trace_web_source_location reported a well-formed generated_position past
the end of the selected script as invalid_format on generated_position,
with no bounds, so callers were told their input was malformed and not
which coordinate to change. Report out_of_range on the line or column
that is past the end, with its valid bounds, as export_web_scripts and
inspect_web_network_capture now do for their selections.
The position scan now returns the bound it ran past, so the offset and
the reported limit come from one pass and cannot disagree on line
terminators.
Fixes#7132
* fix(gdb): keep TTY verification across read-only inferior-tty inspection
The console command path cleared `inferiorTtyVerified` before dispatching
any command whose text merely mentioned `inferior-tty`, so the read-only
`show inferior-tty` query permanently revoked a persistent session's
verified output sink; no in-session path ever restored the flag, and a
later close of a live session failed detach verification with
capability_unavailable.
Exempt the exact read-only query forms (`show inferior-tty` and the MI
`-inferior-tty-show`) from the output-mutation predicate; every other
command mentioning the TTY setting keeps revoking, so mutating commands
still fail closed and detach keeps re-reading the live TTY before
detaching. Cover the query forms, composite commands, and the
inspect-then-close detach path with regression tests.
Fixes#5099
* test(gdb): classify show inferior-tty in the one-shot table and rename the TTY classification table
- Add a 'show inferior-tty' row to the 'classifies one-shot GDB
commands' table: the read-only query no longer invalidates the detach
proof, a user-visible one-shot behavior change.
- Rename the 'classifies read-only inferior TTY queries as non-mutating'
table to 'classifies inferior TTY commands' since two of its rows are
mutation cases.
- Assert via the existing recorded-commands array that the inspected
'show inferior-tty' text is actually dispatched, and add an
execute-path assertion that the MI '-inferior-tty-show' form leaves
the verified-sink flag intact (defensive exemption: REA's own MI calls
do not route through this gate).
---------
Co-authored-by: akushonkamen <akushonkamen@users.noreply.github.com>
* fix(jeb): reconnect after stale MCP sessions
* fix(jeb): preserve failures for overlapping MCP requests
* fix(jeb): make cleanup operations explicit and stabilize timeout fixtures
* fix(decompile): retain inventory limitations with the latest selection
The manifest and decompile index dropped procedure-inventory
limitations, so a directory separated from its Evidence response could
not explain why functions were selected or omitted. Keep those
limitations on the manifest and in a latest_run index record that also
names the filter and counts that produced them. Older runs remain
represented only by their retained function records.
Fixes#8355
* test(decompile): surface export errors and check function caveats
Address review findings on the inventory-limitation regression:
- Throw the typed export error instead of returning from a failed Result.
- Assert historical function records keep their own pseudocode caveats
and do not receive the latest inventory warnings.
* fix(artifacts): own source errors during output setup
* fix(artifacts): join silent source destruction before returning
* fix(artifacts): retain source cleanup failures with primary errors
* fix(artifacts): join source finalization and classify secondary failures
* fix(firmware): separate source cleanup from output rollback
* fix(artifacts): retain live source cleanup dependencies
* fix(artifacts): preserve source failure completion and semantics
* fix(artifacts): retain scope cleanup owners and typed failures
* fix(artifacts): keep cleanup classification and admission recovery
When the operation completed and only scope cleanup failed, keep the cleanup failure's own reason instead of reporting io, matching main (fixes artifactProvider.cleanupRetry). When a typed primary is rebuilt with pending scope cleanup, carry its userMessage and ASAR header admission so callers keep the configured ceiling and setting.
* fix(artifacts): translate plain file-close failures through the reader path
The outer file-cleanup branch rebuilt every ArtifactFileCleanupFailure as a
ProviderAdapterError, so dyld reads lost their io, unavailable, format and
cancelled reasons and their exact file-cleanup cause. Compose separately only
when the failed primary owns its own translation (a domain error, source
failure or scope cleanup failure); raw and reader primaries are already
projected by the file failure with its exact lease.
* fix(artifacts): bound source destruction by cancellation and keep wrapper admission
After cancellation, SafeOutputTree.write could wait indefinitely for a source
whose destruction did not settle, both in the destroy join and in the
iterator's wait for close. Both waits now end at cancellation plus a fixed 1 s
grace, modeled on the process-output closure grace. A destruction that
outlives it is reported as incomplete source cleanup under an exact lease that
releases only once closure is observed without a late error.
ArtifactResourceCleanupFailure and SafeOutputSourceFailure now keep the
primary's admission, matching withCleanup.
* fix(artifacts): keep one settled wait while observing a stuck source
observeClosure raced the same pending close promise against a new timer every
10 ms, so a source whose destruction never settled accumulated one reaction per
poll for as long as it stayed open. Each poll now waits on its own promise that
the close listener or the unref'd timer settles, leaving one pending wait and
one close listener. The lifecycle test also asserts that a late close releases
the retained owner without an explicit retry.
