* refactor: prune internal seams and preserve configuration ownership
* fix(setup): keep YAML aliases and inherited registration settings on refresh
- Reuse an unchanged YAML collection only while every alias in it still
resolves after the edit; otherwise rebuild it so the alias becomes its
value. A sibling anchor replaced or moved in the same refresh no longer
leaves an unresolved alias in Hermes or Goose output.
- Keep a connection selector whose existing value already chooses stdio
(for example an inherited Hermes transport: stdio) instead of superseding
it; remote selectors are still replaced. Explicit stdio selectors are
therefore no longer rewritten (Kimi expectation updated).
- When the whole Hermes registration is inherited through a merge,
override it with that merge and write only the changed fields.
* fix(setup): edit registration fields whose YAML key is an alias
A key written as an alias to a string scalar (for example *field with
field: &field env) was treated as a source-only key, so any change to
its value was refused in Hermes and Goose. Resolve such keys to their
string, keep the aliased spelling while its anchor survives the edit,
and write the plain key when the same edit rebuilds the anchor.
* test(process): bound cleanup-boundary waits and always release gates
Both cancellation tests awaited a bare started promise and released
their gates only on success, so a missed boundary waited for the outer
deadline and could leave cleanup parked. Use awaitAcknowledgement and
release and join the cleanup in finally.
* fix(setup): repair only aliases an edit leaves unresolved
Replace the pre-edit alias survival guess, which expanded aliases to
sibling anchors that survive unchanged, with an exact repair: record
what each alias in the replaced value resolves to, write the edit, then
replace only aliases left without a preceding anchor by that value.
- Keep an aliased key's source position, so its anchor stays ahead of
later aliases.
- Treat an aliased key as its string only when no other key in the map
resolves to the same string; an ambiguous one stays guarded.
- Override an inherited Hermes registration only when the requested
entry keeps every inherited field, so an explicit replacement can drop
remote selectors.
* fix(setup): repair aliases whose binding an edit changes, keeping comments
An alias whose own anchor was removed could resolve to an earlier anchor
with the same name and silently change value. Record the node each alias
resolved to and repair any alias that no longer resolves to that node.
Carry the alias's comments and spacing onto the repaired value.
* test(setup): split the Hermes anchor and merge refresh cases
* fix(setup): refuse removing an overridden key its merge would restore
The merge-retention check skipped keys the mapping also overrides, so
dropping such a key (for example a remote url during an explicit stdio
replacement) let the retained merge restore it. Check removal before
skipping overridden keys, so the edit is refused with the existing
message instead of producing a registration that cannot be applied.
The testing guide requires file-owned createMcpSchemaValidation instances
to be cleared in afterAll, so shared workers do not retain schema strings
and compiled validators after a file finishes.
Co-Authored-By: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor(cli): run one-shot commands through one shared owner
scripts/rea.mjs and the test CLI session worker each implemented the
one-shot command sequence: argument normalization, output admission,
configuration errors, version documents, the Amp scope refusal, and
result delivery. The worker copy had drifted: it never rendered
formatted version reports or the Amp refusal.
Move the sequence into src/cliOneShot.ts. Both callers supply a host
for their streams, exit and resource ownership. The launcher keeps
closed-pipe status, worker shutdown and process exit; the session
worker captures output per command.
The cliOutput bundle entry is superseded and removed. The dispatcher
test now replaces only the command runtime, so output admission runs
production code. A new parity test compares the file session with a
fresh process.
* test(cli): bundle the one-shot entry in the runtime bundle fixture
* perf(tests): run plain CLI commands on the file's shared process
`cli.run` in `cliTest` files started a fresh compiled CLI for every
command, about 0.45s and 260 MB each before any work. The file-scoped
session already existed, but callers had to opt in through
`runFileCli` or `sharedCliRun`, so 1,300 call sites still spawned.
Make the fixture choose: `cli.run` uses the shared process when it
reports the command exactly as a fresh process would, and starts one
otherwise (stdin, explicit deadlines, MCP and MCP doctor routing,
NODE_OPTIONS, or enabled logging). `freshProcess: true` keeps
explicit process-level checks. The session worker now presents the
launcher's entrypoint, so registration identity matches a fresh
process.
