Export an authenticated capture and environment manifest as a pinned agentenv bundle with provenance, a replay verifier and smoke task.
Followups preserve immutable input ownership, bounded discovery, caller paths and numeric values; bind bundle writes and package copying to retained filesystem owners; verify POSIX modes; retain cleanup authority; and verify framework/npm executable selection. Default MCP remains stdio.
Validation: pinned Linux toolchain, typecheck/build/lint/format/docs/knip, 452 focused tests, ten product-catalog cases, real GitHub response replay in the generated non-root Docker image, and the real pinned agentenv framework smoke workflow. Platform and resource-measurement limits are recorded in the feature verification document.
Co-authored-by: gensokyo-dev <gensokyo-dev@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Export's headroom check reserved one native parse per input, while the
raw parse, its authenticated Evidence copy and the schema copy of its
result are live together while the pair loads; it now reserves all
three, so a file near the heap limit is refused as a resource
constraint rather than exhausting the heap.
A bundle name that Windows reserves as a device name (con, prn, aux,
nul, com1-com9, lpt1-lpt9) is refused while planning, before any file
is written, since the env folder could not be created there.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The serve change now loads environmentSource lazily so CLI startup never
imports it; the export command does the same, and the unused static
import is dropped.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Serve retained capture Evidence as a bounded MCP replay environment with discovery.
Preserve default stdio, caller-selected facts and complete source Evidence.
Fix numeric fidelity, argument identity, startup cancellation and bounded discovery,
query/path matching and output metadata. Verify real recorded API data and public
CLI/MCP workflows; preserve explicit gaps for Windows and third-party hosts.
Co-authored-by: Edgar Arakelyan <edgar.arakelyan@scale.com>
Co-authored-by: gensokyo-dev <gensokyo-dev@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Public ECR caps anonymous pulls by data per source IP, and hosted
runners share IPs, so the lane failed on every run today while the
pinned framework built its service-db image from
public.ecr.aws/docker/library/postgres. The lane now switches Docker to
the containerd image store, pulls each public ECR base image the pinned
framework's Dockerfiles name from mirror.gcr.io (the same Docker
official images under the same digests) and names it as the Dockerfile
does, as the framework's own CI does. The verifier's quota handling
still covers anything pulled from public ECR.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Reuse the common Linux identity reader and retain the original PID/start-time pair throughout detach. After Rizin confirms no active descriptor, accept a proven end of that original process while preserving refusals for unresolved or live mismatched targets. Remove the duplicate proc parser and cover deterministic exit/live-redirect transitions with owned fixtures.
Fixes#5277
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
* fix(process): classify baseline cleanup with current ownership facts
Use the pre-launch baseline only to select candidates for current native
identity/token validation. Preserve confirmed absence and verified foreign
generations instead of carrying a premature baseline identity failure.
Exercise the real Linux enumeration/exit race and retain countercontrols for
unknown identities and live token-owned processes.
Assisted-by: Reimu (gensokyo-skills:reimu-incident-triage)
* fix(ci): distinguish process inventory from historical PID lookups
* test(ci): verify decoded historical PID controls before tracing
* fix(ci): trace historical PID handles and signal probes
* fix(ci): resolve traced directory paths across pathname syscalls
Classify producer-decoded FD/path pairs once instead of limiting failed relative
lookup detection to openat on /proc. This preserves attempted readlinkat, statx
and newfstatat accesses with no returned descriptor.
Three regression cases fail against the previous policy and all 33 controls
pass with the shared pathname interpretation.
Assisted-by: Reimu (gensokyo-skills:reimu-incident-triage)
* test(ci): declare unresolved legacy pathname coverage
Report the historical-PID access surfaces actually checked and explicitly mark
legacy cwd-relative pathname calls unverified. The existing tracer does not
provide their cwd identity, and a blanket rejection also rejects legitimate
GDB build-ID metadata queries.
Retain every committed access guard and document the preexisting limit without
claiming absence from missing path evidence. The complete real 44-case CLI/MCP
recorded-crash qualification passes with the coverage declaration.
Assisted-by: Reimu (gensokyo-skills:reimu-incident-triage)
* fix(ci): reject priority access to historical PIDs
* fix(ci): preserve C-quoted components in traced path checks
strace renders non-ASCII pathname bytes as C octal escapes, not JSON strings.
Keep those components opaque when resolving literal ASCII path separators and
proc PID selectors, matching the existing absolute-path interpretation.