* fix(artifacts): settle pending reads before cancellation
* test(artifacts): observe the consumed ZIP iterator on cancellation
* test(artifacts): validate projected cleanup resources before sorting
* test(mcp): reserve parent capacity for timeout recovery
* fix(artifacts): contain ASAR cancellation before output consumption
* test(artifacts): hash ASAR cancellation fixture bytes
* fix(uninstall): keep a managed cache namespace whole when it holds a caller-selected Kuna cache
purge --purge-data reported a REA_KUNA_CACHE_DIR selection below the default Kuna cache as retained, then removed it together with its parent namespace. A namespace that contains the selection is now retained and reported, so the retained report is true.
Fixes#7344
* fix(uninstall): also keep a namespace equal to, or reached by symlink traversal from, the selected Kuna cache
Compare the namespace and the selection with the same normalization, treat an equal path as contained, and resolve existing paths before planning so a symbolic link followed by .. is judged by where it leads.
* fix(uninstall): judge a selection with parent traversal where the filesystem resolves it
Collapsing .. lexically contradicts the existing rule that parent traversal after a symbolic link leads elsewhere, and broke the retained-through-symlink-traversal test. Compare spellings without .. directly and resolve existing paths for the rest, so the symlink-parent case still purges the default cache while a selection that resolves into a managed namespace is retained.
* fix(uninstall): keep a namespace whole when the selection's location is unknown
A realpath failure other than ENOENT/ENOTDIR (for example EACCES under an
inaccessible parent) no longer counts as "absent". Each namespace that may
contain the caller-selected Kuna cache is retained instead of purged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(adb): name unexecutable adb paths in readiness refusals
When REA_ADB_PATH or the PATH-resolved adb is a directory or a file the
host refuses to execute, the version probe fails at spawn with EACCES or
EPERM. That fell through to the generic "did not report a usable version"
refusal, which named neither the path nor the cause.
Classify those spawn errors as binary_not_executable (provider rejection
executable_missing), name the selected path and errno, and give
remediation for the environment, PATH and host-policy cases. The generic
fallback now names the selected path too.
Fixes#5689
* fix(process): admit synchronous spawn errors as captured failures
Node throws spawn errors other than EACCES, EAGAIN, EMFILE, ENFILE and
ENOENT synchronously from execFile. execFileBytes called execFile inside
its Promise executor, so ENOTDIR or EPERM became a rejection without
capture fields and execFileOutputFailure returned undefined. Consumers
that classify by failure code, such as the adb version probe, could not
see the code, which left the adb EPERM branch unreachable.
Catch synchronous spawn errno errors at the capture boundary and attach
the same empty capture an asynchronous spawn failure carries. Argument
validation errors stay unadmitted.
The adb version probe now reports an ENOTDIR selected path, such as a
REA_ADB_PATH whose parent is a regular file, as a missing binary with
the filesystem error code instead of the generic version refusal.
* fix(process): expose spawn failures from the capture owner
execFileBytes knows when a command never started, but
ExecFileOutputFailure did not say so, so consumers reread raw syscall
and code fields and disagreed. Mark both the synchronous throw and an
asynchronous `spawn <path>` error with `spawnFailed: true`, and set
`path` on the synchronous error to match the asynchronous shape.
Argument validation errors stay unadmitted.
Consumers now use the owner field:
- inspectAdbClient never reports a spawn errno as `exit_code`. ENOENT,
ENOTDIR, ELOOP and ENAMETOOLONG are `binary_missing`; EACCES and EPERM
stay `binary_not_executable`; any other spawn errno, such as EINVAL,
is `binary_not_executable` with a path-naming "could not be started"
message. Each records `filesystem_error` and `path_source`. EACCES
remediation also names parent directory search permission, and EPERM
remediation no longer names host policy as the only cause.
- DarwinProcessRunTokenReader tags every not-started compiler as
`spawn_failed`, not only ENOENT. EACCES, EPERM and ENOTDIR were
previously `failed`.
- NativeDmgArtifactReader uses one not-started rule for both
`processNotStarted` (previously `spawn ` only, so synchronous errors
were missed) and the ENOENT unavailable/io split (previously any
`spawn` prefix). Its fake hosts now reject with real execFileOutput
spawn failures.
* fix(process): classify spawn failures consistently across consumers
Admit synchronous and asynchronous spawn errnos through one helper that
requires an errno and a `spawn` or `spawn <path>` syscall. The
synchronous shape now also gains `spawnargs`, so both shapes match.