`runFileCli` and `sharedCliRun` are superseded and removed; their
call sites use `cli.run`, and paired fresh/shared checks use
`freshProcess`.
* style(tests): format the managed member summary call site
* test(cli): give each shared-session command an empty stdin
The shared CLI process reads session frames from its own stdin. A
command that reads stdin without supplied input, such as
`compare-wasm-interfaces - --json`, read that pipe and hung, where a
fresh process receives EOF. The worker now presents an ended, empty
stdin to each command and restores its own afterwards.
The parity test compared the routed path with itself after cli.run
began choosing the session. It now compares a fresh process with the
session directly, including the `mcp add` refusal and a command
reading absent stdin.
* test(cli): keep default command logging and launcher checks on fresh processes
environment-serve and environment-build log at info when REA_LOG_LEVEL is
unset, through a logger that writes to stderr directly. The shared CLI
process captures only process.stderr writes, so routed runs lost those
lines. Declare the default-logging commands beside the command names,
have infoLogger read that set, and start a fresh process for them.
The log-level precedence checks compared the shared process with itself
after routing; their fresh side now passes freshProcess: true.
239 literal timeoutMs values on cli.run and processes.run only restated
a guess at host speed. On hosted runners with four workers, cliOutput's
3-second value failed while the command still produced correct output.
Deadlines that are the behavior under test, derived from an operation
budget, or that bound a regression's wait remain.
Co-Authored-By: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`rea doctor --target ""` passed an empty string to target readiness,
which checked the working directory instead of reporting that no app
was named. Use the shared local path schema, so an empty target fails
validation before any readiness check, as every other target does.
Fixes#7561
Co-Authored-By: gensokyo-dev <gensokyo-dev@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A terminal call on one branch does not end the whole function: other
branches can still reach the following code, which stays in the body and
pseudocode. The function-level limitation now says Ghidra excluded that
call's fall-through and that code reachable only through it is missing
if the callee returns. It is listed before the call-specific facts so a
bounded composed summary that admits limitations in order keeps it.
The body-coverage tests now check the counted records and their reasons
instead of freezing the explanatory sentence.
Co-Authored-By: gensokyo-dev <gensokyo-dev@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
decompile_all set its top-level "procedure_info is unavailable" caveat
from a per-call flag that only a newly attempted function could raise.
A resume that skipped every verified file, or selected nothing, rewrote
the manifest and decompile-index.json with an empty limitations list
while every retained record still reported an unavailable body.
The export owner now answers from the records it retains: the summary
counts every non-external record whose body is unavailable, including
records an earlier run wrote, and repeats the reason when all share one.
The per-call flag is removed. A fresh export whose procedure_info works
but leaves some bodies unavailable now reports that caveat too; a later
attempt that records a known body clears it.
Fixes#8351
Co-Authored-By: gensokyo-dev <gensokyo-dev@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor(cli): run one-shot commands through one shared owner
scripts/rea.mjs and the test CLI session worker each implemented the
one-shot command sequence: argument normalization, output admission,
configuration errors, version documents, the Amp scope refusal, and
result delivery. The worker copy had drifted: it never rendered
formatted version reports or the Amp refusal.
Move the sequence into src/cliOneShot.ts. Both callers supply a host
for their streams, exit and resource ownership. The launcher keeps
closed-pipe status, worker shutdown and process exit; the session
worker captures output per command.
The cliOutput bundle entry is superseded and removed. The dispatcher
test now replaces only the command runtime, so output admission runs
production code. A new parity test compares the file session with a
fresh process.
* test(cli): bundle the one-shot entry in the runtime bundle fixture
`cliIntegerArgument` piped a regex-guarded string into a number but never
published Zod's input view, so `--schema` advertised a bare integer for 15
fields while the parser accepted only decimal argv text. `environment-serve
--port` had the same gap through the transforming MCP_PORT owner.
Remove `cliIntegerArgument` and route every call site through
`cliDecimalField`, binding each field to its domain or contract owner where
one exists so bounds, defaults and optionality come from that owner. Export
the input-view publisher as `publishArgvInput` and apply it to `--port`,
which keeps the MCP_PORT grammar shared with `rea mcp --http`.
