* feat(desktop): capture a Linux desktop application in use
Add `capture-desktop-application`, a CLI-only, Linux and X11 capture that
launches an installed desktop application, watches it while it is used and
writes capture Evidence plus SHA-256 addressed content:
- inventory: desktop entry, launch command, executable, package and its
apt sources (or snap, flatpak, AppImage), Electron markers and candidate
state directories;
- session: the launched process tree, client windows from xprop with the
first application window time and a window match, and files held open;
- state: a stat walk of the home directory before launch, at checkpoints
read from stdin, at stop and after exit, with created, modified, deleted
and retyped paths and the content of changed files and state directories.
It refuses non-Linux hosts, missing DISPLAY or xprop, a non-empty output
folder and an application whose window is already open, and signals only
processes it started.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): own launched processes, confirm walk coverage and keep cancelled captures
- Launch through the owned provider path with a run token; release with
SIGTERM, then the token-verified group cleanup, after every session.
Processes without the token are never signalled; each records whether it
carries it, and the session records whether cleanup was verified.
- Report creations and deletions only where a walk listed the nearest
existing directory; count the rest as unconfirmed.
- Retain a file only when it is still the walked version, through owned
no-follow reads; charge the budget only for new content; create files
exclusively in a private output folder owned by the caller.
- Walk content roots outside the home directory, compare paths in their
physical spelling, and run executables from the caller's directory.
- Refuse when the window list cannot be read, re-evaluate window ownership
each sample, handle one queued request per sample with a bounded stdin
queue, and write the capture with end reason `cancelled` on interruption.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep owned cleanup failures and fresh digests
- Allow a capture cancelled before any requested checkpoint to hold only the
baseline.
- Retry an incomplete stop once; if cleanup is still unverified, write the
capture and fail with the run token and process group as cleanup
resources.
- Classify path changes after a walk (ENOTDIR and other selected-file
errors) as changed_since_walk instead of failing the capture.
- Treat a non-directory ancestor as proof that nothing existed beneath it.
- Report a before digest only for the file version it was read from.
- Derive stderr_truncated from stderr's own byte counts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* wip(desktop): state view over a capture folder
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep failed file-handle closes owned for retry
Content reads pass retainFailedClose, so a handle whose close fails stays
owned by the content store; the capture retries those closes after it is
written and fails with the output folder as the cleanup resource if one
still cannot be closed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(desktop): read a captured application's state
Add inspect-desktop-application-state, a CLI command that reads a capture
folder into the application's state: every retained or changed file with
its role and reasons, a typed JSON view of each version (SQLite through the
shared worker, dconf through a private dconf dump, JSON, XML, key files,
text) and the kinds of change between versions (lines, values, keys, rows).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): report process and handle cleanup failures together
When both the launched processes and a retained file's handle remain
unresolved after the capture is written, one cleanup error now lists both
reasons and both resource sets.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(desktop): export a captured application as an agentenv computer app
Add export-desktop-application, which writes an agentenv bundle with one
computer_app environment from a capture folder and its state view: the
apt package, a boot launch matched on the captured window class with a
window ready check, owned paths from the state roles, a seed of the
baseline files, data hooks that call agentenv's add/get/reset helpers
with a typed JSON view on get, a skill, a README and a deploy smoke task.
The desktop CLI commands now load their services lazily.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep state views faithful to the capture
- Read key files, XML attributes, dconf groups and SQLite tables into
dictionaries without inherited properties, so captured keys such as
__proto__ stay data.
- Version databases with their write-ahead log as of each checkpoint, and
stage only digest-verified bytes for the SQLite and dconf readers.
- Detect the format per version, report format changes, keep JSON null and
empty containers as values, keep XML text and preserved whitespace, and
mark truncated views (including XML depth) and comparisons of them.
- Number versions and changes by checkpoint index, decide baseline
presence from the captured type, and keep tagged SQLite integers, text
bytes and blobs distinct.
- Carry the capture's limitations and omitted content forward, match state
directories by their home path, index changes once per capture, keep
failed handle closes owned, and finish the CLI through the shared owner.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep coverage, logs and handles honest in the state view
- Read coverage flags only from formats whose readers write them, so JSON
fields named truncated stay data.
- Fail a SQLite version whose write-ahead log existed but was not retained
or does not match its digest, instead of reading the database alone.
- Close retained content on every exit, including cancellation, and report
a close that still fails together with the primary failure.
- Finish the CLI with the canonical operation name.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): export only what the computer can install and seed
- Refuse packages not from the Ubuntu 24.04 archive, since the computer
installs by name from that archive.
- Start the launch command in the captured working directory.
- Respell the home path only in files the state view read as text.
- Report files that were not retained instead of dropping them silently.