Use the owner's `spawnFailed` fact in the remaining consumers:
- inspectAdbClient reports exhausted host capacity (EAGAIN, EMFILE,
ENFILE, ENOMEM) as a host failure to retry and no longer tells the
caller to change REA_ADB_PATH. Path-resolution errnos come from a
predicate the filesystem owner exports.
- runAdbCapture says adb could not be started instead of claiming an
exit code for a process that never ran.
- The Darwin compiler probe words every spawn_failed outcome as a start
failure, not a compilation failure.
- Asset catalog inspection treats any assetutil that never started as
unavailable, not only ENOENT.
* fix(process): report host spawn capacity as a retryable constraint
Spawn errnos that report exhausted host capacity (EAGAIN, EMFILE, ENFILE,
ENOMEM) were classified by adb readiness alone. assetutil reported them as
an unavailable tool, which marked inspect_asset_catalog unavailable in the
session, and adb commands reported them as protocol failures.
Classify them once in the process capture owner and report a retryable
capacity constraint with recovery advice from assetutil and adb commands.
* docs(adb): describe host capacity failures from device operations
* fix(adb): report exhausted host spawn capacity as runtime unavailability
A host that cannot start adb for lack of process, memory or descriptor
capacity is not a configuration problem. Give it its own failure code and
map it to the runtime_unavailable provider rejection instead of
not_configured.
* fix(adb): report probe-time host capacity as a retryable constraint
A device operation whose adb version probe could not start for lack of host
capacity was refused as capability_unavailable without retryable. It now
reports the same retryable capacity constraint as a later adb command.
* fix(adb): keep the selected adb path in probe-time capacity errors
The retryable capacity constraint raised at the version probe dropped the
selected_binary and path_source diagnostics the refusal used to carry.
* refactor(adb): keep the spawn-failure fact to adb consumers
Restore the DMG reader, Darwin compiler probe and assetutil to main. The
capture owner still marks a never-started command, including the spawn
errors Node throws synchronously, and only the adb readiness probe and
adb commands read that fact.
* test(adb): assert spawn-failure facts instead of refusal wording
The new adb tests compared complete refusal sentences and banned an old
phrase. They now check the errno, selected path, path source and the
owner's spawn-failure marker, so wording edits do not break them.
* fix(adb): own one host-capacity remediation and cover the spawn route
The host-capacity constraint and the configuration failure each carried their own remediation sentence. AdbConfiguration now owns the text and both use it, so the constraint's remediation.action equals diagnostics.remediation.
The synchronous spawn-throw test now runs on Node's execFile route and on the owned spawn route adb uses (stopSignal). The provider test covers inspect_adb_client under EMFILE next to list_adb_devices, and the docs say which operations report the retryable capacity constraint and which report runtime_unavailable.
* fix(process): report EMFILE and ENFILE spawn failures without stdio
After an EMFILE or ENFILE spawn failure Node creates no stdio, so the
owned stop-signal route threw a TypeError while reading the streams and
the later spawn error went unhandled. Attach the error listener first and
capture absent streams as empty, so adb reports retryable host capacity.
* fix(adb): keep a completed push when host capacity stops its digest check
A capacity failure starting sha256sum came back as a retryable error even
though adb push had already written the file. Repeating the request with
overwrite=false is then refused because the destination exists.
Return the receipt with an unavailable device digest and name the capacity
failure in its limitations, so the caller is told the transfer is unverified
rather than advised to retry.
* docs(adb): list host capacity as an unverified push case
---------
Co-authored-by: t <t@t>
* fix(cli): parse environment-serve --port and --host like rea mcp --http
environment-serve declared --port as a number, so incur coerced the flag text with Number(): an empty --port= bound an ephemeral port instead of failing, and 0x1F90 or 1e3 were reinterpreted. --host accepted whitespace. docs/cli.md says these flags resolve like rea mcp --http, which accepts only decimal port text and a non-empty trimmed host. The flags now use the same rules and are refused before binding.
* refactor(cli): reuse the shared MCP listener port and host schemas
* fix(setup): replace the fixed Hopper download deadline with a stall timeout
Hopper package downloads aborted after a fixed 120 s, which was also the
largest deadline the download owner accepted. The current 32 MB Linux
package needs about 132 s at the reporter's sustained 245 KB/s, so setup
could never finish on that connection, and the timeout surfaced only as
Node's generic abort message.
Abort a download when no response bytes arrive for 30 s, or when it
outlives a 15-minute overall bound, with a tagged
HopperDownloadTimeoutError that names the URL, the limit reached and the
bytes received. Linux and macOS setup already relay a thrown download
error's message; the Linux publisher now keeps it for release metadata
and public key fetches instead of a generic verification failure.
Metadata and key fetches keep their 10 s bound.