The decimal catalog test now requires every numeric field's advertisement
to admit its decimal argv token, covers repeated options and
string-advertised token grammars, and checks `--schema` output directly.
The string branch's missing numeric range (#9348) is unchanged.
Fixes#9344
Co-Authored-By: gensokyo-dev <gensokyo-dev@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Explicit deadlines at or below the project deadline only shortened it:
a literal 30-second value also disabled the coverage scaling, which timed
out wide-capacity regressions on main. Workloads above the built
deadline use the long-running tag. Deadlines derived from an operation
budget remain.
Co-Authored-By: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An unavailable session is a typed invalid_request. The CLI treats that
projection as an operation failure and exits 1.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
fix(cli): batch of small fixes for #9714, #9718, #9759, #9856 and #9809#9714: replace bare z.string().min(1) local paths in ADB CLI commands with localPathStringSchema so NUL bytes are rejected at the CLI boundary.
#9718: decode-android-resources path uses localPathStringSchema, matching apktoolInputSchemas.
#9759: inspect-sqlite-database CLI options now reject an empty column array and reject rowLimit/rowOffset/column/schemaScope=selected_table without --table via superRefine, mirroring inspectSqliteDatabaseInputSchema.
#9856 and #9809: shared snapshotSelectionOption is now localPathStringSchema.optional(), so every analyze/inspect/decompile/xrefs/trace/function/instructions/search --snapshot rejects NUL bytes.
Tests: tests/boundary/cli/overnightBatch1CliSchemas.test.ts (15 tests) proves empty/NUL input returns VALIDATION_ERROR before any provider runs and valid input is admitted.
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
* fix(adb): reject unrepresentable activity arguments
* test(adb): lock complete activity component boundaries
The CLI and advertised schema still admitted a slash-free 512-character
component after admission required a nonempty package and class. Keep
that length sample rejected, admit a pattern-valid 512-character
component, and assert the typed field error.
* style(docs): format NTFS verification tables
oxfmt rejects the tables merged from main. The alignment is formatting
only, so static checks can run on this branch.
* test(adb): use a well-formed component for the length constraint
An over-long run of letters also fails the package/activity pattern, so the selector check reported both issues. The length fixture now has a valid component shape.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(cli): validate named inputs before target admission
* fix(mcp): preserve valid inputs when advertised schema references widen
* test(inputs): reach session behavior with admitted inputs
One-shot admission now rejects incomplete requests before a session exists. Lifecycle tests supply the required fields, and unknown arguments are rejected before provider issues are retained.
* fix(cli): preserve Electron fuse path spelling
Anchor relative fuse paths without stripping dot segments, and let an empty path reach the operation so it still reports invalid_request.
* fix(cli): reject outline-depth unless detail is summary
The advertised schema already required detail summary whenever outline-depth
was present. The parser still applied the full default and accepted that
combination, so its output failed the same schema. Parsing now rejects it
before the command runs.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(cli): refuse an unsupported Node.js release before linking
The dispatcher imported the compiled runtime before checking the runtime
range, so a release outside `engines.node` failed while linking a module
that imports `createZstdDecompress`. Callers saw a module-linking stack
trace from every command, including `--version` and `doctor`, instead of
the refusal the installer and `engines` already promise.
Check `engines.node` from the package read the dispatcher already performs,
before the first compiled import. The helper has no imports of its own: the
dispatcher must admit the runtime before any dependency can be resolved.
Fixes#9296
* fix(cli): ship and align runtime admission
* fix(ci): cover packaged runtime admission helper
* test(cli): assert Node admission with structured range results
Export satisfiesNodeRange and cover caret, minimum, union, and
non-release versions. The dispatcher proves the compiled runtime never
loads by the absence of its marker file, and compares stderr to the
helper's own message.
---------
Co-authored-by: 2SinceJuly <202121119+2SinceJuly@users.noreply.github.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Validate analyze-javascript-application paths with the shared localPathStringSchema before anchoring or provider execution. Empty paths now return CLI field errors; NUL bytes are rejected at the same boundary. Preserve selected-path Evidence for valid inputs and update the CLI regressions. Closes#9747.
