The scope listed environmentManifest*.ts, which on case-sensitive runners
misses EnvironmentManifestAccumulator.ts, and an application path that
does not exist. Brace patterns cover both spellings, drop the dead path
and bring scopes.mjs back under 500 lines, with the same 46 files in
scope.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Hosted runners share that registry's quota, and the framework builds its
infra images from it on every fresh runner; a 429 from it earns one retry
after 90 seconds, recorded in the receipt, while any other failure ends the
lane at once.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The pattern was a `const` below the top-level try block, so the leak filter
reached it in the temporal dead zone the first time a run actually created
the helper; locally no container was new, so the filter never ran. Reproduced
the fresh-host path by removing the local `agentenv-registry` before a run.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The first hosted run of the real-agentenv lane failed only on the cleanup
check: agent-env's local image store starts a registry:2 helper
(`agentenv-registry[-<port>]`) on first use and keeps it running across runs,
so a fresh runner ends the run with one more container than it started with.
The verifier now lists containers with their names, reports that helper under
`image_store_helpers` and asserts that nothing else was added.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Add rea environment-export <manifest.json> --evidence <capture.json> <dir>
[--package-tarball <path>] [--name <override>]: it reads and authenticates the
manifest and capture pair once and writes an agent environment bundle folder
(README with provenance and a rights note, envs/<name> with a Dockerfile that
pins this exact rea version or installs a given tarball, the manifest and the
Evidence as byte-identical copies, a Python verifier that checks replay
through the MCP endpoint, and a smoke task) that the agentenv framework runs
with agent-env run. Refuses a non-empty directory and a mismatched pair
before writing. Adds the real-agentenv hosted lane, which packs the checkout,
exports a bundle from the source-owned capture fixture and runs it on the
runner's Docker with a pinned agentenv-framework, wired into the CI planner
and its guard tests.
Refs morluto/rea#4933
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Serve needs the sessionless JSON-RPC error response; exporting it under a
descriptive name while the transport keeps its short local name leaves
the transport's own code as it is in the streamable HTTP change.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The transport now closes the connection when it replies before an upload
is fully read, which HTTP allows for a 413, so a fetch still streaming
the oversized body can fail before it sees the reply. The test declares
an oversized Content-Length, sends one byte, and reads the 413 the
server answers from the header before closing.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add rea environment-serve <manifest.json> --evidence <capture.json>
[--host] [--port]: it loads an environment-manifest view and the capture
Evidence it was projected from, refuses a manifest whose parent evidence id
does not match the capture, builds one MCP tool per manifest tool and serves
them over streamable HTTP beside an environment card at
/.well-known/agent-env.json and a data plane at /agentenv that refuses every
method. Each tool call replays the retained record whose path and query
values best match the arguments, cites the record ordinal and evidence id,
marks replayed content as untrusted target content, and truncates bodies
over 256 KiB with a flag. Nothing executes the captured application.