- Load captured dconf keys for apps that own no files.
- Keep home-level files as owned paths; rename reserved Python class names.
- Mark truncated SQLite and text views in the class's get view, and read
file types the way the state view does.
- Release the output tree through a resource scope, and read seeds through
an owner closed on every exit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep staged folders owned, symlinked state roots and XML values
- Stage database bytes in a private runtime root released through a
resource scope, so a failed removal keeps its owner and is reported with
the read's outcome.
- Report cleanup facts and owners from desktop failures instead of
wrapping them as a plain adapter error.
- Record the state directories as walked, in their physical spelling, and
match roles against both spellings, so files in a symlinked state
directory are not mistaken for selected documents.
- Keep whitespace-only XML leaf values; drop only formatting between
elements.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): read XML in the exported app the way the state view does
Keep whitespace-only leaf values and xml:space="preserve" text in the
generated get view; drop only formatting between elements.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): release retained handles with their owners, read older captures
- Release retained-content handles whose close failed through a resource
scope on every exit; a release that fails again reports the exact handle
owners. A read that finished keeps its bytes when only its close failed.
- Accept captures written before state directories were recorded, and say
in the state view's limitations that symlinked state directories may be
misclassed for them.
- Compute each XML element's whitespace context once instead of scanning
siblings for every text run.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): boot without the working folder, bound XML, accept mirrors
- Try the captured working directory only when an argument is relative,
and start the app even when that folder is missing.
- Cut the generated XML view at REA's node and depth limits, and keep one
unreadable file from failing data/get.
- Accept Ubuntu 24.04 mirrors, not only the canonical hosts; PPAs and
other repositories are still refused.
- Read seeds through the retained-content owner's new signature.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): state view review round
- Stage a retained -journal beside its database so the SQLite worker
accepts an inactive journal and refuses a hot one; a -wal or -journal
that existed but was not retained (including one omitted at the
baseline) makes the version unreadable.
- Keep tables that read when another fails, and let cancellation and
unfinished cleanup propagate instead of becoming view errors.
- Read text as a key file only when every line parses as one.
- Rank a file named in a window title or selected by the caller as a
document even when the application holds it open; match titles on
file-name boundaries; leave the display name out of dconf matching.
- Bound JSON and key file views (4 MiB, 500 levels, exact numbers) and
report too-large, missing and altered retained content separately.
- Add no version or change while a database stays absent.
- Read staged databases in place instead of copying them again.
- Give Evidence the same limitations as the result.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): export review round
- Load captured dconf keys without D-Bus: install dconf-cli, compile the
existing and captured key files into the user database, and warn on
failure instead of stopping the server.
- Start relative-argument launches in the captured working directory,
the home included, since the framework launches from the app folder;
respell the home itself and option values under it.
- Read views in a thread, skip files over 64 MiB, align the generated
readers with the state view's, and close SQLite connections.
- Never own the home or a shared base folder; map a symlinked state
directory's files back to their home spelling.
- Report omitted files and unretained opened folders.
- Name the module so it cannot shadow another, and keep the class off
the module's own names; derive names the bundle check accepts.
- Write seeds as they are read, and remove an unpublished bundle on
failure.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): capture review round
- Ask the launch process group and token carriers to exit before
killing them, on errors too; report incomplete cleanup with its facts.
- Count descendants of the launch as started by the capture even when
their environment cannot be read; treat a reused pid as a new process.
- Follow symlinked desktop entries; name a flatpak's state after its
application id; match flatpak windows by name only.
- Stop on end of input; refuse empty, duplicate and reserved checkpoint
names; require whitespace after the checkpoint keyword.
- Stay on each walk root's device, and never walk or retain `/` or a
directory containing the home; say so in the limitations.
- Refuse a window manager that does not publish _NET_CLIENT_LIST.
- Remove retained content when a capture fails before it is written.
- Skip reading a file larger than the remaining content budget.
- Record apt's archive origin for each package source.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): read an unset client list as no windows when supported
xfwm4 leaves _NET_CLIENT_LIST unset while it manages no windows, so the
capture refused an ordinary desktop with nothing open. Read
_NET_SUPPORTED with the list: an unset list means no windows when the
window manager supports it, and the capture is refused only when it
does not. `xprop`'s "no such atom" output now reads as unset too.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): accept packages by apt's archive origin
Accept a package source when apt reports its origin as Ubuntu for a
noble suite, so mirrors count and PPAs or other repositories that merely
have "ubuntu" in their URL do not. Captures made before origins were
recorded fall back to Canonical's own archive hosts. Seed reads report
why retained content could not be used.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(desktop): capture and export apps from vendor apt repositories
A closed-source app installed from its vendor's apt repository, such as
Typora, can now be captured and exported as a computer app.