Two controls fail before the correction and all 35 pass afterward. An actual
strace observation independently reproduces the rejection of an unrelated
Chinese filename and verifies the corrected classification.
Assisted-by: Reimu (gensokyo-skills:reimu-incident-triage)
* fix(ci): reject historical PID resource and scheduler calls
* fix(schema): preserve portable large base64 validation
* fix(ci): share explicit PID syscall contracts with tracing
Derive tracer selection and reported coverage from the same named target
contracts used by the access checker. Cover resource limits, scheduler calls,
process metadata, PID groups, capabilities and pidfd operations without mixing
UIDs, policy enums, self selectors or output values with target PIDs.
Interpret each target once and retain unresolved target facts as a distinct
failure. Emit the coverage catalog once per verifier result.
The previous oracle misses 28 new controls. All 83 controls pass after the
change; real native resource/scheduler probes capture 14 previously missed
calls with resource limits and affinity unchanged. All 35 selected syscall
names are accepted by the pinned local strace.
Assisted-by: Reimu (gensokyo-skills:reimu-incident-triage)
* fix(ci): classify I/O priority and qualify PID trace coverage
* fix(process): keep ownership retries on the native clock
* fix(ci): retain process edges in ownership trace inventory
Keep fork/vfork and resumed edges along with clone events so the shared attribution owner receives the complete process relation facts it consumes.
Assisted-by: Reimu (gensokyo-skills:reimu-incident-triage)
* fix(process): type native exit predicates and ownership fixtures precisely
* fix(ci): retain trace coverage limits after integration
Restore explicit unverified symlink aliases and same-Node stat/status purpose in the shared coverage contract and guide. The native-exit and trace-attribution integration does not establish those properties. Preserve both limitations rather than silently broadening the reported qualification.
Assisted-by: Reimu (gensokyo-skills:reimu-incident-triage)
The receipt's agent_env_run is recorded in a finally block, so a failed
receipt says how the last run ended, how many runs there were and which
public ECR refusal ended it: public_ecr_quota is data_limit for the
per-IP data-transfer cap and rate for a request-rate refusal. Only a
rate refusal earns the one retry; the data cap fails the lane at once,
since a pause on the same runner cannot lift it.
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Bound recent decoded history to complete UTF-8 prefixes and reuse the bounded capture implementation without changing command Evidence or wire queue accounting. Add deterministic Unicode and invalid-byte coverage, and document history retention.
Fixes#5091Fixes#5242
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
A captured query name longer than 64 characters is advertised under a
short, collision-safe `query_<n>` alias, with the captured name sampled
in its description; replay maps the alias back, and the manifest keeps
the full name.
Replies cut `recorded_path` and `recorded_query` to 1 KiB and set
`recorded_line_truncated`, so a megabyte-scale recorded URL is not
echoed into every reply; selection still uses the full recorded line.
An explicit empty query (`/api?`) keeps its `?` in `recorded_query`. The
shared WHATWG URL parser reports it as "", like no query, so the replay
exchange reads the delimiter from the recorded URL instead.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Default native one-shot Rizin presentation to plain text before collection while preserving caller colour overrides, literal output, recorded argv and shared CLI/MCP Evidence.
Fixes#4488
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Replay parses a JSON body only when every integer survives exactly; a
body with an integer outside JavaScript's safe range, such as an id of
9007199254740993, is returned as its recorded text instead of with
other digits.
A SIGINT or SIGTERM that arrives while environment-serve reads and
authenticates its files now ends startup with a cancelled result before
the listener binds, rather than binding and stopping at once.
A tool description cuts a captured path longer than 1 KiB at a
character boundary and points to the manifest Evidence, matching the
list sample budget; the manifest keeps the full path.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Record the admitted selected path separately from canonical artifact identity in successful and partial Evidence. Anchor relative inputs consistently across both CLI routes using the existing caller-path owner.
Adapt shared client verifier assertions and boundary coverage from PR #5261, and the dedicated-route anchoring correction proposed in PR #5265. Historical parsing remains independent of live paths, including legacy records without the parameter.
Validation: 118 focused tests in eight files, static and docs checks, discovery, and installed Gemini CLI 0.29.5 loopback verification of 207 schemas/241 examples passed. Synthetic static-analysis fixtures; no live Google API or native target execution.