Refs morluto/rea#4933
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Media types are case-insensitive in HTTP, so the takeover guard compared
them lower-cased, but the SDK's transport matches Accept as a
case-sensitive substring. A header such as Application/JSON passed the
guard, closed the live session, and then got 406 from the SDK. The guard
now also requires the SDK's Accept substrings and uses its exported
isJsonContentType, so it only replaces a session the SDK will accept.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The copy raced every read against one pending close promise, which piled
up reactions on long streams, and it only noticed a close that happened
after it started, so a route resolving after its client left waited
forever on an idle body. One close listener now cancels the reader,
which also ends a pending read; a reply that is already destroyed cancels
at once; drain waits remove their listeners.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Readable.fromWeb destroys its source on a client disconnect and waits for
the body's cancel(), which for one branch of a teed body settles only when
the sibling is consumed or cancelled, so the pipeline never returned. The
body is now copied chunk by chunk with backpressure; when the reply closes
the copy returns and the cancellation is started, not awaited.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Cancelling one branch of a teed body settles only after its sibling is
consumed or cancelled, so a HEAD route answering with a clone of a live
cached stream left the request handler pending indefinitely. The reply
ends after the headers and the cancellation is started, not awaited.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A comma or semicolon inside a quoted parameter is not a separator, so a
header such as application/json;note=", text/event-stream;x=1" holds a
single range. The takeover guard split on every comma and found a
text/event-stream range the client never sent. Ranges and their
parameters are now split outside quoted strings, and q is read from the
parsed parameters.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A route answering HEAD with a body, such as a reused event stream, was
piped until EOF although Node discards the bytes, so an endless stream
held the request open. A HEAD reply now ends after the headers and
cancels whatever body the route attached.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
closeAllConnections() ran before close(), so a connection accepted in
between missed the forced-close pass and close() could wait for its
request timeout. close() now starts first and closeAllConnections()
follows immediately, as Node documents.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Retain provider-reported call sites and raw classification independently of generic reference flags. Keep all endpoint evidence when containing-procedure routes merge, and include relation in edge identity to avoid order-dependent labels.
Closes#5130
* feat(analysis-view): project an environment manifest from web network captures
Add the environment-manifest view kind to inspect_analysis_view for retained
HAR Evidence: the primary origin's recorded request lines become a
deterministic tool surface (names, path templates, parameters with their
rule and basis, observed query names, value-free body shapes, record
pointers), with excluded groups, three fixed unknowns and the shared
projection budget. The four format rules always apply; after-uid-literal,
opaque-token and sibling-variance are opt-in and labelled, and literal
fold-in never touches a format-rule parameter. The api-surface accumulator
moves onto shared route, media-type and budget helpers without behaviour
change.
Refs morluto/rea#4933
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* test(web-network): check the manifest refusal text like the api-surface refusal
The real-capture verifier stringified the whole MCP result for the
environment-manifest refusal, so a declared "[" literal matched the result
envelope itself; compare the parsed refusal as the api-surface branch does.
Refs morluto/rea#4933
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* docs(specs): record the hosted web-network lane run for the manifest view
Refs morluto/rea#4933
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* docs(specs): reconcile the manifest view verification scope note with the hosted run
Refs morluto/rea#4933
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(analysis-view): bound body, route and name work in the environment manifest
Addresses the automated review findings on the PR: read request bodies at the
top level only instead of walking nested values; admit every literal route
part before materializing it; compare at most 32 segments in sibling-variance
and say so; keep stop words literal after a uid literal; keep the next
collision suffix per tool-name base; preserve a templated exclusion when two
groups print the same row.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(analysis-view): keep manifest folding, naming and media-type reads linear
Addresses the second automated review round: fold literal siblings through
set membership, key collision suffixes by the truncated name they share, and
charge a request media type before it is scanned.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(analysis-view): charge the manifest group key before building it
Addresses the third automated review round: the composite key copies the
method, origin, template and rules, so that copy is reserved before the key
is stringified.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(analysis-view): accept a +json suffix only on application media types
Addresses the fourth automated review round: `image/example+json` or
`text/example+json` no longer counts as JSON for origin selection, exclusion
or body shapes, matching the documented `application/json` and
`application/*+json` contract.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(analysis-view): require the capture parent's exact subject for a manifest
Addresses the fifth automated review round: the manifest cites the report
path and digest, so a parent whose subject is absent or names another path or
SHA-256 is refused at admission, as the capture view already does; the
api-surface view keeps its existing admission.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(analysis-view): share truncated suffix allocation work
Track suffix progress by the actual truncated prefix and suffix width. Distinct full names can collide only after suffix truncation; sharing that progress prevents quadratic rescanning while preserving shorter free names and existing allocation order.
