24 Commits

Include renames

Author	SHA1	Message	Date
Anandan	d7ac85cbf9	Polish Zero's TUI and harden patch, model, and background workflows (#916) ... * Checkpoint UI polish * Fix structured apply patch handling * Restore tool previews when resuming sessions * Improve theme-aware code rendering * Replace persistent sidebar with run details * Remove inert transcript interactions * Cover resumed edit previews * Smooth active run status feedback * Preserve semantic colors behind overlays * Normalize ChatGPT model aliases * Render staged image attachments in terminal * Polish transcript and tool feedback * Resolve rebased diff renderer conflict * Address UI polish review findings * Fix smoke test regressions * Harden patch and transcript edge cases * Bind structured patches to workspace root * Use unique structured patch temp files * Retry structured patch temp allocation * Reuse rooted patch temp allocator * Fix Windows CI process checks * Fix structured patch safety boundaries Preserve read-before-write credit only when the model already knew the full source, reject ambiguous hunk matches, and retain CRLF line endings. Add regression coverage for unsafe overwrites, positive tracking cases, duplicate matches, and Windows-style files. * Resolve plan test seam after rebase Drop the obsolete sticky-plan height helper while retaining the PR status test seams brought forward by the UI changes. * Address final review correctness gaps Bound narrow waiting labels, reject malformed plan records, preserve missing final newlines, reject out-of-order EOF hunks, clear stale tracking after failed rollback, and keep deferred tool loading aligned with model visibility. * Harden patch transactions and review edges Publish new patch targets without overwriting raced destinations, journal only completed mutations, and create replacement temps beside their targets. Reject pre-plan diagnostics, cover tool-search transcript suppression, and leave sufficient cleanup time in the Windows process fixture. * Bind patch rollback to committed versions Capture file identity and content before publication, quarantine rollback targets atomically, and refuse destructive undo when a path was replaced or modified in place. Add deterministic coverage for publication and rollback races. * Align structured patch failure semantics Use prevalidated sequential application with explicit partial-success errors instead of unsafe multi-file rollback. Retain atomic per-file publication, no-overwrite creates, unsupported-hardlink fallback, and conservative tracker invalidation. * Preserve patch context bytes Track source offsets for structured-patch context lines and reuse the exact matched source text during replacement. This keeps tolerant matching from changing indentation or mixed line endings outside the requested edit.	2026-08-19 22:18:47 +05:30
3 people	8e266797a8	perf: improve harness context efficiency (#838) ... * Improve harness context efficiency * Address harness efficiency review findings * Make recaps idle and cancellable Delay recap generation until the session has been inactive, orient it around the active goal and next task, cancel stale work on activity, and render the result ephemerally above the composer. Also strengthen the formatter safety regression to exercise formatter-modified edit output. * Track every replace-all edit span Translate each replacement into its post-edit line range, including cumulative shifts from earlier replacements, so follow-up edits remain authorized for every model-supplied change. * Make review regressions cross-platform Verify replace-all tracking through the canonical edit tool path instead of a platform-sensitive temp path, and cover cancellation when recaps are disabled during generation. * fix(tools): derive SeenWhole from the recorded ranges SeenWhole was a flag set only by a SINGLE read covering the file, while SeenRange judged coverage from the accumulated ranges. The two then disagreed about identical reads: after reading lines 1-50 and 51-100 of a 100-line file, SeenRange(1,100) was true and SeenWhole was false. That matters because write_file gates overwrites on SeenWhole. A file past the read byte budget cannot be read whole in one call — the read is truncated and RecordSeenRange is correctly skipped, since the model did not see those lines — so no sequence of reads could ever set the flag, and the overwrite was refused permanently with: the intended change depends on content that has not been read exactly in this session. Read the affected lines with read_file, then retry. Advice that could not change the answer. edit_file was unaffected because it gates on SeenRange, so the escape was to edit rather than rewrite, but a model following the error text would loop. SeenWhole is now computed from the ranges against the file's recorded line count, so scoped reads that together cover a file make it writable and the error text becomes actionable. The observation carries that line count, and a read reporting a different one clears the accumulated ranges: they describe a shape the file no longer has. Coverage is judged by merging sorted ranges rather than walking every line against every range, which the previous SeenRange did — same answer, and it no longer scans line-by-line over a large file. Co-Authored-By: Claude Opus 5 <[email protected]> * test(tools): key the large-file test on the resolved path read_file resolves the workspace root through EvalSymlinks before recording anything, so the tracker is keyed on the resolved path. The test asserted against the raw t.TempDir() path, which is the same string on Windows and a different one on macOS, where the temp dir sits under /var — a symlink to /private/var. The SeenWhole assertions would have looked up a key that never existed: passing here, failing on macOS CI. Also switches the line generator to fmt.Fprintf (staticcheck QF1012). Both from CodeRabbit on #842. Co-Authored-By: Claude Opus 5 <[email protected]> * test(tools): actually switch the line generator to fmt.Fprintf The previous commit's message claimed this was done. It was not: the edit silently did not apply and I reported it fixed without re-reading the file, so builder.WriteString(fmt.Sprintf(...)) survived at the head — caught by @anandh8x, not by me. Verified this time by running the linter rather than by reading the diff: golangci-lint --enable-only unused,ineffassign,staticcheck ./internal/tools/ reports 0 issues. * fix: keep exact-read workflows recoverable * test: cover permission normalization wiring * fix: commit file observations after output budgeting * fix: defer file observations across retries * test: normalize patch line endings --------- Co-authored-by: Vasanthdev2004 <[email protected]> Co-authored-by: Claude Opus 5 <[email protected]>	2026-07-31 23:30:03 +05:30
Anandan	9fe02ae52e	fix(sandbox): clarify scoped permission prompts (#798)	2026-07-24 17:37:32 +05:30
Anandan	96859c9bd1	feat(sandbox): unify command execution and enforcement (#781) ... * feat(sandbox): unify command execution and enforcement * test(sandbox): make platform contracts portable * fix(sandbox): close execution lifecycle races Bound retained interactive output, preserve interruption state, and start workspace observation before process launch. Protect active runtime roots with cross-platform leases, capture transient protected-path creation events, and restore process attributes after PTY fallback. * fix(sandbox): restore strict macOS isolation Remove Seatbelt host-local network allowances after native validation showed localhost filters can reach host interfaces. Track process reap completion so retained sessions cannot signal a stale numeric PID.	2026-07-21 18:55:13 +05:30