- The capture records each non-Ubuntu repository listing the installed
version (uri, suite, components from apt's sources files, one-line or
deb822) and the key that signs it: the signed-by key, or the trusted
key that gpgv shows verifies the repository's signed index. The key
is retained with the capture.
- The capture records the packages owning the libraries the executable
loads (DT_NEEDED with RUNPATH and the linker cache, through REA's ELF
readers), since a vendor package may not depend on them.
- The export declares a verified vendor repository as an AptSource with
its key, installs a vendor package's library packages, and adds
--no-sandbox to an Electron app's launch, since a container denies
Chromium's sandbox.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): report a locked database at once in data/get
A database the running app holds locked made each data/get wait sqlite's
five-second busy timeout before reporting it. Record the Typora run in an
agentenv computer in the verification.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf(desktop): detect key files without splitting the whole text
Read lines one at a time and stop at the first that a key file view
would drop, instead of splitting a file of up to 64 MiB into arrays
before its format is known.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep symlinked homes and state folders under the home in exports
- Respell a path under its state folder's logical spelling only when that
spelling is under the captured home, so a symlinked HOME keeps its
files; pair walked and logical state folders only when the capture
lists the same number, and match the innermost folder first.
- When two files map to one home path, keep the one present before the
capture and name the other in the limitations.
- Read key files in the generated data/get with the state view's rule,
checked against it by running the helper under python3.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): end captures on zombies and keep cleanup owners
- A zombie or dead process no longer keeps the session open.
- Remove only the partial capture file this run created.
- Keep the exact owners of handles and processes whose cleanup failed on
the returned error, so a retry can release them; test the published
capture's cleanup-failure branch with mixed outcomes and retries.
- Release the application once even when the exit checkpoint fails.
- A cancellation before the capture is written removes what it retained.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): vendor package review round
- Match apt sources through `apt-get indextargets`, which covers flat `./`
and `/` suites and gives each release file and sources entry.
- Accept a key whose signature verifies even when the release carries
another signature without a key here; keep only the verifying key from
a keyring holding several (OpenPGP packet splitter).
- Install the package from its repository's release (`name/<release>`),
declare one source per URI and suite, support only the capture host's
architecture, and refuse Ubuntu Pro repositories.
- List only library packages the computer can install; walk libraries only
for vendor installs, with RPATH inherited as ld.so does, normalized
paths, and DT_NEEDED bounded while reading.
- Put --no-sandbox after the program an env wrapper launches; keep the
gpgv folder's owner when its removal fails; respect --max-file-bytes for
keys; wait 0.25 s on a busy SQLite database in data/get.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(desktop): keep the vendor spec's gpgv command on one line
A code span broken across lines left `<binary keyring>` for VitePress to
read as an unclosed HTML tag, so the docs build failed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(desktop): add a validated task to exported desktop applications
Each capture can now yield one agentenv task in its exported bundle. An
agent writes the task (a prompt plus declarative checks over the app's
data/get views); REA validates it and stays model-free.
- `describe-desktop-application-task` summarises a capture's net change
per file (role, format, views before and after) and drafts checks.
- Checks: file presence, lines present/absent/counted, JSON-pointer values,
SQLite rows and counts. REA keeps a task only if a check fails on the
seed and every check passes on the captured end state; a file that was
not retained at the baseline counts as absent, as the computer starts.
- `export-desktop-application --task` writes tasks/NAME.json (deploy,
agent, skills, recording, prompt, verifier), a compiled verify.py that
reads data/get, and an eval. A boundary test runs the verifier under
python3 and checks it agrees with REA's evaluator on every check kind.
- Docs, spec and skill guidance, with the solve-rate recipe.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(desktop): keep the seed test in its own block
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(desktop): record the task verifier driven in an agentenv computer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(desktop): record the Typora task run in an agentenv computer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep task checks bounded, complete and attributable
- line_count counts lines holding a substring (contains) instead of
matching a regular expression, which could stall the verifier on
agent-written text and read differently in Python.
- value_equals of a whole object or array is undecided on a truncated
view.
- The draft keeps a database whose rows changed under an unchanged hash,
and a file whose truncated views match while it changed.