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
* fix(analysis-view): merge only identifier-like siblings under sibling-variance
Addresses the sixth automated review finding: a bucket merged whenever one
literal carried a digit, folding plain words such as `mine` into the
parameter. The rule now partitions the bucket, merges the identifier-like
siblings and leaves the other literals as their own tools.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(analysis-view): combine qualifying sibling cohorts
Keep coded identifiers and a qualifying plural hyphenated cohort in one eligibility Set before checking the minimum merge size. Read each literal once and reuse the same membership at the consumer, preserving non-identifier routes and the three-hyphen minimum.
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
* docs(analysis-view): clarify opt-in sibling folding
State the additional sibling-variance selection in the guide, acceptance specification and MCP parameter description. Preserve the existing single-rule behavior and caller-selected inference rules.
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
---------
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Separate enumeration outcome from retained facts in the native call-route
owner. Keep every available typed call with its source provider and site,
supplement incomplete kinds with inferred fallback targets, and retain
known routes when fallback fails. Per-reference unknowns take precedence
over aggregate availability; cancellation remains terminal.
Project partial routes before enumeration failures, preserve each omitted
route's relation, and include its call site in the omitted-edge identity
so distinct observations to one target cannot overwrite each other.
Remove the superseded success-only provider/result representation.
Validation: 69 focused cases plus final 30-case rerun, including nine
public SDK MCP regressions; full static/architecture, docs and discovery
checks pass. Controlled-provider source REDs reproduce both route loss
and omitted-site collisions. Real native providers remain unverified.
Closes#5073Closes#3922Closes#5128
A browser on the listener's own page sends Origin with the scheme and the
bound port. The SDK validator parses the Origin and compares its hostname
with the loopback allowlist, so the port never takes part; this test keeps
that true for the MCP endpoint and for composed routes, under 127.0.0.1
and localhost.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Read shadowed registrations from the effective JSONC syntax tree before
any client is changed. Share the same typed ownership decision with the
reread before removal, including foreign OpenCode V1 fallbacks. Remove
all admitted duplicates using one member/separator planner and grant
serializer authority only for exact admitted paths.
Setup may remove its explicitly superseded OpenCode V1 path. Preserve
inactive repeated parents, unrelated entries, comments and source backups.
Use the pinned JSONC scanner instead of handwritten string decoding.
Validation: final 86 focused cases and 9 setup acceptance cases passed;
104 additional filesystem consumer cases passed. Static/architecture,
docs and discovery checks passed. A broader 186-case run had one OMP
timeout; its isolated 9-case rerun passed, with timeout cause unverified.
Controlled compiled CLI comparisons verify removal/refusal and backups;
real developer-client execution remains unverified.
Adapted from #4977 at 4cd22d4ec2.
Closes#4976
Co-authored-by: Nikhil Bhagat <knewboy.nykhil@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Update public-boundary expectations after the explicit XML unknown-scalar
and native UI deadline provenance changes. Retain raw malformed literals,
independent exact integers, expanded-year ISO dates, and partial UI reports.
Assert successful cleanup releases its lease and failed cleanup retains it
until close retries. Keep malformed-input and true date-range coverage.
The shared number fixture owns CLI/filesystem/MCP expectations. Native
plutil controls confirm integer entities are invalid plist literals, even
though they are valid XML. No runtime behavior or CI gates change.
Validation: 187 source cases, 138 focused public cases, final 97-case
rerun after fixture typing/group changes, full static/architecture checks,
and test discovery (1591 files).
Addresses a thirteenth automated review finding: `application/json;q=0`
explicitly refuses JSON, so it no longer counts toward the exact Accept ranges
a session takeover requires.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Addresses the twelfth automated review finding: bodyUsed only means a body
was disturbed, so a route that read one chunk of an upload left the rest
paused on a keep-alive socket. The close decision now follows the incoming
message's end of stream.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The previous commit added a second successful route call to the regression
but left the single-observation assertion in place.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Share source operations with execution owners and derive availability and missing prerequisites from one evaluation. Distinguish authored UI dispatch from native-seed call tracing without inventing a default request mode. Preserve target gates, typed failures and partial results.