Refs #7077
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(setup): keep the macOS release feed on the metadata limit
The stall-timeout change left the macOS release feed fetch on the
package download bounds. That fetch could then wait up to 15 minutes
instead of the 120 s it had, while the installation guide says release
metadata keeps a 10 s limit. Only the Linux publisher owned that limit.
Move the 10 s metadata limit into HopperDownload.ts beside the package
bounds. The Linux feed and key fetches use it, and the macOS installer
now passes it for its feed fetch through the installer host.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(environment): retain ID ordering with missing clocks
* fix(environment): compare known creation clocks across gaps
---------
Co-authored-by: hhang <169027046+xu91102@users.noreply.github.com>
* feat(desktop): capture a Linux desktop application in use
Add `capture-desktop-application`, a CLI-only, Linux and X11 capture that
launches an installed desktop application, watches it while it is used and
writes capture Evidence plus SHA-256 addressed content:
- inventory: desktop entry, launch command, executable, package and its
apt sources (or snap, flatpak, AppImage), Electron markers and candidate
state directories;
- session: the launched process tree, client windows from xprop with the
first application window time and a window match, and files held open;
- state: a stat walk of the home directory before launch, at checkpoints
read from stdin, at stop and after exit, with created, modified, deleted
and retyped paths and the content of changed files and state directories.
It refuses non-Linux hosts, missing DISPLAY or xprop, a non-empty output
folder and an application whose window is already open, and signals only
processes it started.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): own launched processes, confirm walk coverage and keep cancelled captures
- Launch through the owned provider path with a run token; release with
SIGTERM, then the token-verified group cleanup, after every session.
Processes without the token are never signalled; each records whether it
carries it, and the session records whether cleanup was verified.
- Report creations and deletions only where a walk listed the nearest
existing directory; count the rest as unconfirmed.
- Retain a file only when it is still the walked version, through owned
no-follow reads; charge the budget only for new content; create files
exclusively in a private output folder owned by the caller.
- Walk content roots outside the home directory, compare paths in their
physical spelling, and run executables from the caller's directory.
- Refuse when the window list cannot be read, re-evaluate window ownership
each sample, handle one queued request per sample with a bounded stdin
queue, and write the capture with end reason `cancelled` on interruption.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep owned cleanup failures and fresh digests
- Allow a capture cancelled before any requested checkpoint to hold only the
baseline.
- Retry an incomplete stop once; if cleanup is still unverified, write the
capture and fail with the run token and process group as cleanup
resources.
- Classify path changes after a walk (ENOTDIR and other selected-file
errors) as changed_since_walk instead of failing the capture.
- Treat a non-directory ancestor as proof that nothing existed beneath it.
- Report a before digest only for the file version it was read from.
- Derive stderr_truncated from stderr's own byte counts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* wip(desktop): state view over a capture folder
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep failed file-handle closes owned for retry
Content reads pass retainFailedClose, so a handle whose close fails stays
owned by the content store; the capture retries those closes after it is
written and fails with the output folder as the cleanup resource if one
still cannot be closed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(desktop): read a captured application's state
Add inspect-desktop-application-state, a CLI command that reads a capture
folder into the application's state: every retained or changed file with
its role and reasons, a typed JSON view of each version (SQLite through the
shared worker, dconf through a private dconf dump, JSON, XML, key files,
text) and the kinds of change between versions (lines, values, keys, rows).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): report process and handle cleanup failures together
When both the launched processes and a retained file's handle remain
unresolved after the capture is written, one cleanup error now lists both
reasons and both resource sets.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(desktop): export a captured application as an agentenv computer app
Add export-desktop-application, which writes an agentenv bundle with one
computer_app environment from a capture folder and its state view: the
apt package, a boot launch matched on the captured window class with a
window ready check, owned paths from the state roles, a seed of the
baseline files, data hooks that call agentenv's add/get/reset helpers
with a typed JSON view on get, a skill, a README and a deploy smoke task.
The desktop CLI commands now load their services lazily.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep state views faithful to the capture
- Read key files, XML attributes, dconf groups and SQLite tables into
dictionaries without inherited properties, so captured keys such as
__proto__ stay data.
- Version databases with their write-ahead log as of each checkpoint, and
stage only digest-verified bytes for the SQLite and dconf readers.
- Detect the format per version, report format changes, keep JSON null and
empty containers as values, keep XML text and preserved whitespace, and
mark truncated views (including XML depth) and comparisons of them.
- Number versions and changes by checkpoint index, decide baseline
presence from the captured type, and keep tagged SQLite integers, text
bytes and blobs distinct.
- Carry the capture's limitations and omitted content forward, match state
directories by their home path, index changes once per capture, keep
failed handle closes owned, and finish the CLI through the shared owner.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep coverage, logs and handles honest in the state view
- Read coverage flags only from formats whose readers write them, so JSON
fields named truncated stay data.