- A task file that cannot be read keeps the reader's detail, and a failed
cleanup keeps the read failure as its primary.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): leave a file with one version out of the task draft
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(desktop): update the task verification's test counts
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(desktop): record the task solve rate with Claude Code and Sonnet 5.5
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(desktop): capture and export apps installed from a downloaded .deb
capture-desktop-application --package-file reads the file's control fields
with dpkg-deb and records its SHA-256, size and dependencies when it holds the
installed package; the file itself is never kept. The library walk now also
runs for local installs.
export-desktop-application --package-url declares agentenv's
Download(url, sha256) for that file, its dependencies and library packages as
apt packages, and a run script that installs it with dpkg.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): seed app-named dotfiles and respell UTF-16 seeds
The capture now treats dotfiles in the home named after the application
(.varicad-cfg.ini, .notesrc) as state roots, so a file the app only reads
during the capture is still seeded. The exported seeding respells the
captured home in UTF-16 text files with a byte-order mark, keeping the mark.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): hold readiness until the app's own window shows
An exported app is ready only once a window of its class that the taskbar
lists is shown, so a splash screen of the class, which skips the taskbar, no
longer counts as the app being up.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(desktop): record VariCAD captured, exported and run in an agentenv computer
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep exported views strict JSON for infinite and inexact numbers
The exported data/get spells infinite and negative-zero SQLite reals as REA's
SQLite reader does ("Infinity", "-Infinity", "-0"), and refuses a JSON file
holding a number that reading would change (1e999, integers past 2^53, -0,
rounded fractions) with the state view's own error, instead of a view with
an infinity in it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep package-file facts tied to one file and URLs unechoed
- A --package-url refusal never repeats the URL, and credentials are checked
before the scheme.
- The package file's identity must hold between dpkg-deb's read and the hash.
- A failed close keeps its cleanup owner even when the capture is cancelled.
- Readiness also ignores windows typed as splash screens.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): record database logs and keep state changes distinct
- A selected path that is not a directory brings its -wal and -journal as
content roots, so the capture records whether they exist and retains them.
- The state view treats a file as absent only under recorded content roots
and refuses a database whose log presence is unknown.
- JSON changes list containers too, so an array that becomes an object with
the same members is a change.
- Key file entries escape the key as a JSON pointer segment, so [a/b] c and
[a] b/c stay apart.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep watching through unread samples and late workers
- An unreadable window list is unknown, not zero windows, and is named in
the limitations.
- Before ending the session, live run-token carriers no parent link reached
are tracked; an unreadable process table leaves the exit unknown.
- An env prefix's assignments find the program and name its XDG folders.
- flatpak run options that take a value are skipped with it, -- is honoured
and a /arch/branch suffix is dropped from the id.
- State directories include the entry's full id.
- Path options refuse empty values; roots count toward the entry limit.
- A capture file whose close failed stays owned and is retried on discard.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): bound apt sources, keep older captures and cleanup owners
- Sources files parse into one stanza per line or deb822 paragraph with its
URIs and suites kept as lists, so no URI x suite product is built.
- Repository architectures and release are optional, so captures written
before they were recorded parse; the export treats them as unrestricted
and unknown.
- Library sources are matched against every index of a declared
repository's URI, suite and components.
- Two failures side by side keep both causes and both cleanup owners, and a
host file whose close fails reports a lease on its handle.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): match escaped key file entries and suggest containers through members
- The draft's key file lookup uses the state view's escaped `group/key`, so a
key holding `/` or `~` still gets its suggestion.
- JSON and XML changes now list containers too; the draft suggests an added
or removed container through its listed members, and a container only
when none of its members is listed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): read relative PATH entries from the launch folder
A program, or an empty or relative PATH entry, is resolved from the folder the
program starts in, as the launch does, so `env PATH=. app` with the entry's
Path still finds the app.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf(desktop): compare JSON views on one shared path
JSON and XML changes are found by walking both trees with one shared pointer
path, building a pointer only for a listed value, so memory follows depth
rather than every container's full path. A pointer over 4096 characters is
counted but not listed. A 256-level document with 4000-character keys went
from about 251 MiB of heap to under 1 MiB.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep JSON Lines as text in the exported reader
The exported reader parses the whole text before an inexact number makes it
JSON with an error, so JSON Lines with an integer above 2^53 stay text as in
REA. Over-long integer spellings are unsafe without converting them. The
guide no longer claims large integers keep their value.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep the state-path help free of dash-led words
The CLI alias check reads `-wal` and `-journal` in help text as short flags,
so the help names the write-ahead log and rollback journal instead.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): never record or export apt source credentials
- Source URIs lose any user name and password as they are parsed, the way apt
splits them, and so do index-target URIs and descriptions and the sources
apt-cache policy lists, so matching works whether or not apt prints them.