Fixes#5258
Co-authored-by: kwakhyun <khyun2348@naver.com>
Co-authored-by: vishal-tambi <tambivishal3@gmail.com>
The environment-manifest view projects HAR captures only, and replay
reads HAR's response fields, but the loader accepted any web network
capture format. A hand-paired SAZ, mitmproxy or qlog capture would load
and replay empty bodies; it is now refused as invalid input naming the
format, before the pair is checked.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sample captured observations, request-body keys and record ordinals before joining them. Preserve complete manifest facts and replay selection, and show omission counts with their Evidence source. Share the capture trust notice across standalone cards, tool discovery and MCP initialization.
A parameter description lists at most ten observed values, each cut at
64 characters, followed by a count of the rest. tools/list and the
environment card are served whole, so a capture with many or very long
path values no longer inflates them; the manifest keeps every value.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add an explicit Streamable HTTP entry for environment/gateway hosts while keeping stdio registrations and default behavior. Preserve the shared provider/session owner across DELETE and replacement; fence and drain tool/completion work before handover or teardown.
Bound HTTP input and plain-response admission, cancel refused bodies, join whole exchanges and asynchronous response cleanup before provider hooks, gate startup readiness, and reject queued HTTP/1.1 pipelining while retaining sequential keep-alive.
Validation: 8 static/build tasks, 83 adapter tests and registry metadata pass. A real installed gh binary produces seven equivalent CLI/stdio/HTTP reports with DELETE/replacement and clean signal shutdown. Broader local native-provider/ownership failures reproduce on clean main and are documented with limitations in the PR.
Co-authored-by: Edgar Arakelyan <edgar.arakelyan@scale.com>
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
The bundle's manifest.json and evidence.json are copies of captured
content, which can include values an application returned such as
session tokens. They are now written with mode 0600 regardless of the
caller's umask. The Dockerfile already copies them with --chown for the
runtime user, so the served environment can still read them.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Replay ranks a record whose path segment equals the argument as written
above one that matches only after percent-decoding, so two recorded
spellings that decode alike no longer resolve by manifest order.
The /agentenv data plane answers -32600 for an id that is not a string,
number or null and for params that are not an object or array, and
refuses a batch of more than 100 messages before building any reply.
The environment MCP server now extends RequestTrackingMcpServer, which
the HTTP owner requires since the streamable-HTTP change it builds on.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Keep exact wildcard, whitespace and aligned-mask validation in the shared
domain refinement. Advertise descriptive string inputs instead of repeating
regexes, and remove discarded byte/mask array materialization.
Preserve caller spelling and error precedence; cover large public stdio
queries, provider-boundary parsing and connection recovery.
Fixes#5257
Classify loopback from the actual bound IP only, then add the configured name to the Host/Origin allowlist. Remove DNS-name classification and the default/fallback that substituted configuration for binding evidence.
Validate the TCP address once before URL/allowlist consumers, preserve IPv4 and IPv6 alias behavior, and add negative controls for localhost names bound to non-loopback IPv4 and IPv6 addresses.
Make the web-response writer own one reader and one cancellation operation across headers, pumping and completion, so every output exception retains source cleanup before provider teardown. The pump borrows that ownership instead of releasing the source on its own.
Reject raw fragment delimiters before parsing origin-form request targets, preserving percent-encoded query data. Add real HTTP negative controls for malformed chunks, invalid output headers and query fragments.
Own complete node HTTP exchanges and separately join response-source cancellation before provider hooks. Retain plain-response admission through asynchronous cleanup, preserve prompt HEAD delivery and MCP SSE admission, and fail closed on unsuccessful cleanup.
Reject queued pipelined requests before allocating work or buffered refusals, keep sequential keep-alive, and withhold all routes until server construction succeeds. Add real HTTP regressions for cancellation, late responses, tee ownership, cleanup failures, resource capacity, pipelining and keep-alive.
Push optional native symbol selection into GNU objdump before collecting Evidence. Preserve native matching, raw output, artifact identity, scoped limitations and the existing full-disassembly default through the shared CLI/MCP workflow.
Fixes#5159
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Track admitted route dispatches until their finalizers settle, retain admission while uploads remain unfinished, and separate MCP cancellation from provider hooks. Reuse staged transport cleanup for startup failures and normal shutdown. Cover plain-route cleanup, incomplete streaming uploads and pending-factory failure with real HTTP requests.
gensokyo-dev