Anandan	afb5010a46	polish v2: smoothness & delight (#484) ... * feat(tui): actionable hints on provider/model errors Classify a failed turn's provider error into auth / rate-limit / connectivity / model-not-found / context-overflow and render a one-line next step below the red error row, instead of dumping an identical raw blob for every failure mode. The classifier lives in a new internal/errhint package so both the TUI error row and the CLI exec path can share it (TUIHint references slash commands, CLIHint references zero subcommands). Classification is a conservative string heuristic keyed off providerio.ClassifiedError's prefixes plus lower-level DNS/TLS/timeout/context-length signatures, since the numeric HTTP status is gone by the time the error reaches a UI surface. * feat(tools): budget bash output with head+tail truncation bash was the one tool that returned command output with no byte cap — 'cat large.log' or a verbose test run could dump megabytes into context and force compaction, while every other read/search tool already applies a budget. Cap stdout and stderr at 96KB each, keeping the head and tail of an oversized stream (build/test failures usually land at the tail) and dropping the middle behind a marker that points at redirect-to-file + read_file. Record raw_bytes/emitted_bytes/estimated_tokens/truncated in Meta like the other tools. Sandbox-denial and shell-issue detection still run on the full raw output before budgeting. * fix(gemini): retry 401 with refreshed OAuth token The Gemini provider used providerio.SendWithRetry (429/503/529 only), so an expired OAuth token surfaced as a terminal 'API key not valid' auth error while OpenAI and Anthropic silently recovered via SendWithAuthRetry's force-refresh-and-replay on 401. Plumb OAuthResolver through gemini.Options/Provider and the factory (exactly as the other two providers already do) and switch the stream send to SendWithAuthRetry. With a nil resolver (API-key users) behavior is unchanged. * fix(errhint): gate classification on provider-origin marker Address CodeRabbit review on #1: agentResponseMsg.err can also carry local failures (a tool's 'permission denied', a 'file does not exist', a config error), and broad substrings would have attached a bogus /provider or /model hint to those. Classify now returns Unknown unless the message carries a provider marker the provider layer always attaches (auth error: / rate limit error: / provider error: / provider request error: / provider stream error:). Local errors never draw a provider hint; provider errors sub-classify as before. Added local-failure test cases proving they stay Unknown. * feat(cli): actionable hint on text-mode exec provider errors zero exec printed provider failures as a bare '[zero] <raw error>' with no next step. Append a one-line hint (reusing the shared errhint classifier) for recognized provider failures — 'run `zero auth`', 'run `zero doctor`', etc. The provider-origin gate means non-provider codes (sandbox_error, mcp_error) and JSON/stream-json output are untouched. * fix(tools): set Result.Truncated for budgeted bash output Address CodeRabbit review on #3: budgetBashOutput recorded truncation in meta["truncated"] but never set the Result.Truncated struct field, so consumers reading the struct (like glob/web_fetch/read_minified do) would miss truncated bash results. Return the bool from budgetBashOutput and set Result.Truncated on every return path. * perf(tui): reuse one LSP manager across prompts runAgentWithOptions built a fresh lsp.NewManager per run and shut it down when the run returned, so gopls (and every other language server) cold-started on the first edit of every turn — 200ms-2s of latency the manager's own design (long-lived, reused servers) exists to avoid. Build one manager per session in newModel (cheap: servers start lazily on first Check) and reuse it across runs; the SelfCorrector still gets a fresh checker wrapping the shared manager each run. Torn down with a short deadline in quit(). Runs fall back to a per-run manager when the session manager is absent (cwd unknown, or a directly-built test model). * perf(tui): accumulate streamingText as []byte (O(1) append) m.streamingText += msg.delta was O(len) per delta -> O(n²) across a long generation (a 10k-token code gen allocates hundreds of MB of intermediate strings and the UI gets progressively laggier). Accumulate into a []byte with append (O(1) amortized) and read via streamingTextString(). A []byte rather than strings.Builder because the TUI model is copied by value on every Update, which would trip strings.Builder's copy check; []byte is nil-safe and copies cleanly like the other slice fields. * perf(tui): coalesce streamed text deltas to one frame Every OnText delta was its own tea.Msg, so a fast provider (100+ tok/s) drove 100+ full Update->View cycles per second, each re-parsing the growing markdown — visible stutter over SSH and wasted CPU. Batch agentTextMsg deltas at the runtime sink over a ~16ms frame and forward them as a single message, decoupling render rate from token rate. Any non-text message flushes pending text first so ordering with tool-call / reasoning / row messages is preserved; the final agentResponseMsg (a tea.Cmd return, not a sink message) is safe because the model already drops deltas for an inactive runID. * fix(agent): raise tool-failure stop threshold 4->6 guardrails.go halted a run after 4 consecutive same-error tool failures. A corrective hint fires at 2, and a model iterating on a genuinely tricky edit can legitimately fail a couple more times after the hint while converging — stopping at 4 cut those runs short. Raise to 6; the streak still resets the instant the tool succeeds or hits a different error, so only true same-error loops are affected. * fix(agent): more reconnect retries with jitter; narrow to transport errors #19: bump maxStreamReconnects 2->4 and add up-to-50% jitter on the exponential backoff (capped at 8s), so a multi-second network blip is ridden out instead of killing the run on a 2s hiccup, and concurrent runs (swarms, cron fleets) don't reconnect in lockstep. #34: drop the '502'/'503' substring matches from shouldReconnect. 503 already exhausted providerio.SendWithRetry (retrying here is a redundant double-retry) and 502 is non-idempotent by providerio's rule (the POST may have been processed). Only genuine transport failures — where no response was received — reconnect now. * fix(agent): reduce stall retries 2->1 to bound stuck-session time A no-output stream stall is detected only after the full stream idle timeout (~5min) elapses, and each retry can idle again — so 2 retries left an interactive session frozen for ~15min. Drop to 1 retry: keeps the common single-hiccup recovery while bounding the worst case to ~2x the idle timeout. * fix(tui): serialize coalescer forwarding to preserve message order Address CodeRabbit review on #7: flush() and the run-switch path drained the text buffer under c.mu but called forward() after releasing it, so a timer-fired text flush could race a concurrent non-text send() and land after the tool-call/reasoning message it should precede. Hold c.mu across drain AND forward (drainAndForwardLocked), so whoever holds the lock delivers atomically and the other caller blocks until it is done — text can never overtake a following non-text message. Added a concurrency stress test (timer racing an inline send) that passes under -race. * feat(tui): accept /compact now Bare /compact already triggers compaction, but /compact now — what users reach for when the context gauge climbs — hit the usage-error branch. Accept the 'now' keyword and advertise it in the command usage. * feat(tui): add /retry, /edit, /copy, /export commands /retry resends the last prompt; /edit recalls it into the composer to tweak and resend — both read a new lastPrompt field captured verbatim (pre-expansion) in launchPrompt. /copy puts the last answer on the clipboard via the existing copy machinery; /export writes a plain role-prefixed transcript to a file (timestamped default, or a given path). Real gaps for SSH users with no mouse select. * feat(tools): separator-insensitive tool_search matching tool_search ranked deferred tools by exact substring, so a model that typed 'webfetch' (dropping the underscore) matched nothing and looped. Add a separator-squashing fallback ('web_fetch' -> 'webfetch') scored below an exact substring match, so precise queries still rank first. * feat(tools): signal ask_user dismissal distinctly from a blank field Empty answers all rendered as '(no answer provided)', so the model couldn't tell a wholesale dismissal (user closed the prompt without answering anything) from one field left blank amid real answers — and might invent a default. FormatAskUserAnswers now flags a full dismissal up front as a skip and marks individual empties '(left blank)' vs '(skipped)'. * feat(tui): fuzzy ranking in model/session pickers The pickers filtered by flat strings.Contains with no ranking, so finding 'sonnet 4.5' among 50+ models meant an exact prefix or scrolling. Rank matches (exact < prefix < contains < subsequence, reusing fuzzySubsequenceGap) so the closest match lands on top, and 'snt45' now matches 'Sonnet 4.5'. Groups stay contiguous — ordered by their best match, never split — so the grouped model picker still renders one header per provider. Covers both /model and /resume (shared commandPicker). * perf(agent): cache per-tool schema render across turns partitionTools re-ran the recursive schema->map conversion (schemaToRuntimeMap) for every tool on every turn — redundant, since a tool's advertised name/description/schema is stable for the run. Add a per-run definition cache keyed by tool name (nil-safe; the plain partitionTools entrypoint and tests pass nil for fresh renders). The partitioning itself (visibility, deferral, ordering) still recomputes every turn — it must, because a tool's deferred state can flip mid-run (swarm tools un-defer once a swarm is active). Only the expensive schema render is memoized. tool_search is excluded by its callers (dynamic description) so it never poisons the cache. * perf(agent): calibrate compaction estimate against real prompt tokens The byte/4 heuristic (ApproxTextTokens) over-counts code-heavy content ~15-20%, so with triggerRatio=0.7 compaction fired at ~60% of true capacity — premature summarizer calls that degrade quality. Each turn now folds (rawEstimate, provider InputTokens) into an EMA calibration ratio, clamped per-sample to a sane band; maybeCompact and the reactive path scale their estimates by it. Turn 1 uses the raw estimate (no data yet); later turns compact near real capacity. * style: gofmt the new agent test files The CI gofmt check flagged the #22/#25 test files (struct-field and switch alignment). No behavior change. * feat(agent): turn-based plan staleness reminder The stale-plan nudge only fired after 10 tool calls since the last update_plan, so a plan that drifts stale across many low-tool-call turns (one call per turn) took many turns to catch — the 'plan set turn 1 stays pending forever' case. Add a turn-count complement: after stalePlanTurnThreshold (8) turns without an update AND with items still pending, fire the same one-shot reminder. Gated on pending items so a fully-completed plan is never nagged; the existing tool-call trigger is unchanged. (The roadmap's fuzzy 'tool calls unrelated to plan items' relevance match is deliberately omitted — too false-positive-prone.) * feat(agent): preserve recent-edits summary across compaction Compaction preserved the plan, loaded skills, tool schemas, and project instructions, but not file edits — so after the editing turns were elided the model knew it had changed a file only vaguely, and would re-read to rediscover its own footprint. Extract write_file/edit_file targets from the elided middle with a one-line note from each tool result, merge them across repeated compactions (newer note per path wins), and carry them in the preserved-state JSON (capped at 20 paths / 160 bytes per note). * feat(tui): workspace-scoped /resume + fewer event reads /resume listed sessions from every project globally, and read the full event file for each of them to test for resumable content. Filter the picker (and /resume latest) by the current workspace Cwd, checked BEFORE the per-session read so a large global history no longer pays N full file reads to build one workspace's list; also skip zero-event sessions via metadata without any read. Sessions with no recorded Cwd (older runs) and an unknown current workspace stay visible so nothing is hidden that can't be confidently placed. Explicit /resume <id> still resolves any session. * feat(tui): warn on model switch that drops staged images Staged images were silently dropped at submit when the active model had no vision support — the user only learned after sending. Chips already render above the composer (renderAttachmentChips); add an immediate amber warning line to the /model switch status (both same-provider and cross-provider paths) when images are staged and the newly selected model can't accept them, so the drop is surfaced at switch time. * feat(tui): inline recovery affordance on setup errors A first-run setup error rendered as a bare red 'error: <text>' with no pointer to the fix. Append a faint, stage-tailored recovery line (edit the endpoint/name/key above then Enter, or pick another model) that names only keys the stage's footer confirms, so the guidance is always accurate. Empty for stages whose footer already makes recovery obvious. * fix: address CodeRabbit review (5 findings) - loop.go: recompute the compaction calibration estimate at calibration time, not request-build time, so a reactive-compaction reissue that shrinks the request feeds the EMA the sample that actually completed. - errhint: match bare HTTP status codes (401/403/429/529) only at digit boundaries, so an incidental number ('4290ms', 'id 14015') isn't mis-bucketed as auth/rate-limit. - bash: drop the stray unmatched ']' in the output-truncation marker. - tui /retry: apply the same exiting/compactInFlight guards commandPrompt has, so a retry can't race compactResultMsg's rewrite of session state. - tui /export: write the transcript 0o600 (it may contain echoed secrets), not world/group-readable 0o644. * test(tui): skip export file-mode assertion on Windows os.WriteFile ignores Unix permission bits on Windows and Stat reports 0666, so the 0o600 assertion failed there. The production 0o600 is honored on Linux/macOS (where it matters); guard the check with runtime.GOOS so Windows smoke passes. * fix(tui): align /resume latest filters + case-insensitive workspace match on Windows Address CodeRabbit review on #21: - latestResumableInWorkspace now applies the SAME filters as the picker (skip zero-event metadata and empty/failed runs), so /resume latest can't land on a session the picker intentionally hides. - sessionMatchesWorkspace compares paths case-insensitively on Windows (its filesystem is), so the same workspace spelled with different casing no longer hides resumable sessions; other platforms stay case-sensitive. * fix(tui): /retry resends the last prompt's image/PDF attachments /retry relaunched only lastPrompt's text, but launchPrompt clears the pending image/document queues once a turn is sent. A vision- or PDF-backed prompt that failed would silently retry as text-only and answer a different task. Snapshot the consumed attachments at launch and re-stage them on /retry so launchPrompt rebuilds an identical request (document preamble, images, and the submit-time vision re-check). startNewSession drops the snapshot so a post-/new /retry cannot leak the previous session's attachments. Also correct the OAuthResolver factory comment, which omitted the Gemini provider it is now passed to. * fix: address jatmn review (reconnect 5xx, /edit attachments, edit-cap, coalescer test) - reconnect: exclude HTTP 5xx (500/502/503/504) before the transport substring match so "504 Gateway Timeout" no longer slips through on the generic "timeout" needle. A gateway timeout is non-idempotent — the completion POST may already have reached the model — so replaying the connect risked duplicate billable work. Reuses a digit-boundary status matcher exported from errhint (HasStatusCode). Test asserts 504/500 stay non-reconnectable. - tui /edit: re-stage the remembered image/PDF snapshot alongside the recalled prompt text, mirroring the /retry fix — editing a vision- or document-backed prompt no longer silently resends a text-only version. - compaction recent-edits: order edits by LAST edit, not first, and move a re-touched path to the newest position on merge, so the maxRecentEdits tail cap keeps the file the model most recently edited instead of dropping it. Adds mergeRecentEdits (edit-specific) and a capped-list regression. - coalescer test: inject the frame timer via afterFunc so TestCoalescerBatchesDeltas proves buffering deterministically instead of racing the real 16ms wall-clock timer. * fix(tools): bound bash output capture in memory, not just model-visible text Previously stdout/stderr streamed into unbounded bytes.Buffers and were only truncated to the 96 KiB budget AFTER the command finished, so a runaway command (cat huge.log, yes) could grow Zero's memory until it stalled or OOMed before budgetBashOutput ever ran. Replace the capture with boundedBuffer, an io.Writer that keeps only the head+tail each stream will surface and discards the middle as it arrives, while counting the true total for the truncation marker. Memory is now bounded to ~head+2×tail per stream regardless of output size. truncateHeadTail is refactored onto a total-aware core so the string path (and its tests) are unchanged, and budgetBashCapture reports the true raw_bytes even though only a bounded slice was held. Adds boundedBuffer/capture unit tests and an end-to-end test that streams ~5× the budget and asserts bounded emission with an accurate raw_bytes.	2026-07-05 13:15:14 +05:30