- A repository whose entry held credentials is marked
`uri_credentials_removed`, and the export refuses it, or an older capture
whose URI still holds them, with a reason that names no URL.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): look programs up without normalizing their paths
Program paths and PATH entries are joined rather than resolved, so `..` after
a symbolic link means what it means to the launch. The lookup moves to its own
module.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): note inexact JSON numbers with a flag, not a list
The exported reader only needs to know whether any number was inexact, so it
keeps a boolean instead of every rejected spelling.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): refuse older captures that still hold apt credentials
A capture written before credentials were removed counted the credentialed
repository's libraries as installable, so the export refuses it whole and asks
for a new capture rather than declaring packages no source offers. Recorded
policy sources are redacted in export messages too.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(desktop): keep the credential fixture on an example host
A login on a real host reads as a secret to the commit scanner, so the older
capture's fixture uses apt.example.com like the other credential tests.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): tidy looked-up paths and search relative entries only for env
Empty and `.` segments are dropped from a looked-up program path, which keeps
`/snap/bin/` entries recognisable as snaps, while `..` is still left for the
kernel. Relative and empty PATH entries are searched only in the PATH an `env`
prefix sets, which travels with the exported launch; the host's own PATH does
not.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep excluded and unwalked database logs unknown
The capture records the paths every walk left out, and the state view treats
a log as absent only under content roots the baseline walked completely and
outside those exclusions, so an excluded or unvisited log leaves the database
unread rather than read without it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): judge JSON numbers after duplicate keys settle
The exported reader marks an inexact number instead of flagging it during the
parse, then looks for marks in the parsed value, so a number a later duplicate
key overwrote no longer refuses the file, as in REA.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): redact a repository's policy source when it names it
An older capture whose policy source matched no sources entry kept that text
whole, and the export named the repository by it; the export now names it
without any user name or password.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): never signal the launch group on unknown membership
When the current read cannot observe a carrier's process group, the carrier
is signalled on its own instead of letting an older process-table row grant
a group-wide SIGTERM.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): look programs up in the launch's order and refuse host-relative finds
The lookup searches PATH as the launch does, an empty entry meaning the
launch folder, so inspection and launch name the same program. A program found
only through a relative or empty entry of the host's own PATH is refused,
since the exported computer would not have it; an env prefix's PATH travels
with the command.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): count unchecked paths and keep logs behind them unknown
Each walk counts the paths it could not stat and the directories on another
device it did not enter, and the checkpoint records it as `unchecked_paths`.
The state view treats a log as absent only when the baseline left nothing
unchecked, so a log whose stat failed stays unknown.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* perf(desktop): scan parsed JSON with one iterator per level
The check for marked numbers walks the parsed value with an iterator per
nesting level instead of copying each container's children; a million-entry
array went from about 15.7 MiB to 8.1 MiB of peak traced memory.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): start a relative program from its captured folder
An exported launch whose program path is relative, such as `./app` from an
entry's Path, now changes to the captured working directory first, as it
already did for relative arguments.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(native): page retained feature traces
* fix(snapshot): retain linked source evidence for replay
* test(snapshot): verify linked foreign evidence stays scoped
* docs(mcp): clarify imported residual questions
* docs(mcp): guide trace reference classification
* fix(cli): report result sources when Evidence publication fails
A trace keeps linked sources on the result. Use those records for the
undelivered source closure as well as the bundle, so a refused output
does not report them as not captured.
* ci: rerun pull request checks
The merge of origin/main did not start the CI workflow for this head.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(native): retain value trace source evidence
* fix(native): build trace error evidence only on failure
* test(mcp): expect unowned value trace refusal
* test(mcp): avoid freezing trace error wording
* test(native): keep value-trace stop coverage with source evidence
Main's stop and continuation cases now meet the trace's evidence-owner
precondition: direct calls supply a source id, and a completed MCP trace
runs in a session that can retain it.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(native): find procedures by the secondary names exact lookup accepts
search_procedures matched only each procedure's primary name, while exact
lookup also accepts Kuna inventory aliases (versioned-symbol and generated
sub_ names) and Ghidra symbols at an exact function entry. A search for a
name procedure_address resolves returned nothing, and trace_feature
silently missed the procedure.
Both providers now match the same names their exact lookup accepts. A
procedure still appears once under its primary name; the optional
matched_aliases field lists the secondary names that matched, so aliases
never become procedures of their own and list_procedures is unchanged.
The shared domain helper owns that row rule for Kuna and for the Ghidra
host-side Unicode folding pass. The Ghidra analysis profile records the
new search semantics so older snapshots cannot replay alias-blind results.
Fixes#8330
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ghidra): match leaf spellings of procedure names in search
procedure_address accepts each entry symbol's leaf or namespace-qualified
spelling, but procedure search tested only qualified names, so a regex
such as ^audit_alias$ missed a secondary symbol ns::audit_alias (and ^same$
missed a primary alpha::same) that exact lookup selects.