Fixes#5071
Addresses the eleventh automated review finding: dot segments such as
`/public/../mcp` were canonicalized to `/mcp` before routing. The bridge now
refuses any target whose path differs after parsing, so routing sees exactly
the path the client sent.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Normalize three-digit region aliases at the shared locale owner, preserving
caller labels and physical-table reuse. Reject malformed legacy qualifiers
through the same CLI/MCP contract and table classifier.
Adapt the owner correction and regressions from PR #4918 after checking Android
and supported Apktool qualifier sources. Add public MCP validation and preserve
existing two-letter regional selectors.
Fixes#4916
BREAKING CHANGE: Numeric legacy locale selectors such as es-r419 are rejected.
Use es-419 or b+es+419. Two-letter region selectors remain supported.
Co-authored-by: Mert Kaya <47145541+mertkayacs@users.noreply.github.com>
Addresses the tenth automated review round: the bridge joins an origin-form
request target onto the listener's origin so a network-path target stays a
path and absolute-form targets are refused; only a lone initialize can replace
an open session; and the shutdown hook records completion only after it
returns, so a hook that threw stays eligible for the next close.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Share named metadata source operations between execution and capability discovery. Preserve symbol fallback and typed runtime failure behavior, and cover availability through public MCP workflows.
Fixes#5070
Declare the missing trace composition and correct call graph prerequisites to require address resolution plus the selected relationship direction. Report forward/backward modes and the actual default independently, preserving missing operations, owner failure reasons and direct partial outcomes.
Share the direction-to-provider mapping across runtime and discovery, reuse the mode evaluator, select defaults by name, and check composition coverage against every canonical enhanced contract. Keep same-endpoint traces callable without relationship reads.
Adapt the missing trace-composition correction proposed in PR #4729 and complete the directly related ownership/refactoring and sibling graph correction.
Validation: 75 source tests and 76 public MCP/schema tests passed; full static/architecture checks, docs and test discovery passed. Controlled SDK/provider workflows verified unchanged catalogs and normalized traces. Small whole-session costs were recorded, with no speedup claim. No native-engine, CLI, Linux/Windows or model tool-selection qualification.
Fixes#4687Fixes#5068
Co-authored-by: AHMED <aptech356@gmail.com>
Picks up upstream's test-runner configuration and the command-finalization
test fixes so the fork lane stops failing on unrelated flaky shards.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Interpret complete scalar source at the XML owner instead of accepting numeric prefixes, permissive date strings or nonempty booleans. Retain malformed content as explicit unknown scalars with original literals and reasons, while preserving the surrounding archive and independent numeric facts.
Share the representation across plist, keyed archive, Interface Builder and entitlement projection; remove the superseded numeric fallback and helpers. Parse date fields as UTC, retain real entity/CDATA semantics, and distinguish native integer/real whitespace without ambiguous whitespace backtracking.
Validation: 276 source tests and 60 compiled/public tests passed, with updated scalar regressions rerun; static, architecture and docs checks passed. Native macOS plutil controls and CLI/MCP source-hash/time-zone controls executed. No Linux/Windows or deep-provider qualification. Tiny completed CLI task costs recorded; no performance improvement claimed.
BREAKING CHANGE: Unresolved XML scalar values now use $plist_type unknown wrappers with element, literal and reason. This replaces the former real/null unknown marker and malformed scalar prefix fallback. Supported extended UTC years now preserve their timestamp.
Fixes#4852
Adapt the completed-quartet decoder from PR #4981 at 4cf6cac14. Bind raw source spans to validated DOM nodes before entity and line-ending interpretation can change data bytes. Preserve depth preflight, reject invalid data forms and allocate exact decoded output through one shared quartet grammar.