Kevin CodexandGnanam	142c548c89	feat(tui): FILES sidebar panel with click-to-select and file drill-in (#365) ... * feat(tui): FILES sidebar panel with click-to-select and file drill-in Add a FILES section to the right context sidebar showing the files the session has touched — newest first, with A/M status badges, aggregated +/− diffstats, and a pulsing row for the file being written right now. Clicking a row selects the file (accent marker, edit cards tint in the chat, transcript scrolls to the latest edit); a second click opens a drill-in view: the chat column swaps to the file's stacked edit cards, `f` toggles to the syntax-highlighted on-disk file with markers on session-added lines, `d` back to diff, Esc returns to the chat. The roster is fed from two sources: changedFiles carried by write_file/edit_file/apply_patch results (persisted per session, so it survives /resume), and a git sweep — baseline snapshot at startup, re-check after command tools and at turn end — so files created through bash/exec_command scaffolding or subagents show up too. * fix(tui): address FILES sidebar review findings Review fixes for the FILES panel / drill-in / git sweep: - touchedFiles: split multi-file diffs per file (perFileDiffStats) so an apply_patch spanning several files no longer charges the whole patch's +/- totals to every file it touched; order by lastRowIndex descending so a re-touched file lists first (reversing first-seen order kept it in its original slot). - sidebarFileLines: filter the live-writing row out before computing the "+N more" trailer so the skipped entry no longer inflates the count. - git sweep: run `git diff --numstat -z` and parse the NUL-terminated rename records (counts + preimage + postimage) — plain --numstat brace-mangles renamed paths ("src/{old => new}"), so their diffstat never matched a porcelain path and renamed files stayed at 0/0; gitTouchedFiles now yields newest detection first to match the roster's ordering. - file view: stream the full-mode read and stop at fileViewMaxLines (os.ReadFile loaded a multi-GB file wholesale before truncating — the exact freeze the cap exists to prevent); re-opening the file already being viewed is a no-op so a stray re-click can't bounce full mode back to diff or reset scroll; skip sub-4-char lines in the changed-line markers so common braces/returns don't mark unrelated occurrences. - keys: gate the drill-in's d/f and Esc handling on noBlockingModal so a permission prompt / ask-user / wizard keeps its own key handling. - sidebar: a live in-flight write counts as content, so the FILES pulse shows for the session's first mutation. - tests: numstat test now feeds real -z record shapes and asserts the rename postimage key; new coverage for per-file stats, re-touch ordering, live-row overflow, same-file reopen, truncation, modal gating, live-write content, and a real-repo rename sweep. --------- Co-authored-by: Gnanam <[email protected]>	2026-07-02 12:15:41 +05:30
Anandan	d29ab98a79	Improve sandbox permission handling (#323) ... Retry shell commands outside the sandbox when sandboxed output only reflects the sandbox namespace, and keep network retries sandboxed when a network grant is enough. Show user-facing permission reasons for escalated shell commands instead of exposing internal sandbox policy text. Tested: env GOCACHE=/tmp/zero-go-cache go test ./internal/agent ./internal/tui -run 'TestRunUsesEscalatedJustificationForPermissionPrompt|TestRunUsesUserFacingEscalatedFallbackForPermissionPrompt|TestPermissionPromptMapsEscalatedSandboxReason|TestRunRetriesShellUnsandboxedAfterSandboxNamespaceLimitedOutput' Tested: env GOCACHE=/tmp/zero-go-cache go test ./internal/tools Tested: env HOME=/tmp/zero-test-home-clean XDG_CONFIG_HOME=/tmp/zero-test-config-clean GOCACHE=/tmp/zero-go-cache go test ./...	2026-06-26 16:21:06 +05:30
KRATOS	0e7318ff72	feat(tui): clickable plan-step detail + plan/sidebar UX & rendering polish (#315) ... * fix(tui): plan panel reflects live progress + prompt cadence The plan panel could read as stuck mid-task even while work continued. Three fixes: - Header showed steps[0] forever, so the title never advanced as the plan progressed; show the current step (in_progress, else first incomplete). - updateFromItems matched steps by content only, so an in-place reword reset a step's elapsed timer to zero; add positional carry-over when the step count is unchanged. - Prompt: tell the model to mark each step completed + the next in_progress before starting it, so the plan tracks real progress instead of jumping at the end. Regression tests included. * feat(tui): click a plan step to see what was built for it Each plan step now records the file mutations (write_file/edit_file/apply_patch) made while it was in_progress, captured from tool-result rows. Clicking a step row in the context sidebar drops a transcript card listing those changes — the implementation for that step. Step->line mapping mirrors sidebarAgentSelectables' offset accounting (one line per step); capture is keyed to the active step and cleared per run. Read-only and additive. Tests cover the offset math + capture. * feat(tui): plan-step detail shows diffs + commands Extend the clickable plan-step detail: capture bash/exec_command runs in addition to file mutations, store each tool's full output (the diff for edit/apply_patch, stdout/stderr for commands), and render the card grouped into Changes and Commands with a short truncated excerpt of each item's diff/output. * fix(tui): plan-step detail toggles instead of stacking duplicates Re-clicking a plan step now hides its card (a stable transcript id + drop-by-id), and clicking a different step replaces it, so at most one detail card is shown. Previously each click appended a fresh card and they piled up. * feat(tui): elaborate plan-step detail by status (what we did / will do) * feat(tui): plan-step card leads with a prose explanation (agent's own narration) * feat(tui): write plan-step explanations with the model on click Clicking a PLAN step now shows a fresh, plain-English write-up of that step, generated on demand by the active model: - past tense ('what we did') for completed/failed steps, future tense ('what we'll do') for pending/in_progress steps - immediate feedback: the card drops in showing 'Writing explanation…' and updates in place (by stable row id) when the text returns - cached per step (content+status) so re-clicking is instant with no second model call; re-clicking still toggles the card closed - the prompt is built from already-captured local data (step text, status, notes, plus a compact digest of file edits, commands, and the agent's narration) and asks for short, non-technical prose - reuses the TUI's existing provider via a one-shot StreamCompletion; no new client, no hardcoded provider. Falls back to the local summary when no provider is configured or the request fails. * fix(tui): minimal plan-step card styling (dim border, status-tinted title) * feat(tui): auto-hide context sidebar when it has no agents or plan * feat(tui): widen chat reading column to fill wide terminals with breathing room * fix(tui): toggle context sidebar silently (no transcript notice) * fix(tui): mark plan complete when a finished task forgot the final update_plan * fix(tui): remove the lime streaming-text glow (render responses in static ink) * fix(tui): remove the shaded panel band behind tool-result cards * fix(tui): Ctrl+B hides the plan entirely (no pinned-panel fallback) * style(tui): gofmt-align model struct fields * feat: narrate the build as a clean story (hide plumbing cards, live plan progress, narration prompt, write_file line counts) * feat(tui): render agent narration bright (ink) so the build reads as a story * feat(agent): demand an elaborate, structured closing summary (not a single line) * feat(tui): mark agent narration with a leading bullet (selection-aligned) * feat: post-turn recap line (※ recap:) with /config recaps on|off toggle * feat(tui): show 'still generating…' during quiet stretches + count tool-call streaming * feat(tui): ACTIVITY panel under PLAN + push the model to step the plan per file * fix(tui): show the quiet 'still generating' hint only when the sidebar is hidden * feat(tui): code preview in write/edit/apply cards (card-only, no model token cost) * fix(tui): address CodeRabbit review — stale plan timestamps, stale explanation, Ctrl+B persistence, UTF-8 truncation * fix: address CodeRabbit re-review round 2 (7 actionable + 2 nitpicks) * chore: drop accidentally-committed WIP internal/cli/dryrun_test.go It is an unrelated, pre-existing dry-run test that does not compile (references a non-existent agent.Options.DryRun field, an unused import, and out-of-scope sandbox symbols). It was swept into the prior commit by 'git add -A' and is not part of this PR's scope.	2026-06-25 20:23:29 +05:30