* docs(desktop): clarify gzip scrub limits
* fix(setup): own desktop build process cleanup
* fix(doctor): compare desktop settings with resolved defaults
* fix(desktop): refuse a build runtime whose export takes no task ends
Several tasks pass --task-end to the build computer's export, so a runtime
packed before it now fails at the start of the capture with the repack fix,
as a runtime without synthetic seeds already did, rather than at export.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* style(desktop): format the noisy-record draft files with the pinned oxfmt
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(desktop): give the root-array draft test its own describe
The records describe grew past the 150-line lint limit with it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(doctor): inspect client-recorded desktop runners
* fix(doctor): reuse matching runner probes
* fix(setup): propagate cancellation to desktop actions
* fix(desktop): rewrite a download's launch keys written with spaces around =
The desktop entry parser accepts `Exec = notes %F` and an indented
`TryExec =notes`, so the install script now matches those keys the same way
instead of leaving the original program in place. Adds the feature's tasks.md.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep why a measured run failed in its solve record
A solve that returned an outcome dropped the runner's error, so a run that
failed to deploy, solve or verify was retried with no reason recorded. The
record, the measure result and difficulty.json now carry it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(setup): stop Hopper on cancel, never report a cancelled setup ready, and keep a failed action's client setting
- The Hopper install gets setup's signal: Linux already honoured it, and the
macOS installer now stops its downloads and stops before mounting or copying.
- runSetup checks the signal after the final doctor and close, so a
cancellation there raises instead of returning ready.
- A failed pack or agentenv install no longer writes its archive or runner to
client configs, so the setting the client already had stays.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(setup): keep the completed setup result in a cancellation after cleanup
A cancellation during the final doctor or host close carried only the applied
actions, dropping each client's result and backup path and the doctor report.
It now carries the whole result as setup_result, as doctor's cancellation
carries its report.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(desktop): move launch execution to boundary suite
* fix(desktop): redact build schema failure output
* refactor(desktop): normalize schema failure once
* fix(desktop): omit unsafe schema parser snippets
* fix(desktop): preserve draft change and selected path evidence
* test(desktop): group retained dconf note regressions
* fix(desktop): respect archive entry format in draft checks
* test(desktop): separate unowned-file draft note cases
* fix(desktop): preserve explicitly selected journal documents
* fix(xml): avoid scanning selected ancestors per tag
* fix(desktop): exclude covered text runs from draft counts
* fix: preserve text when drafting desktop checks
* fix: restore nested desktop state aliases
* refactor: share UUID recognition across draft checks
* fix: retain multiline XML attribute context
* fix: retain relationship identifiers in task drafts
* docs: clarify desktop draft identifier handling
* test(desktop): type formatting run cases as pairs
* fix(desktop): carry document format into selector evaluation
* test(desktop): separate markup boundary regression group
* fix(desktop): propagate formats through draft selectors
* fix(desktop): switch selector format within archive entries
* test(desktop): remove duplicate seed filename case
* fix(setup): retain diagnostics when cancellation overlaps failure
* refactor(setup): keep command cancellation at its owner
* test(setup): verify cancellation at the application boundary
* test(desktop): pass JSON format in exported index parity
* docs(desktop): clarify task checks before scratch export
* fix(desktop): respell selected paths in file URLs
* test(desktop): group captured document spelling cases
* test(desktop): run installer scripts at boundary
* style(desktop): remove trailing blank line
* fix(desktop): bound draft preview serialization
* fix(desktop): restore selected state aliases
* fix(desktop): respect entry format in draft noise
* test(desktop): match exported alias evidence at its JSON boundary
* fix(desktop): retain app state logs in exported seeds
* fix: align desktop numeric seed comparisons
* test(desktop): keep one draft exclusion fixture import
* test(desktop): retain log eligibility across draft test groups
* fix(doctor): resolve empty registered desktop runner
* style: fix desktop launch test formatting
* style: format native command path schema
* fix(desktop): map selected external launch paths
* style(desktop): format seed document regressions
* test(desktop): group launch URL regressions
* fix(desktop): omit redundant nested state aliases
* fix(desktop): compare added free text as a whole
* fix(desktop): check recompressed seeds as shipped
* docs(desktop): clarify recovered seed format
* test(desktop): group shipped gzip seed checks
* fix: retain quoted identifier text in task drafts
* fix: recognize Unicode XML in desktop state readers
* fix(desktop): bound nested draft checks
* fix(desktop): explain missing arrays in truncated views
* fix(desktop): find XML type references in archives
* test(desktop): remove duplicated capture assertions
* fix(desktop): retain nested omitted text boundaries
* style(desktop): format draft value imports