Fixes#4978
Co-authored-by: Avichal Pandey <avichal2018lko@gmail.com>
Addresses the ninth automated review round: a method Fetch refuses, such as
TRACE, is answered with 405 instead of escaping the request guard; the
unread-body decision now comes from the incoming message's own body
declaration, so a GET or HEAD carrying a body closes too; and the regression
uses a keep-alive client and checks that the socket actually closes.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Return byte prefixes with tagged read outcomes and exact causes. Share those facts across partial journals and captures, preserve typed primary failures and successful siblings, and keep zero-byte failures unavailable. Retain failed descriptor and root owners through retry.
Fixes#5058
Addresses the eighth automated review finding: a refused Host or Origin, an
unknown route or the startup 503 answered a POST while its body stayed unread
on the paused bridged stream; such replies now carry Connection: close so an
unread upload cannot keep a socket open.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Give the typed error owner a separate retained secondary-failure collection. Preserve exact direct causes, including caller cancellation reasons and absent causes, while keeping existing diagnostic and live cleanup ownership projections.
Fixes#5059
Derive the read limit from the accepted safe decimal PID plus a tolerated CRLF and overflow sentinel. Retain short-read handling, cached valid facts and existing descriptor ownership and handshake semantics.
Fixes#5057
Record caller cancellation versus the owned deadline once and share that provenance through helper execution, scenario waits and finalization. Preserve independent failures and partial reports, consolidate scenario failure handling and dispose listeners on every exit.
Fixes#5056
Decode completed journal rows strictly while retaining valid neighbors and torn-tail semantics. Preserve structured result read, decoding, JSON and schema failures through the typed fallback.
Fixes#5055
Addresses the follow-on finding on the signal latch: the HTTP entry now owns
its exit status, so a 0 returned by startup after a recorded signal keeps the
signal's 130 or 143 while a real failure still wins; a process test sends the
signal as the listening line appears.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Give each signature snapshot a private child-resource scope. Its composite
root lease closes those children before removing the directory and retains
both stages across failed retries. Bind local cleanup failures to their
exact owner so child release cannot clear a failed root removal.
Replace the mixed-outcome regression that expected premature root removal.
Cover real descriptor denial, primary/cancellation preservation, MCP close
and same-connection recovery. Expose underlying real codesign test errors
before asserting result fields.
Fixes#5052
Addresses the sixth automated review finding: SIGINT and SIGTERM are recorded
from the moment the HTTP entry starts, the lifecycle owner acts on a recorded
signal as soon as it registers, and a second signal during startup exits at
once.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Keep the selected device, addressed file and actual host operand distinct
at the command owner. Parse known device and file diagnostics before
projection, including AOSP host write/read failures and exact snapshots.
Classify complete captured stderr before shortening display text, and
scan leading notices without expanding the capture into a line array.
Adapt Xinglan233's PR #4655 and extend its source-shaped host controls.
Add built CLI/MCP identity, long-path, recovery and input-preservation
coverage. Real platform-tools and Android devices remain unverified.
Fixes#4641Fixes#4643Fixes#5051
Co-authored-by: 星闌 <xinglan233@163.com>
Exclude processing-instruction nodes at the shared container-member owner
before dispatching plist tags. Keep strict syntax validation and scalar
content rules, with app-resolution and CLI/MCP evidence regressions.
Adapted from Mangolycheematcha's PR #4965, including its boundary controls.
Added built CLI/MCP coverage and verified container fixtures with plutil.
Fixes#4964
Co-authored-by: Mangolycheematcha <288892596+Mangolycheematcha@users.noreply.github.com>
Addresses the fifth automated review round: the instance's shutdown hook runs
exactly once even when the listener closes without a live session; the
initialize probe no longer awaits cancelling its cloned body, which would wait
for the original request to drain; and the node:http bridge passes repeated
Set-Cookie values through as an array.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Replaces a comma expression left by the previous commit with plain
statements and moves the port release into a small function, so the listener
body stays within the lint limits without changing behaviour.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Addresses the fourth automated review round: a sessionless POST replaces a
session only when its Accept header lists application/json and
text/event-stream as exact media ranges, and a session whose transport
shutdown rejected stays owned so the next close retries it.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