Vasanth T	258f1a31c9	fix(swarm): make swarm_collect wait for members instead of polling (#310) ... * fix(swarm): make swarm_collect wait for members instead of polling Swarm spawn was fire-and-forget and the only way to learn a member had finished was to call swarm_status/swarm_collect, which returned an instant snapshot. So an orchestrator had to poll in a loop, flooding the chat with repeated status cards and never getting a clean "done". swarm_collect now BLOCKS until every member of the team reaches a terminal state, then returns their results in one call: - Coordinator gains a change-broadcast channel and WaitSettled(ctx, team), which blocks until the scope has no pending/running task (or ctx is done). Every state transition (register/setstatus/finish/reassign) wakes waiters. - Swarm.CollectWait wraps it; the collect tool calls it bounded by the run context (user cancel) and a timeout (default 600s, cap 1800s, overridable via timeout_seconds), so a stuck member returns partial state instead of hanging forever. - Tool descriptions now steer the model: spawn then collect once; status is a one-shot snapshot, not something to poll. TUI: collapseRepeatedStatusCard drops the previous identical swarm status/collect card when a check repeats verbatim back-to-back, so any residual re-checks don't stack duplicate blocks in the chat. * fix(swarm): address review on blocking collect (race + timeout overflow) - WaitSettled: take the settled decision and the returned snapshot in the SAME locked pass. Previously the snapshot was re-read after releasing the RLock, so a concurrent Register/Reassign could make the call return a non-terminal task it never waited on — breaking the blocking contract. Removed the now-dead scopedList; shared sortTasksByCreation with List. - collectWaitTimeout: clamp timeout_seconds in float space before converting to time.Duration. A very large value overflowed the int64-ns Duration and wrapped negative, making context.WithTimeout fire immediately instead of honoring the cap. - test: release the gated member via defer in TestCollectBlocksUntilMembersFinish so a failing assertion can't leak the blocked goroutine; add a collectWaitTimeout clamp/overflow unit test.	2026-06-24 14:48:30 +05:30
Vasanth TandClaude Opus 4.8	96a851df2d	feat(tui): transcript polish — left-rule cards, tool-call density, pinned plan (#269) ... * feat(tui): unify tool cards onto the left-rule card style Tool result/running cards were the last transcript surface still drawn as a full rounded box (╭─ head ─╮ / │ body │ / ╰─ footer ─╯), while specialist cards (#255) and the reference TUIs (opencode, codex) use a lighter left-rule card. Mixing two card languages in one transcript reads as un-designed, so converge tool cards onto the same left-rule shape. toolCard() now draws a status-tinted "│ " rail down the left edge with the head on the first line and the status glyph (✓/✗/spinner) right-aligned to the card edge — no top, right, or bottom borders. The glyph moves out of toolCardHead onto the rule line. Width math is preserved: every emitted line is still exactly `width` cells (the two cells where the right border sat become panel background), and the inner content budget stays width-4, so the diff/read/bash/grep body renderers — which assume width-4 — are untouched. The tiny tier keeps its existing borderless behavior (no leading "│"), so TestTinyToolCardDropsSideBorders still holds. Click-to-expand/collapse is unaffected: the toggle attaches to the head line by relative offset, which is still the first line. Tests: update TestRunningToolCardShowsHeadAndSpinnerSlot to assert the left rule (no box corners); add TestToolResultCardRendersAsLeftRule for the result-card shape + glyph-on-rule; the all-lines-equal-width invariant (TestToolCardLinesAllSameWidth) is unchanged and still passes. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> * feat(tui): cut tool-call transcript density (paths, auto-approve rows, redundant bodies) Follow-up to the left-rule card frame in this PR — same surface, the content inside/around the cards. A run of MCP file ops rendered ~5–7 lines each, with the same absolute path repeated 3× and the tool name twice. The reference agents (opencode, codex) collapse a successful call to ~1 line, use workspace-relative paths, and only surface approval when the user is actually prompted. Five changes bring tool cards in line: 1. Auto-approved permission rows: the OnPermission handler always recorded the audit event but only renders a visible row when the event is noteworthy (a real prompt, a deny/cancel, an explicit durable decision, or a sandbox block) — not for silent auto-approves. A new permissionEventIsNoteworthy predicate gates both the live path (model.go) and the resume rebuild (session.go) so resumed sessions match the live view. The session log is unchanged — only the rendered row is suppressed. 2. displayPath relativizes a tool card's target to the workspace (D:\...\examples\calc\calc.go -> examples/calc/calc.go), falls back to ~/... under home, then to …/last-3-segments for external paths. Display only; the hyperlink still points at the original absolute path, and the path sent to the tool / stored in the session is untouched. 3. A successful call whose output is a one-line confirmation ("Successfully created directory …", "Created x (N bytes).") drops its body — the head already shows the action, target, and ✓. Narrow verb allowlist; errors and multi-line/real output always keep their body. 4. displayPath's external-path tail (…/segments) — folded into (2). 5. One blank line between consecutive tool cards in a turn. Separators were only inserted at turn boundaries, so back-to-back cards stacked with no gap (the dense "wall"). Tool-card↔tool-card only; specialist cards keep their own grouping. Net: each MCP file op goes from ~5–7 lines to ~1, paths relative, no auto-approve noise. Tests cover the predicate (suppress auto / keep real decisions), displayPath (cwd / home / external tail / relative passthrough), body collapse (confirmation vs real output vs error), and the inter-card blank. Two existing permission tests updated for the new intent; full internal/tui suite green. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> * feat(tui): pin the plan panel above the composer The plan panel was injected inline into the scrolling transcript body, so a streaming turn pushed it up and out of view exactly when it was most useful. Pin it in the footer, directly above the composer, so it stays visible while the transcript scrolls underneath. - footerView renders the pinned plan above the composer; the scrollable frame already reserves footer height, so no extra layout plumbing is needed. - A height budget (pinnedPlanMaxHeight: at most a third of the screen) keeps a long plan from crowding out the transcript or the input — when the full panel would exceed the budget it collapses to a one-line summary (renderPlanSummaryLine: spinner/✓, done/total, current step). Ctrl+P still expands, but the budget always wins so the composer stays on screen. - The two inline-injection sites in transcript_selection.go are removed (the panel no longer lives in the body), along with the now-unused planPanelEmitted flag. Tests: full-when-it-fits, collapse-to-summary-when-too-tall, hidden-when-empty, and footer-renders-plan-above-composer. Existing plan-panel tests unchanged and green; full internal/tui suite green. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> --------- Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>	2026-06-20 18:58:54 +05:30