* test(desktop): group model and draft value checks
* fix(desktop): map captured launch paths once
* refactor: remove unused whole-text guard state
* refactor: stop passing unused text children
* test: align free-text checks with whole-note policy
* fix: validate recompressed desktop archive seeds
* style(desktop): format archive seed regression
* fix(desktop): retain placed-item sibling guards
* fix(desktop): preserve archive paths and bound doctor reads
* fix(doctor): refuse non-files before descriptor admission
* fix(setup): track remaining cleanup resources across retries
* test(desktop): specify XML format in heap pairing fixture
* fix(setup): skip Hopper launch after cancelled copy
* fix: preserve task measurement limits and cleanup
* fix(desktop): retain reported solve sandbox cleanup
* test(desktop): check retained log seed admission
* fix(doctor): query agentenv for model endpoint
* fix(doctor): preserve uncertainty for empty endpoint override
* fix(desktop): redact runtime schema errors
* fix(desktop): normalize captured file URLs
* fix(desktop): report seeded files by capture path
* fix(desktop): retain startup readiness failure stage
* fix(desktop): retain JSON date checks
* fix(desktop): preserve archive formatting checks
* fix(desktop): preserve explicitly selected journal files
* fix(desktop): report build command transport limits
* docs(desktop): clarify unreadable dconf versions
* test(desktop): remove duplicate history regression
* fix(desktop): align XML names with exported reader
* fix(desktop): create selected state alias targets
* fix(desktop): inspect supported runtime archives
* fix(desktop): keep ordinary text checks exact
* fix(desktop): verify registered build host paths
* fix(desktop): retain record identity in draft checks
* test(desktop): preserve text reference numbers
* fix(desktop): bound download install input reads
* fix(desktop): match placed notes by whole text
* test(desktop): match multiple task export results
* fix(desktop): retain failed measurement file closes
* fix(setup): retain completed actions on cancellation
* test(setup): retain cancelled installer result
* fix(desktop): scrub XML independently of reader compatibility
* fix(desktop): preserve file aliases and reader diagnostics
* style(desktop): format review fixes
* fix(desktop): inspect archives with registered runner
* test(desktop): verify registered archive interpreter
* style(desktop): format capture review fixes
* style(desktop): format review changes
* feat(desktop): target agentenv-framework 0.9.1464
Desktop bundles, setup's --install-agentenv and the doctor's exact-version
check now target 0.9.1464, which keeps an exported app's data/get call,
holds the computer fixture above boot dialogs, leaves an unresolved setting's
build unverified rather than failed, and mounts lock packages instead of
copying them into the image. The web environment lane stays on 0.9.1431.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): retain per-solve sandbox cleanup roots
* test(desktop): expect the solve cleanup helper among the shipped agentenv helpers
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(desktop): clean up a stopped solve's sandboxes through agentenv 0.9.1482
agentenv-framework 0.9.1482 lists the local sandboxes under a root
(local_sandbox_ids) and rebuilds one killed while it wrote its port map for
teardown. The solve cleanup helper now terminates each sandbox agentenv
lists, keeping its Docker and host-process checks, and reports anything else
left under the root. Desktop bundles, setup's --install-agentenv and the
doctor's version check target 0.9.1482.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): verify a killed solve's cleanup once its sandbox root is empty
A solve's sandboxes are all local under its private root, and agentenv now
keeps a sandbox's folder until its teardown is confirmed. So when the helper
ends without a report and REA's cleanup empties that root, the cleanup is
verified: a cancelled solve ends as a cancellation and a solve past its
deadline as a failed run, rather than as cleanup the measure cannot vouch for.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(desktop): target agentenv-framework 0.9.1485
0.9.1485 keeps a local sandbox's folder until its teardown is confirmed, which
the solve cleanup's verified result relies on. (0.9.1484 failed to publish.)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): record a solve stopped before it reports as failed, not as a refused request
A helper killed from outside or stopped at its deadline left no report, so the
measure refused with invalid input and told the caller to fix its model
endpoint. A helper a signal ended now gives a failed solve of unknown cost,
which the measure records and stops on; one that exits on its own without a
report still ends the measure as a solve that could not run.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): check verifier behavior after selector changes
* test(windows): verify rejected writes during cleanup by effect
* fix(desktop): preserve selected alias target kinds in exports
* fix(cli): retain caller capture paths in environment builds
* fix(ghidra): classify oversized endpoint records consistently
* test: align model and Evidence expectations with current contracts
* fix(desktop): reconcile upstream sandbox cleanup recovery
* fix(docs): link cleanup qualification as repository evidence
---------
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(cli): record the caller HAR path in environment-build evidence
environment-build inspected a HAR without the caller path that
inspect-web-network-capture records, so the published evidence.json
omitted caller_input_path and failed the byte-for-byte portable check.