Lookup and search now share one bridge definition of the names that select
a procedure, so they cannot drift. Matching secondary symbols are still
reported by their qualified names; because a leaf ends its qualified
spelling, the host's Unicode literal pass stays exact over those names.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Bind typed service creation, observed availability and retryable cleanup in one composition owner. Reuse selected CLI/MCP factories and canonical contract groups without copying provider operation inventories.
Closes#8429. Refs #740.
Validated paired real application workflows, actual local Codex CLI Terra/high use, complete Evidence and Unknown checkpoint parity, compiler-backed import boundaries, SDK schemas and final real mixed routing. Automated review findings were fixed at their producing owners. Existing exact-base CodeQL alerts are documented on the PR under the owner-authorized unrelated-check exception; no global alerts or security rules were changed.
Assisted-by: Suika (gensokyo-skills:suika-scatter-gather-planning)
* fix(ghidra): decide batch names independently of request order
The Ghidra bridge applied set_addresses_names in JSON member order, each
address in its own transaction, so a reordered but equivalent map could give
a shared name, or a name released by another selected address, to a
different address.
The bridge now resolves every destination (namespace and leaf name) against
the names held before the batch. Addresses that request the same destination,
or a name that another selected address holds, are rejected without applying;
the remaining edits are independent and apply as before. Both naming
operations report each failure's canonical address, reason and related
addresses. The adapter projects the bridge reply to the unchanged boolean
results and keeps the reply as raw_result only when an address failed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ghidra): report each contested batch name once
A batch conflict listed every other requester on each failure, so k
addresses competing for one name produced k(k-1) related addresses, and
the adapter retained the whole reply, booleans included, as raw_result.
The bridge now reports each contested destination once in a conflicts
table with its namespace, name, requesting and holding addresses, and
each conflict failure refers to it by index. Conflicts are ordered by
their first requester, so indexes do not depend on member order. Single
and batch naming share one planner and reply layout. The adapter
validates the table in linear time and keeps only failures and conflicts
in raw_result.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(artifacts): inspect classic iNES container regions
* fix(artifacts): preserve iNES source disappearance as integrity failure
* fix(artifacts): revalidate iNES source before parsing header
* fix(artifacts): validate admitted roots before classification
* fix(artifacts): normalize source loss during root hashing
* fix(artifacts): bind iNES extraction admission to inventory
* test(artifacts): clarify non-executing inspection wording
* fix: preserve binary plist detection with extended magic probe
* test(browser): wait for popup document loads before capture
* fix(artifacts): honor cancellation across source validation
* fix(artifacts): prefer artifact magic over implicit database suffix
* fix(artifacts): select extraction readers from scanned format
* fix(artifacts): complete prefix reads and share ZIP format admission
* fix(browser): budget scenario cleanup for content drain and shutdown
* test(artifacts): admit valid universal inputs before routing
* test(artifacts): verify iNES workflows on macOS
* test(ci): own iNES macOS coverage and portable fixture paths
* fix: preserve cleanup retries and avoid duplicate inventory parsing
* fix(contracts): share ZIP target formats across MCP lifecycle schemas
* fix(target): preserve typed cancellation during descriptor admission
* refactor(artifacts): use JSON-safe inventory producer output directly
* test(artifacts): share file read setup and satisfy CI checks
* fix(artifacts): classify changed admission as integrity failure
* ci: run Mach-O summary delivery coverage on macOS
* test(javascript): align parameter provenance with main contract
* test(browser): await discoverable fixture pages before runtime verification
* fix(artifacts): pass target metadata to format detection
* fix(artifacts): bind extraction to opened target
* fix: repair the static-check failures on the default branch (#2895)
* fix: repair the static-check failures on the default branch
The default branch fails its own required `Static checks` job three ways, so
every pull request reports that job as failed regardless of its own change.
- `npm run format:check` reports `src/domain/functionComparison.test.ts` and
`src/ida/IdaOperationRunner.ts`.
- `npm run lint` reports a duplicate `import { join } from "node:path"` in
`tests/boundary/mcp/ghidraInventoryMcp.test.ts` (lines 4 and 17).
- `npm run typecheck` reports `format: "devin"` missing from the client format
union in `src/application/SupportedClients.ts`, and an unchecked index in
`tests/boundary/cli/clientProfileLifecycle.test.ts`, whose pair array is
inferred as `string[][]`.
Apply the pinned formatter, drop the duplicate import, list the `"devin"` format
that its own definition already uses, and mark the pair array `as const`.
Validation: `npm run check:fast` and `npm run format:check` pass.