- Fail a SQLite version whose write-ahead log existed but was not retained
or does not match its digest, instead of reading the database alone.
- Close retained content on every exit, including cancellation, and report
a close that still fails together with the primary failure.
- Finish the CLI with the canonical operation name.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): export only what the computer can install and seed
- Refuse packages not from the Ubuntu 24.04 archive, since the computer
installs by name from that archive.
- Start the launch command in the captured working directory.
- Respell the home path only in files the state view read as text.
- Report files that were not retained instead of dropping them silently.
- Load captured dconf keys for apps that own no files.
- Keep home-level files as owned paths; rename reserved Python class names.
- Mark truncated SQLite and text views in the class's get view, and read
file types the way the state view does.
- Release the output tree through a resource scope, and read seeds through
an owner closed on every exit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep staged folders owned, symlinked state roots and XML values
- Stage database bytes in a private runtime root released through a
resource scope, so a failed removal keeps its owner and is reported with
the read's outcome.
- Report cleanup facts and owners from desktop failures instead of
wrapping them as a plain adapter error.
- Record the state directories as walked, in their physical spelling, and
match roles against both spellings, so files in a symlinked state
directory are not mistaken for selected documents.
- Keep whitespace-only XML leaf values; drop only formatting between
elements.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): read XML in the exported app the way the state view does
Keep whitespace-only leaf values and xml:space="preserve" text in the
generated get view; drop only formatting between elements.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): release retained handles with their owners, read older captures
- Release retained-content handles whose close failed through a resource
scope on every exit; a release that fails again reports the exact handle
owners. A read that finished keeps its bytes when only its close failed.
- Accept captures written before state directories were recorded, and say
in the state view's limitations that symlinked state directories may be
misclassed for them.
- Compute each XML element's whitespace context once instead of scanning
siblings for every text run.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): boot without the working folder, bound XML, accept mirrors
- Try the captured working directory only when an argument is relative,
and start the app even when that folder is missing.
- Cut the generated XML view at REA's node and depth limits, and keep one
unreadable file from failing data/get.
- Accept Ubuntu 24.04 mirrors, not only the canonical hosts; PPAs and
other repositories are still refused.
- Read seeds through the retained-content owner's new signature.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): state view review round
- Stage a retained -journal beside its database so the SQLite worker
accepts an inactive journal and refuses a hot one; a -wal or -journal
that existed but was not retained (including one omitted at the
baseline) makes the version unreadable.
- Keep tables that read when another fails, and let cancellation and
unfinished cleanup propagate instead of becoming view errors.
- Read text as a key file only when every line parses as one.
- Rank a file named in a window title or selected by the caller as a
document even when the application holds it open; match titles on
file-name boundaries; leave the display name out of dconf matching.
- Bound JSON and key file views (4 MiB, 500 levels, exact numbers) and
report too-large, missing and altered retained content separately.
- Add no version or change while a database stays absent.
- Read staged databases in place instead of copying them again.
- Give Evidence the same limitations as the result.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): export review round
- Load captured dconf keys without D-Bus: install dconf-cli, compile the
existing and captured key files into the user database, and warn on
failure instead of stopping the server.
- Start relative-argument launches in the captured working directory,
the home included, since the framework launches from the app folder;
respell the home itself and option values under it.
- Read views in a thread, skip files over 64 MiB, align the generated
readers with the state view's, and close SQLite connections.
- Never own the home or a shared base folder; map a symlinked state
directory's files back to their home spelling.
- Report omitted files and unretained opened folders.
- Name the module so it cannot shadow another, and keep the class off
the module's own names; derive names the bundle check accepts.
- Write seeds as they are read, and remove an unpublished bundle on
failure.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): capture review round
- Ask the launch process group and token carriers to exit before
killing them, on errors too; report incomplete cleanup with its facts.
- Count descendants of the launch as started by the capture even when
their environment cannot be read; treat a reused pid as a new process.
- Follow symlinked desktop entries; name a flatpak's state after its
application id; match flatpak windows by name only.
- Stop on end of input; refuse empty, duplicate and reserved checkpoint
names; require whitespace after the checkpoint keyword.
- Stay on each walk root's device, and never walk or retain `/` or a
directory containing the home; say so in the limitations.
- Refuse a window manager that does not publish _NET_CLIENT_LIST.
- Remove retained content when a capture fails before it is written.
- Skip reading a file larger than the remaining content budget.