Also update three stale portable expectations that already fail on main:
the no-reader verifier digest matches the #9185 selector parent, uncapped
IDA callee pages report complete discovery, and a CLI refusal of a
malformed artifact inspection includes the undelivered source closure.
* fix: restore portable docs, alias, offset, and Windows cleanup checks
The witness page linked task anchors that were never written, so any
docs-touching PR failed the route check. A selected state directory was
restored as a dangling symlink by a duplicated helper. An empty
safetensors file reports the extent as outside the file before offset
conversion. Windows cleanup refusal uses the runtime's in-progress message.
* fix(cli): keep the caller's HAR spelling in environment-build evidence
inspect-web-network-capture records the path the caller typed. The
one-shot build had already absolutized that path, so a relative capture
disagreed with the three-step bundle. The byte-for-byte check now runs
from the capture directory and requires caller_input_path grafana.har.
* fix(desktop): create alias targets only for directory selections
A missing settings file was created as a directory because the helper
treated any absent path as a directory. The capture's selected path kind
now travels with the alias, and only a directory alias creates its target.
An absent file alias stays a file the app can create.
* fix(desktop): keep legacy alias kind unknown
Captures written before selected_paths.kind leave the alias unknown.
Defaulting those to a directory makes an omitted settings file a
directory, so a later write through the alias fails with EISDIR.
* fix(desktop): keep alias kind a file, directory, or unknown
The export plan was widening a missing selected path kind to string.
Record file or directory only when the capture says so, and unknown otherwise.
* fix(desktop): narrow a missing alias kind to unknown
The selected path kind was widened to string, so the export plan could
not keep the file, directory, or unknown distinction.
* test(desktop): expect alias kind in the rendered app module
The export now records whether a selected alias is a directory. The
rendered STATE_ALIASES tuples include that kind.
* fix(ghidra): reject an oversized Windows TCP endpoint as invalid
The POSIX read maps a record past the compact endpoint bound to
"Ghidra TCP endpoint is invalid". The Windows lease reported that same
bound as a generic observation failure, so an expanded endpoint failed
the Windows lane with a different message.
* fix(desktop): create a legacy alias when a child proves it is a directory
A capture written before selected path kind can still nest one alias
inside another. That parent is a directory. A legacy leaf stays unknown
so a missing settings file is not created as a directory.
* fix(desktop): restore selected aliases when the app owns no files
An empty state directory does not become an owned path, so the class
was ownless and never called _ensure_state_aliases. The ownless class
now restores aliases whenever the export recorded some.
* fix(desktop): create the parent of a missing file alias
A file alias must stay a file. When its parent directory was not seeded,
the symlink was dangling and a write through it failed with ENOENT.
* ci: retrigger checks after an unrelated Windows timeout
The Windows lane timed out in webModuleCli, which this diff does not touch,
and the rerun API is unavailable.
* test(evidence): preserve complete CLI refusal diagnostics
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: gensokyo-dev <gensokyo-dev@users.noreply.github.com>
morluto