* fix(setup): keep Devin on the JSON configuration dialect
---------
Co-authored-by: 吴佳浩 <wujiahao@supremind.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
(cherry picked from commit df3d96da80)
* fix(artifacts): bind session inventories to target identity
* test(browser): bound fixture readiness acknowledgements
---------
Co-authored-by: 64579525 <17373302683@163.com>
Co-authored-by: 吴佳浩Alben <35291372+XiaoBinGan@users.noreply.github.com>
Co-authored-by: 吴佳浩 <wujiahao@supremind.com>
* refactor(javascript): break the semantic analysis import cycle
Split shared semantic facts out of the analysis hub so projectors of
effects, evaluation, and identity no longer import one another in a cycle.
* refactor(javascript): share the import specifier reader
Read static imports in one module used by the boundary checker and both
cycle guards, so those rules cannot drift apart.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Reuse the pinned SDK's combined array-element and object-member admission
before canonical validation, deferred runtime loading and tool execution.
Share a configurable finite allowance across eager/deferred HTTP and stdio,
and project refusals to bounded, actionable transport resource errors.
Preserve canonical CLI/application contracts, caller-selected input values,
ordinary validation semantics and complete Evidence access. Exercise actual
transport boundaries, real artifact/TShark workflows, packaged installation,
continued service and downstream identity/capacity regressions.
Fixes#7882
BREAKING CHANGE: MCP tool arguments now default to 1,024 combined array
elements and object members per call. Select a larger positive finite
REA_MCP_MAX_INPUT_ELEMENTS allowance and restart for larger inline inputs,
or use retained/file selectors where supported. Inputs are never truncated.
Assisted-by: Reimu (gensokyo-skills:reimu-incident-triage)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Use one command owner for setup, client writers, Gemini policy and CLI defaults.
Migrate recognized runner registrations with backups and remove runner prewarm.
Retain unknown identities and exercise real offline npm, CLI and MCP workflows.
Fixes#7757
BREAKING CHANGE: managed MCP registrations use the selected absolute runtime
and REA entry script, including package-runner cache paths. Keep that installation
available or restore it before setup; unknown registrations require confirmed
manual repair. Setup no longer returns prewarm or emits its progress events.
Assisted-by: Reimu (gensokyo-skills:reimu-incident-triage)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Ship Claude Code and Codex from one release-pinned npm artifact with bundled runtime dependencies, extraction-only MCP qualification, plugin-aware recovery, and synchronized release metadata.
Integrates #2815 and the original proposal #1977. The original commits remain available on the PR branch; retain their author and assistant credit in this squash.
Validation: required CI passed, real Codex/Claude loading verified, and reviewed packaging/recovery findings addressed.
Co-authored-by: GamerDubz <themastergamerplays24.7@gmail.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
Co-authored-by: OpenAI Codex <openai-codex@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Use one typed-checker worker by default without changing semantic scope or caller overrides. Reuse the bounded CLI worker for pure argument validation while retaining fresh-process coverage and all upstream cases.
Keep registration tests independent of real package-runner downloads while asserting the actual prewarm command and startup context. Pass the advertised binary_session definition by name to package verification, retaining default SDK validation and complete catalog/contract checks while avoiding compilation of unrelated tool outputs. Preserve all four installed-tarball scenarios and existing deadlines.
Strengthen Hermes preview operation/backup assertions and clarify physical-path routing documentation.
Assisted-by: Suika (gensokyo-skills:suika-scatter-gather-planning)
Save typed response fields and reuse generated IDs or authentication values across browser scenario requests, UI observations and navigation through the shared CLI/MCP workflow.
Preserve exact numbers, retained Evidence, explicit source/coverage limits and prospective page-value semantics. Bound response decoding, retained spellings and request serialization before allocation, and protect marked response values across source records, follow-up text and planned screenshots.
Integrates Edgar Arakelyan's #7162, including follow-ups through 9f5191ab0. Final local validation: 560 feature-branch tests and 561 current-main integration tests, static/build/docs checks and real PocketBase CLI/MCP privacy workflows. Whole-task comparison and verification limits are recorded in docs/verification/browser-saved-values-2026-10-26.md.
Co-authored-by: Edgar Arakelyan <edgar.arakelyan@scale.com>
Move shared function, dossier, inventory, reference and output semantics from the legacy Hopper module to native domain owners. Migrate provider, adapter, test and verifier consumers directly.
Attach to external browsers without implicit default-context overrides, and own temporary focus only on the selected page. Preserve unrelated page media and exact page inventory through CLI/MCP. Remove bootstrap-page retries; retain late/failed cleanup ownership and verified SDK notices.
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Route six artifact verifiers through the canonical complete MCP output and error parsers. Remove duplicated JSON/schema interpretation while retaining Evidence authentication, provider provenance, independent CLI parsing and CLI/MCP parity checks. Validate malformed success/error envelopes at the shared boundary.