- Record apt's archive origin for each package source.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): read an unset client list as no windows when supported
xfwm4 leaves _NET_CLIENT_LIST unset while it manages no windows, so the
capture refused an ordinary desktop with nothing open. Read
_NET_SUPPORTED with the list: an unset list means no windows when the
window manager supports it, and the capture is refused only when it
does not. `xprop`'s "no such atom" output now reads as unset too.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): accept packages by apt's archive origin
Accept a package source when apt reports its origin as Ubuntu for a
noble suite, so mirrors count and PPAs or other repositories that merely
have "ubuntu" in their URL do not. Captures made before origins were
recorded fall back to Canonical's own archive hosts. Seed reads report
why retained content could not be used.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(desktop): capture and export apps from vendor apt repositories
A closed-source app installed from its vendor's apt repository, such as
Typora, can now be captured and exported as a computer app.
- The capture records each non-Ubuntu repository listing the installed
version (uri, suite, components from apt's sources files, one-line or
deb822) and the key that signs it: the signed-by key, or the trusted
key that gpgv shows verifies the repository's signed index. The key
is retained with the capture.
- The capture records the packages owning the libraries the executable
loads (DT_NEEDED with RUNPATH and the linker cache, through REA's ELF
readers), since a vendor package may not depend on them.
- The export declares a verified vendor repository as an AptSource with
its key, installs a vendor package's library packages, and adds
--no-sandbox to an Electron app's launch, since a container denies
Chromium's sandbox.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): report a locked database at once in data/get
A database the running app holds locked made each data/get wait sqlite's
five-second busy timeout before reporting it. Record the Typora run in an
agentenv computer in the verification.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf(desktop): detect key files without splitting the whole text
Read lines one at a time and stop at the first that a key file view
would drop, instead of splitting a file of up to 64 MiB into arrays
before its format is known.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep symlinked homes and state folders under the home in exports
- Respell a path under its state folder's logical spelling only when that
spelling is under the captured home, so a symlinked HOME keeps its
files; pair walked and logical state folders only when the capture
lists the same number, and match the innermost folder first.
- When two files map to one home path, keep the one present before the
capture and name the other in the limitations.
- Read key files in the generated data/get with the state view's rule,
checked against it by running the helper under python3.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): end captures on zombies and keep cleanup owners
- A zombie or dead process no longer keeps the session open.
- Remove only the partial capture file this run created.
- Keep the exact owners of handles and processes whose cleanup failed on
the returned error, so a retry can release them; test the published
capture's cleanup-failure branch with mixed outcomes and retries.
- Release the application once even when the exit checkpoint fails.
- A cancellation before the capture is written removes what it retained.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): vendor package review round
- Match apt sources through `apt-get indextargets`, which covers flat `./`
and `/` suites and gives each release file and sources entry.
- Accept a key whose signature verifies even when the release carries
another signature without a key here; keep only the verifying key from
a keyring holding several (OpenPGP packet splitter).
- Install the package from its repository's release (`name/<release>`),
declare one source per URI and suite, support only the capture host's
architecture, and refuse Ubuntu Pro repositories.
- List only library packages the computer can install; walk libraries only
for vendor installs, with RPATH inherited as ld.so does, normalized
paths, and DT_NEEDED bounded while reading.
- Put --no-sandbox after the program an env wrapper launches; keep the
gpgv folder's owner when its removal fails; respect --max-file-bytes for
keys; wait 0.25 s on a busy SQLite database in data/get.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(desktop): keep the vendor spec's gpgv command on one line
A code span broken across lines left `<binary keyring>` for VitePress to
read as an unclosed HTML tag, so the docs build failed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(desktop): add a validated task to exported desktop applications
Each capture can now yield one agentenv task in its exported bundle. An
agent writes the task (a prompt plus declarative checks over the app's
data/get views); REA validates it and stays model-free.
- `describe-desktop-application-task` summarises a capture's net change
per file (role, format, views before and after) and drafts checks.
- Checks: file presence, lines present/absent/counted, JSON-pointer values,
SQLite rows and counts. REA keeps a task only if a check fails on the
seed and every check passes on the captured end state; a file that was
not retained at the baseline counts as absent, as the computer starts.
- `export-desktop-application --task` writes tasks/NAME.json (deploy,
agent, skills, recording, prompt, verifier), a compiled verify.py that
reads data/get, and an eval. A boundary test runs the verifier under
python3 and checks it agrees with REA's evaluator on every check kind.
- Docs, spec and skill guidance, with the solve-rate recipe.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(desktop): keep the seed test in its own block
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(desktop): record the task verifier driven in an agentenv computer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(desktop): record the Typora task run in an agentenv computer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep task checks bounded, complete and attributable
- line_count counts lines holding a substring (contains) instead of
matching a regular expression, which could stall the verifier on
agent-written text and read differently in Python.
- value_equals of a whole object or array is undecided on a truncated
view.
- The draft keeps a database whose rows changed under an unchanged hash,
and a file whose truncated views match while it changed.