KRATOS	1c30f4c117	audit fixes: cron lock, accounting race, O(n²) hot paths, /style wiring (#260) ... * audit fixes: cron lock, accounting race, O(n^2) hot paths, /style wiring Fixes five verified findings from a code audit. Two related findings were already addressed upstream and three need larger/separate work (noted below). H-1 cron store: cross-process lock for the read-modify-write. Two schedulers seeing a job due raced the metadata read-modify-write; fireJob even documented it ("full atomicity needs file locking"). Adds a per-job O_EXCL lock (mirroring internal/oauth's pattern, stale-reclaim included) and a Mutate primitive doing the re-read+modify+write atomically. Update/Remove lock too. The lock is held only for the millisecond RMW, never across a job's exec. M-5 specialist accounting: close the check-then-append race. specialistEventExists (unlocked ReadEvents) + a later AppendEvent let two finishers (TaskOutput poll vs onExit, even cross-process) both pass the check and write duplicate stop/usage events. Adds sessions.Store.AppendEventUnlessExists (check + append atomic under the session lock) and routes the stop and usage paths through it. M-2 hooks audit: O(1) sequence via tail read. append re-read and scanned the whole audit log every call to find the max sequence (O(n^2) over a session). Reads only the file tail now; multi-process safe (the log is a shared global file), unlike an in-memory counter which would collide sequences across processes. M-4 transcript rehydration: O(n^2) -> O(n). The three resume/rewind/compact rehydration loops called appendTranscriptRow per event, each re-scanning every existing row for the keyed-row dedup. A bulk appendTranscriptRowsDedup builds the key set once; semantics are identical. M-6 /style: actually shape responses. The TUI /style command stored a style but never threaded it anywhere. Adds agent.Options.ResponseStyle, a system-prompt directive for concise/explanatory/ review, and wires m.responseStyle through the run. "balanced" is a no-op (prompt byte-identical to before). Already addressed upstream (no change): - M-1 forked-session double-count: Store.Fork already skips EventUsage events, with a comment naming the exact double-count it prevents. - M-3 lineage O(N^2): Tree already does a single store.List() scan and indexes children in memory; no path calls List per node. Deferred (need larger/separate changes): - M-7 escalate_model in the TUI needs a ModelSwitcher that builds a provider mid-run; registering the tool alone yields a tool that errors on call. - L-1 MCP SSE reconnect is a stream-lifecycle change (low-likelihood after the 8 MiB per-event cap). - L-2 dead-code removal belongs in a dedicated cleanup sweep. Tests: per-fix unit tests including concurrency (cron Mutate, sessions AppendEventUnlessExists) under -race; full go test ./... green. * fix(windows): treat ERROR_ACCESS_DENIED as lock contention (cron + oauth) The Windows smoke run failed TestMutateIsAtomicUnderConcurrency with "...lock: Access is denied" (FireCount 19/20). On Windows a concurrent holder's os.Remove leaves the lock file in a delete-pending state, so an O_EXCL create races it with ERROR_ACCESS_DENIED (os.ErrPermission) rather than ErrExist — the retry loop only treated ErrExist as contention and hard-failed. Treat os.ErrPermission as contention (retry) in the new cron lock and in the oauth lock it mirrors (oauth's own concurrent test exposed the same pre-existing bug under the added load). Unix is unaffected — it returns ErrExist. * fix: address review — cross-process atomic audit append + AppendRun guard Addresses the review feedback on this PR. P1 (blocking): AuditStore.append is now cross-process atomic. The O(1) tail read observes another process's prior appends, but the read-then- append was not atomic across processes — two could both read sequence N and write N+1. Wraps lastSequence()+append in a per-file O_EXCL lock (hooks/lock.go, same stale-reclaim + Windows ErrPermission handling as cron/oauth); store.mu stays as the in-process fast path. Adds TestAuditStoreSequenceConcurrent (4 stores x 12 goroutines on one file -> unique dense sequences), which the prior sequential test could not catch. Walked back the comment that oversold the tail read. P2: AppendRun no longer resurrects a removed job. fireJob's AppendRun ran after Mutate released the per-job lock; a Remove in that window let AppendRun's MkdirAll recreate the dir with an orphaned runs.jsonl. AppendRun now takes the per-job lock and bails if metadata.json is gone. Adds TestAppendRunDoesNotResurrectRemovedJob. P2: lastSequence ReadAt tolerates a short final read. ReadAt may return io.EOF with n < len(buf) if the file shrank between Stat and the read; treat EOF as non-fatal and use buf[:n] (matches lastEventSequence). P3: oauth stale-reclaim no-op removed. The double os.ReadFile "stale == data" guard compared the file to itself read twice in a row (always true); staleness is decided by the mtime check, so the guard is dropped (behavior-preserving). Tests under -race; cron/hooks/oauth green. A shared filelock helper would DRY the three near-identical locks — left as a follow-up to avoid churning the already-green cron/oauth packages here.	2026-06-19 21:11:34 +05:30
Vasanth T	b237e9849a	feat(tui): sticky plan panel + specialist task cards + task table overlay (#255) ... * feat(tui): sticky plan panel + specialist task cards + task table overlay Three new TUI surfaces that give users live visibility into agent progress and specialist delegation, so long turns and subagent work never look frozen. Sticky plan panel (plan_panel.go): - Pinned between the title bar and transcript body, shows the agent's step-by-step plan from the update_plan tool as a live checklist. - Header with spinner + progress count + elapsed; text progress bar; per-step list with status icons (✓ completed, ⠹ in_progress, ○ pending, ✗ failed) and individual step timings. - Auto-collapses to a one-line green summary 30s after completion. Ctrl+P toggles expand/collapse. - Plan state synced from update_plan tool results via CurrentPlan(); timestamps preserved across the tool's full-replacement updates by matching on content. Specialist cards (specialist_card.go): - New rowSpecialist transcript row kind; EventSpecialistStart/Stop now handled in session.go hydration (previously fell through to default and were silently dropped on resume). - Animated card with spinner + name + task + elapsed + token count + tool call count. Blue while running, green when done, red on error. - specialistTracker tracks live state; Task tool calls/returns are intercepted in the OnToolCall/OnToolResult callbacks to start/complete tracking and emit card rows. - Height cache marks running specialist rows unstable so the spinner animates. Task table overlay (task_table.go): - Ctrl+G toggles a full-width overlay showing all specialists in the session as a sortable table: #, Specialist, Task, Status, Time, Tokens, Tools. - Summary bar with running/completed/error counts, total tokens, aggregate elapsed. - Arrow keys navigate rows; Esc closes the overlay. Tests: plan_panel_test.go (7 tests), specialist_card_test.go (11 tests), task_table_test.go (8 tests). All existing TUI tests pass. * fix(update_plan): expose structured nested item schema so models stop sending bad arguments The plan property's Items schema was omitted because of an outdated comment claiming the serializer drops nested Properties/Required. The serializer (propertyToRuntimeMap) already handles them recursively. Without the nested schema, weaker models guessed the item structure from a text description and sent malformed arguments, hitting the 4-strike guardrail halt. Now exposes Items as an object with content (string, required), status (enum), and notes (string). * fix(tui): route plan + specialist updates through message sink, not stale closures The OnToolCall/OnToolResult callbacks captured model by value, so m.plan.updateFromItems() and m.specialists.start/complete() mutated stale copies that never reached the live model. Introduced planUpdateMsg, specialistStartMsg, and specialistCompleteMsg tea.Msg types sent through runtimeMessageSink, handled in updateModel() where they mutate the live model. * feat(tui): subchat drill-in for specialist sessions Enter on a task table row loads the child session's events and swaps the transcript view to show