Thread the existing resource scope through skill and client configuration reads. Keep failed-close handles owned, wait for admitted reads, and surface unresolved cleanup alongside doctor, uninstall and update results.
Validated focused setup/doctor/update and filesystem boundary checks, temporary-file hygiene, packaged setup/update/uninstall workflows, and static checks. No external provider installation was performed.
Track attempted writes, preserve original content and modes from one regular-file observation, and continue rollback after individual failures. Return tagged failure details and retained backup paths through setup.
Validation: setup filesystem and recovery tests, combined compile/typecheck/lint/format/metadata/architecture checks. Filesystem fault injection covers backup, ambiguous publication, and rollback failures.
Guide task-centered recovery from observed client, registration, PATH and
provider blockers. Install the recovery reference, document exact JavaScript
module selectors, and require clarification before searching for an unnamed
app. Validate public setup in isolated Codex accounts and preserve failed
or unrecognized tool outcomes in the existing evaluator.
Refs: #1587
BREAKING CHANGE: Optional verify:agent reports now use schemaVersion 4.
Consumers must accept expectedFirstTool: null and targetClarificationPassed
for missing-target scenarios. Production CLI/MCP contracts are unchanged.
* feat: add Hermes as a supported MCP client
Hermes Agent reads stdio MCP servers from `mcp_servers.<name>` in
`config.yaml`. REA had no Hermes client, so setup could not register it and
Hermes users had to wire the server up by hand.
- SupportedClients: add the `hermes` format and client definition, resolving
the config path from HERMES_HOME, else the platform default that Hermes's own
resolver uses (LOCALAPPDATA/hermes on Windows, ~/.hermes elsewhere), including
HERMES_DATA_DIR_SUFFIX.
- ClientConfigurationDocument: parse and serialize Hermes YAML, upserting the
rea entry into the parsed document so user comments and unrelated settings are
preserved; emit `enabled: true` since Hermes connects entries unless disabled.
- ClientRegistrationStatus: forward the Hermes location variables so status
checks resolve the same path as setup.
- Tests: cover path resolution on both platforms and the register/read/uninstall
round trip, and clear the Hermes location variables between tests.
- delilah 🌸
* docs: document the Hermes client and its config path
- delilah 🌸
* refactor(setup): resolve skill destinations per client
* fix(setup): install Hermes skills in the active profile
* fix(setup): identify each client skill action uniquely
---------
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
* refactor(domain): split error taxonomy into thematic modules
Move each error family out of domain/errors.ts into its own module
(base, core, provider selection/adapter, browser observation,
artifact, evidence, unknown registry, hopper, configuration) and
relocate AnalysisErrorProjection to analysisErrorProjection.
Migrate all 162 importers to the owning modules and delete
errors.ts. No re-export shims; behavior is unchanged.
* refactor(runtime): name all silent catch causes without changing diagnostics
Bind cause in every bare catch and unhandled rejection across src/.
Real failures preserve the cause for logging; best-effort cleanup
carries an explicit comment. Caller-visible and Evidence strings are
byte-identical to before.
* fix(hopper): report unavailable procedure body coverage
* refactor!: simplify runtime tools and remove replay engines
Keep direct inspection, capture, and comparison tools. Bind handlers to named contracts and let agents compose experiments with commands and local fixture servers.
BREAKING CHANGE: Remove controlled replay, Node characterization, finite replay-machine, managed runtime planning, and redundant string-tracing tools. Retire process replay, shims, reactive scenarios, custom checkpoints, and active browser replay and origin-scope inputs.
morluto