- A task file that cannot be read keeps the reader's detail, and a failed
cleanup keeps the read failure as its primary.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): leave a file with one version out of the task draft
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(desktop): update the task verification's test counts
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(desktop): record the task solve rate with Claude Code and Sonnet 5.5
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(desktop): capture and export apps installed from a downloaded .deb
capture-desktop-application --package-file reads the file's control fields
with dpkg-deb and records its SHA-256, size and dependencies when it holds the
installed package; the file itself is never kept. The library walk now also
runs for local installs.
export-desktop-application --package-url declares agentenv's
Download(url, sha256) for that file, its dependencies and library packages as
apt packages, and a run script that installs it with dpkg.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): seed app-named dotfiles and respell UTF-16 seeds
The capture now treats dotfiles in the home named after the application
(.varicad-cfg.ini, .notesrc) as state roots, so a file the app only reads
during the capture is still seeded. The exported seeding respells the
captured home in UTF-16 text files with a byte-order mark, keeping the mark.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): hold readiness until the app's own window shows
An exported app is ready only once a window of its class that the taskbar
lists is shown, so a splash screen of the class, which skips the taskbar, no
longer counts as the app being up.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(desktop): record VariCAD captured, exported and run in an agentenv computer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep exported views strict JSON for infinite and inexact numbers
The exported data/get spells infinite and negative-zero SQLite reals as REA's
SQLite reader does ("Infinity", "-Infinity", "-0"), and refuses a JSON file
holding a number that reading would change (1e999, integers past 2^53, -0,
rounded fractions) with the state view's own error, instead of a view with
an infinity in it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep package-file facts tied to one file and URLs unechoed
- A --package-url refusal never repeats the URL, and credentials are checked
before the scheme.
- The package file's identity must hold between dpkg-deb's read and the hash.
- A failed close keeps its cleanup owner even when the capture is cancelled.
- Readiness also ignores windows typed as splash screens.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): record database logs and keep state changes distinct
- A selected path that is not a directory brings its -wal and -journal as
content roots, so the capture records whether they exist and retains them.
- The state view treats a file as absent only under recorded content roots
and refuses a database whose log presence is unknown.
- JSON changes list containers too, so an array that becomes an object with
the same members is a change.
- Key file entries escape the key as a JSON pointer segment, so [a/b] c and
[a] b/c stay apart.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep watching through unread samples and late workers
- An unreadable window list is unknown, not zero windows, and is named in
the limitations.
- Before ending the session, live run-token carriers no parent link reached
are tracked; an unreadable process table leaves the exit unknown.
- An env prefix's assignments find the program and name its XDG folders.
- flatpak run options that take a value are skipped with it, -- is honoured
and a /arch/branch suffix is dropped from the id.
- State directories include the entry's full id.
- Path options refuse empty values; roots count toward the entry limit.
- A capture file whose close failed stays owned and is retried on discard.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): bound apt sources, keep older captures and cleanup owners
- Sources files parse into one stanza per line or deb822 paragraph with its
URIs and suites kept as lists, so no URI x suite product is built.
- Repository architectures and release are optional, so captures written
before they were recorded parse; the export treats them as unrestricted
and unknown.
- Library sources are matched against every index of a declared
repository's URI, suite and components.
- Two failures side by side keep both causes and both cleanup owners, and a
host file whose close fails reports a lease on its handle.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): match escaped key file entries and suggest containers through members
- The draft's key file lookup uses the state view's escaped `group/key`, so a
key holding `/` or `~` still gets its suggestion.
- JSON and XML changes now list containers too; the draft suggests an added
or removed container through its listed members, and a container only
when none of its members is listed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): read relative PATH entries from the launch folder
A program, or an empty or relative PATH entry, is resolved from the folder the
program starts in, as the launch does, so `env PATH=. app` with the entry's
Path still finds the app.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf(desktop): compare JSON views on one shared path
JSON and XML changes are found by walking both trees with one shared pointer
path, building a pointer only for a listed value, so memory follows depth
rather than every container's full path. A pointer over 4096 characters is
counted but not listed. A 256-level document with 4000-character keys went
from about 251 MiB of heap to under 1 MiB.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep JSON Lines as text in the exported reader
The exported reader parses the whole text before an inexact number makes it
JSON with an error, so JSON Lines with an integer above 2^53 stay text as in
REA. Over-long integer spellings are unsafe without converting them. The
guide no longer claims large integers keep their value.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep the state-path help free of dash-led words
The CLI alias check reads `-wal` and `-journal` in help text as short flags,
so the help names the write-ahead log and rollback journal instead.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): never record or export apt source credentials
- Source URIs lose any user name and password as they are parsed, the way apt
splits them, and so do index-target URIs and descriptions and the sources
apt-cache policy lists, so matching works whether or not apt prints them.