Validation: 11 boundary tests, Go compiler verifier (30 cases), and synthetic IL2CPP/Flutter verifier workflows passed; typecheck/lint passed. PCAP readiness passed with stub tools, but capture inspection is unsupported on macOS. Linux-only binary-layout and EVM verifier toolchains were unavailable.
Upgrade Zod to 4.6.6 and refresh locked license inventories. Preserve REA's established timestamp spellings through one shared UTC/offset grammar, including completion-verifier consumers. Size the stdin resource regression from the child's actual heap capacity.
Fixes#7173
Includes the dependency and inventory changes proposed in #7184.
Co-authored-by: tijo95 <georgesarmede@gmail.com>
Scope MCP discovery, setup, doctor, status and recovery guidance by selected tool families using one contract inventory and shared catalog identity. Preserve default discovery, canonical validation and complete Evidence.
Fixes#3246. Builds on #3026. Real libcrypto workflow verifies all 5,367 exports and identical complete Evidence. Static/source/build/docs/Windows/package/Greptile checks pass; ten assertions reproduced identically on clean main and feature across Node 24/22, with cancelled coverage explicitly unverified. Merge uses the user-authorized bypass for baseline failures and unchecked human-readiness declarations, without attesting human review.
Co-authored-by: 0xLLVEL <fakhrezan1@gmail.com>
Co-authored-by: Codebuff <noreply@codebuff.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Share ordered schema positions between Gemini literal checks, DeepSeek regex
checks, and catalog array-shape checks. Reuse the canonical keyword and local
reference owners; keep unreferenced instance literals opaque and unresolved
external or dynamic targets unknown.
Gemini and catalog checks now catch constraints in schemas reached through
references into examples. Preserve source paths, resource scopes, cycles and
regex occurrence counts. Align fixture first-error selection with the native
Gemini check and use consistent bracketed array locations in diagnostics.
Validation: 55 focused tests passed, including full/compact MCP catalogs;
typecheck, lint, discovery, and Node source-loader checks passed. The old
Gemini scanner reproduced the local-reference false negative. Installed
Gemini and DeepSeek clients were not run.
Migrate twelve application service files to the existing provider input owner,
preserving schema causes, cancellation precedence, caller selection, and
retained Evidence. Keep flows with distinct error policies separate.
Replace the DeepSeek verifier's recursive object scan with schema-position
traversal using the canonical keyword and local-reference owners. Literal
pattern fields no longer cause false regex failures; patternProperties keys
are checked alongside actual pattern constraints in native regex modes.
Validation: 271 focused workflow/service tests and six verifier regressions
passed; static checks, discovery, and actual Node source-loader smoke passed.
The baseline scanner reproduced the new regressions. Installed DeepSeek client
execution was not run.
Share exact ELF program-header facts across nine consumers while preserving their admission and precision policies. Centralize conformance path and digest binding, retain verifier-specific checks, and route fixture-owner changes to CI qualification.
* fix(mcp)!: return a compact binary_session status by default
binary_session {} with no target open returned about 66 KB, most of it
provider rejection diagnostics and candidate capability sets that the
skill's recovery flow re-reads on every retry. 6.8.0 grew it by 21%
because the shared regex capability limitation began repeating setting
bounds and step-by-step recovery for every search operation of every
provider (#6099, #6267, #6301, #7049) and IDA gained that limitation for
its two search operations (#4862).
The regex limitation now states the effective deadline and heap, their
sources and where to change them; the deadline and heap errors keep the
full recovery. binary_session gains detail: summary (default) or
complete. The summary keeps open state, target identity, the binding,
route capabilities, run, activity and health status, each candidate's
availability and target-support status, code and reason, and every
tool's availability, reason, remediation and modes, and lists the
fields it leaves out in omitted_fields. Complete detail returns the
previous shape. The CLI capabilities and providers commands keep
complete provider facts through the same application projection.
BREAKING CHANGE: binary_session {} no longer returns
analysis_provider_candidates[].availability.diagnostics,
target_support.diagnostics or capabilities, or tool_availability group
surface, effects and annotations. Pass {"detail": "complete"} to get
them.
Fixes#7109
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(mcp): key binary_session output fields by detail
The output schema accepted detail: "complete" with summary candidates or
tool groups, and a summary without omitted_fields, so detail did not
tell callers which fields existed. Each session kind is now crossed
with a detail-specific shape: a summary requires omitted_fields and
summary-only candidates and tool groups; complete requires diagnostics,
candidate capabilities and static tool flags and forbids omitted_fields.
Both the canonical schema and the SDK-validated advertised schema reject
mismatched shapes.
The verifier helper accepts summary candidates only for a validated MCP
summary; CLI provider output still requires candidate capabilities.
Regex limitation tests check values, sources and setting names instead
of whole sentences.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
morluto