- A repository whose entry held credentials is marked
`uri_credentials_removed`, and the export refuses it, or an older capture
whose URI still holds them, with a reason that names no URL.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): look programs up without normalizing their paths
Program paths and PATH entries are joined rather than resolved, so `..` after
a symbolic link means what it means to the launch. The lookup moves to its own
module.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): note inexact JSON numbers with a flag, not a list
The exported reader only needs to know whether any number was inexact, so it
keeps a boolean instead of every rejected spelling.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): refuse older captures that still hold apt credentials
A capture written before credentials were removed counted the credentialed
repository's libraries as installable, so the export refuses it whole and asks
for a new capture rather than declaring packages no source offers. Recorded
policy sources are redacted in export messages too.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(desktop): keep the credential fixture on an example host
A login on a real host reads as a secret to the commit scanner, so the older
capture's fixture uses apt.example.com like the other credential tests.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): tidy looked-up paths and search relative entries only for env
Empty and `.` segments are dropped from a looked-up program path, which keeps
`/snap/bin/` entries recognisable as snaps, while `..` is still left for the
kernel. Relative and empty PATH entries are searched only in the PATH an `env`
prefix sets, which travels with the exported launch; the host's own PATH does
not.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep excluded and unwalked database logs unknown
The capture records the paths every walk left out, and the state view treats
a log as absent only under content roots the baseline walked completely and
outside those exclusions, so an excluded or unvisited log leaves the database
unread rather than read without it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): judge JSON numbers after duplicate keys settle
The exported reader marks an inexact number instead of flagging it during the
parse, then looks for marks in the parsed value, so a number a later duplicate
key overwrote no longer refuses the file, as in REA.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): redact a repository's policy source when it names it
An older capture whose policy source matched no sources entry kept that text
whole, and the export named the repository by it; the export now names it
without any user name or password.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): never signal the launch group on unknown membership
When the current read cannot observe a carrier's process group, the carrier
is signalled on its own instead of letting an older process-table row grant
a group-wide SIGTERM.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): look programs up in the launch's order and refuse host-relative finds
The lookup searches PATH as the launch does, an empty entry meaning the
launch folder, so inspection and launch name the same program. A program found
only through a relative or empty entry of the host's own PATH is refused,
since the exported computer would not have it; an env prefix's PATH travels
with the command.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): count unchecked paths and keep logs behind them unknown
Each walk counts the paths it could not stat and the directories on another
device it did not enter, and the checkpoint records it as `unchecked_paths`.
The state view treats a log as absent only when the baseline left nothing
unchecked, so a log whose stat failed stays unknown.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf(desktop): scan parsed JSON with one iterator per level
The check for marked numbers walks the parsed value with an iterator per
nesting level instead of copying each container's children; a million-entry
array went from about 15.7 MiB to 8.1 MiB of peak traced memory.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): start a relative program from its captured folder
An exported launch whose program path is relative, such as `./app` from an
entry's Path, now changes to the captured working directory first, as it
already did for relative arguments.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(mcp): guide retained evidence input recovery
* style(mcp): format catalog and server types
* test(mcp): verify HTTP capacity recovery guidance
* test(mcp): model catalog recorder imports in cleanup fixtures
record-mcp-catalog.mjs loads tool contracts and the Evidence-input
contract before it registers cleanup owners. The cleanup fixture still
sentineled only the previous imports, so those loads failed before any
owner wrote cleanup.jsonl. Track the script's read() calls and replace
the new modules with the empty contract list this fault injection uses.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(mcp): report selection after failed target opens
* fix(mcp): retain resource root selection in open failures
* test(session): assert selection during cleanup failures
* test(mcp): delay failed open response across target switch
* test(session): distinguish no selection from pending cleanup
* test(session): assert selections during cleanup and cancellation
* test(mcp): join the failed-open gate before restoring its spy
The snapshot-switch gate waited only on its acknowledgement, so a request
that settled early hung until the runner timeout, and a later assertion
failure restored the spy while that request was still in flight. Race the
acknowledgement and join the launched open in finally before mockRestore.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* feat(native): page retained feature traces
* fix(snapshot): retain linked source evidence for replay
* test(snapshot): verify linked foreign evidence stays scoped
* docs(mcp): clarify imported residual questions
* docs(mcp): guide trace reference classification
* fix(cli): report result sources when Evidence publication fails
A trace keeps linked sources on the result. Use those records for the
undelivered source closure as well as the bundle, so a refused output
does not report them as not captured.
* ci: rerun pull request checks
The merge of origin/main did not start the CI workflow for this head.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(native)!: preserve value-flow absence semantics
* test(native): compare value-flow reasons with their owners
Stop freezing the unrecorded and Kuna unavailable sentences. Assert the
procedure-scoped unknown and that an explicit provider reason is preserved.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