the subagent's full conversation (user messages, agent text, tool calls, results). A nav bar at the top shows the specialist name/task and a back hint. ArrowUp or Esc pops back to the main chat at the saved scroll position. - subchat.go: subchatState with enter/exit, renderSubchatNavBar - transcript_selection.go: transcriptBodyItemsFromRows renders arbitrary rows (reuses the same rendering pipeline as the main transcript) - model.go: Enter on task table row triggers drill-in; ArrowUp/Esc exits; transcriptView() short-circuits to child rows when subchat is active * fix(ci): strip CRLF line endings and BOM from plan_tool_test.go and update_plan.go gofmt and git diff --check failed on ubuntu CI because PowerShell's Set-Content wrote UTF-8 with BOM and CRLF. Stripped both to plain LF without BOM. * feat(tui): add renderLeftRuleCard helper for borderless specialist cards * feat(tui): switch specialist cards to left-rule rendering, drop hint line * feat(tui): add renderSpecialistSummary one-line rollup for specialist cards * fix(tui): correct slice offset in renderSpecialistSummary and add pluralization test The muted tail was sliced at summary[len(spinnerView)] but the spinner sits at byte offset 2 (after the 2-space indent), so the slice cut into the spinner's UTF-8 continuation bytes and dropped the indent. Slice at 2+len(spinnerView) instead. Also add a test asserting '2 errors' is present and '2 error' (singular) is absent when two specialists errored. * refactor(tui): remove task table overlay — cards carry everything now * feat(tui): render specialist summary line above cards in transcript * feat(tui): mark specialist card lines as clickable selectable rows * feat(tui): click specialist card to drill into subchat, Enter as keyboard fallback * tui: clear selectedSpecialistID after Enter drill-in Fixes Task 7 review issue: selectedSpecialistID persisted after Enter drill-in, causing a subsequent Enter to re-drill into the specialist's subchat instead of submitting the composer. Clear it immediately after subchat.enter succeeds so the keyboard fallback is one-shot per click; click re-sets it, so click->Enter still works. * chore: gofmt model.go + test files * chore: gitignore .superpowers/ and docs/superpowers/ — local skill artifacts * fix(tui): remove Enter keyboard fallback for subchat drill-in — mouse click only * fix(tui): reconcile specialist childSessionID from tool call ID to real session ID on completion * feat(specialist): add Progress callback field to RunOptions and TaskRunOptions * feat(specialist): stream child stdout line-by-line via Progress callback * feat(agent): wire OnToolProgress callback for specialist child events * feat(tui): show live tool-call progress in specialist cards * fix(swarm): update RunChild mock signature for new progress callback param * fix(tui): render plan panel inline in transcript, not pinned at top * chore: gofmt model.go, specialist_card.go, specialist_click_test.go * fix(tui): address PR review - plan panel without specialists, stream reader safety, resume dedup + payload keys	2026-06-19 20:35:08 +05:30
Anandan	ac6addaa83	Align sandbox permission blocks and backend states (#253) ... * Prompt for shell network permissions Route network-risk shell calls through the existing permission prompt instead of hard-denying them at sandbox preflight. Approved network prompts apply the current turn/session request-permissions overlay so the effective sandbox policy is widened only after user approval. Move network command detection into the shell AST analyzer for package installers, gh/git network subcommands, and python http.server so quoted process patterns such as pkill -f "python3 -m http.server 8000" are not misclassified as network activity. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox -run 'TestAnalyzeCommand|TestClassifyDoesNotFlagQuotedHttpServerPattern|TestEvaluateExemptsNetworkToolsFromDenyByDefault|TestEngineClassifiesNetworkAndDestructiveShellCommands|TestGrantRequestPermissionsNetworkOverlaysPolicyForTurn' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/agent -run 'TestRunPersistentCommandPrefixStillPromptsForNetwork|TestRunApprovedNetworkBashPromptAppliesTurnNetworkGrant' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/tools -run 'TestBash|TestRegistryRunsBashThroughSandboxEngine' Tested: GOCACHE=/tmp/zero-go-cache go test ./... * Auto-allow native-sandboxed shell commands Remove the old hidden bash auto-allow environment/config path. Ordinary shell commands now use the active native sandbox as the permission boundary by default, while network, destructive, and workspace policy checks still run first. Policy-only and disabled sandbox backends continue to require approval for shell commands, so unsandboxed execution is not silently allowed. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox -run 'TestSandboxedBash|TestShellSandboxActive|TestEvaluateExemptsNetworkToolsFromDenyByDefault|TestGrantRequestPermissionsNetworkOverlaysPolicyForTurn|TestAnalyzeCommand|TestClassifyDoesNotFlagQuotedHttpServerPattern' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/tools -run 'TestBashAuto|TestBashStillPromptsWithoutActiveSandbox|TestRegistryRunsBashThroughSandboxEngine' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/cli -run 'TestApplyConfiguredSandboxPolicy|TestApplyConfiguredAutonomyCeiling' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/agent -run 'TestRunPersistentCommandPrefixStillPromptsForNetwork|TestRunApprovedNetworkBashPromptAppliesTurnNetworkGrant' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/daemon -run 'TestScrubWorkerEnvRemovesReentrancyMarkers' Tested: GOCACHE=/tmp/zero-go-cache go test ./... * Prompt for destructive shell approval Remove the separate DenyDestructiveShell policy layer from active sandbox decisions. Destructive shell classification now produces an approval prompt in ask/auto flows instead of a sandbox hard-deny, while no-approval paths remain blocked. Drop the removed destructive-shell policy field from sandbox policy output, backend capabilities, snapshots, and Windows golden data. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/agent -run 'TestRunPromptsForDestructiveShellInsteadOfSandboxDeny|TestRunPersistentCommandPrefixStillPromptsForNetwork|TestRunApprovedNetworkBashPromptAppliesTurnNetworkGrant' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox -run 'TestEngineClassifiesNetworkAndDestructiveShellCommands|TestBackendCapabilitiesReflectDisabledPolicy' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/cli -run 'TestRunSandboxPolicy|TestEffectiveSandboxPolicy' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/zerocommands -run 'TestSandboxPolicySnapshotFromPolicyFillsEffectiveMode' Tested: GOCACHE=/tmp/zero-go-cache go test ./... * Remove web-tool network policy switch Remove the old EnforceToolNetwork policy option and the NetworkHostAllowed per-tool gate so sandbox network policy only controls sandboxed shell egress. Keep web_search and web_fetch on their own tool permission and URL safety paths, with tests proving deny/scoped shell network policy no longer blocks in-process web tools. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox -run 'TestEvaluateExemptsNetworkToolsFromShellNetworkPolicy|TestEngineAllowsNetworkSideEffectWhenShellPolicyBlocksNetwork|TestGrantRequestPermissionsNetworkOverlaysPolicyForTurn|TestScopedNetworkGateInEvaluate' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/tools -run 'TestWebSearchRunWithSandbox|TestWebFetchRunWithSandbox|TestRegistryRoutesWebFetchThroughSandboxPath' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/agent -run 'TestRunPersistentCommandPrefixStillPromptsForNetwork|TestRunApprovedNetworkBashPromptAppliesTurnNetworkGrant' Tested: GOCACHE=/tmp/zero-go-cache go test ./... Tested: git diff --check * Prompt for outside-workspace file access Convert recoverable outside-workspace file path violations into permission prompts instead of hard-denying in ask/auto modes. Approved prompts now grant the requested filesystem scope through the existing request_permissions overlay for the current turn or session, so the follow-up sandbox evaluation and scoped file tools use the same policy path. Keep unsafe mode, apply_patch escapes, symlink traversal, and non-recoverable path cases hard-denied. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox -run 'TestEngineAutoAllowsWorkspaceFileMutationTools|TestEngineDeniesOutOfWorkspacePaths|TestGrantRequestPermissionsReadDoesNotGrantWrite|TestGrantRequestPermissionsSessionPersists' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/agent -run 'TestRunPromptsAndAllowsOutsideWorkspaceWrite|TestRunSessionAllowsLaterOutsideWorkspaceWrite|TestRunAppliesSandboxEvenInUnsafeMode' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/tools -run 'TestRegistryAppliesSandboxBeforeToolExecution|TestRegistrySandboxGatesPathAliasKeys|TestRegistryAllowsPromptToolWithPersistentSandboxGrant' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/cli -run 'TestRunSandboxCheckJSONDeniesOutOfWorkspaceWrite' Tested: GOCACHE=/tmp/zero-go-cache go test ./... Tested: git diff --check * Fix Windows network prompt test fixture Use a Windows curl.cmd shim and cmd.exe PATH syntax for TestRunApprovedNetworkBashPromptAppliesTurnNetworkGrant while keeping the POSIX fake curl fixture for Linux and macOS. This keeps the test focused on network prompt approval and turn network grants instead of relying on a POSIX shell script being executable on Windows. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/agent -run 'TestRunApprovedNetworkBashPromptAppliesTurnNetworkGrant|TestRunPersistentCommandPrefixStillPromptsForNetwork' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox -run 'TestClassifyASTCatchesNetworkProgramsRegexMisses|TestClassifyFlagsPipedInstallerVariants' Tested: GOCACHE=/tmp/zero-go-cache go test ./... Tested: git diff --check * Remove sandbox autonomy ceilings Sandbox permission decisions now match grants by tool and scope only, without MaxAutonomy or request autonomy checks. Persistent/session grants, permission approvals, workspace-write auto-allow, and native-sandbox shell auto-allow no longer route through an autonomy ceiling. Remove the sandbox.maxAutonomy config and CLI surfaces, including grant --auto, policy output, sandbox check autonomy input, and sandbox grant snapshots. MCP permission autonomy is intentionally unchanged because it is a separate MCP permission model. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox ./internal/agent ./internal/tools ./internal/zerocommands ./internal/config ./internal/cli ./internal/tui Tested: GOCACHE=/tmp/zero-go-cache go test ./... * Fail closed without native sandbox Remove AllowPolicyOnlyRunner from sandbox policy and snapshots. A restricted/managed command plan now errors when native sandbox support is unavailable instead of running through a policy-only direct runner. Policy-only backend data remains as diagnostics for capability/reporting paths, but it no longer authorizes command execution when a platform sandbox is required. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox ./internal/zerocommands ./internal/cli ./internal/tui Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/agent ./internal/tools Tested: GOCACHE=/tmp/zero-go-cache go test ./... * Remove scoped shell network policy Drop the domain-scoped shell network mode and the local scoped-egress proxy path from the active sandbox model. Shell network policy now serializes and evaluates only deny or allow. Request-permissions network grants widen to allow without domain lists, and platform profiles consume the binary mode directly. The Linux helper no longer accepts proxy-route flags, Windows network hashes only the binary mode, and web tool tests assert they remain separate from shell network policy. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox ./internal/tools ./internal/notify Tested: GOCACHE=/tmp/zero-go-cache go test ./... * Align permission grant ordering and prompt text Move persistent and session grant matching ahead of recoverable sandbox prompts while keeping explicit denies and non-recoverable path violations fail-closed. Clean TUI permission transcript/card text so normal prompts show action, reason, scope, and readable block details instead of raw permission/risk/violation key-value metadata. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox ./internal/tui ./internal/agent ./internal/tools Tested: GOCACHE=/tmp/zero-go-cache go test ./... * Remove policy-only sandbox terminology Replace the unavailable native-backend diagnostic path with explicit unavailable support/backend states, and stop presenting missing native isolation as a policy-only fallback. Rename structured sandbox denial metadata from violation to block across permission events, stream-json, snapshots, TUI rendering, and sandbox-check output so user-facing flow matches blocked action language. Update README, work split docs, smoke test selectors, and Windows sandbox policy golden output for the new backend/support names and block payloads. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox ./internal/agent ./internal/tools ./internal/tui ./internal/cli ./internal/doctor ./internal/zerocommands ./internal/streamjson Tested: GOCACHE=/tmp/zero-go-cache go test ./... Tested: scripts/sandbox-smoke.sh Tested: git diff --check * Fix sandbox review follow-ups Fail closed for unknown network modes, keep network prompts ahead of bash allow grants, preserve v1 grant-file reads, and classify unparseable commands with obvious network programs as network-risk. Bump stream-json schema to v2 and document the block metadata field after the violation-to-block rename. Tests: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox ./internal/streamjson ./internal/specialist ./internal/cli -run 'TestExec.*Stream|TestStreamJSON|TestExecProtocol|TestExecReadsStreamJSONImages|TestExecAcceptsImageOnlyStreamJSONMessage|TestExecInputFormatStreamJSON' Tests: GOCACHE=/tmp/zero-go-cache go test ./... Tests: scripts/sandbox-smoke.sh Tests: git diff --check	2026-06-19 19:50:12 +05:30
Anandan	eb608741b0	Align permission prompt rendering (#246) ... * Align permission prompt rendering Remove normal permission prompt risk labels from focused cards, transcript rows, and permission detail text so risk metadata is not presented as the permission UI contract. Rename the recoverable deny option from a redirect-style prompt to a continue-without-running label that matches its current behavior. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/tui Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/tui ./internal/agent ./internal/cli Tested: GOCACHE=/tmp/zero-go-cache go test ./... Tested: git diff --check * Tighten permission prompt fallbacks Use conservative allow/deny choices when a permission request lacks backend-supplied decisions, avoiding impossible session or persistent grant options. Document that a failed session-grant recording attempt must not deny the current user-approved tool call; it only means a later matching call prompts again. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/tui ./internal/agent Tested: GOCACHE=/tmp/zero-go-cache go test ./... Tested: git diff --check * Split permission deny and cancel decisions Add an explicit cancel permission decision that aborts the active run while keeping deny as a recoverable tool refusal. Expose cancel choices for command and apply-patch approval prompts, keep apply-patch off the recoverable deny path, and stop offering persistent always approvals for command/apply-patch prompts until scoped prefix approval exists. Classify cancel decisions as permission-decision events for TUI session logs and exec JSON output. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/agent ./internal/tui ./internal/cli Tested: GOCACHE=/tmp/zero-go-cache go test ./... Tested: git diff --check * Stabilize OAuth secret creation Publish encrypted OAuth token secrets atomically under a short-lived creation lock so concurrent first-run callers never observe a half-written secret file. This fixes the Zero Review failure in TestLoadOrCreateSecretConcurrentConverges. Tested: go test ./internal/oauth -run TestLoadOrCreateSecretConcurrentConverges -count=100 Tested: go test ./internal/oauth Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/agent ./internal/tui ./internal/cli Tested: GOCACHE=/tmp/zero-go-cache go test ./... Tested: git diff --check	2026-06-18 16:53:20 +05:30
Anandan	2d62387e08	Align permission session approvals (#244) ... * Align permission session approvals Add in-memory session grants, workspace-write auto-allow for built-in file mutation tools, and dynamic permission choices for once/session/future approvals. Persist future approvals only when a grant store is configured, while keeping session approvals scoped to the active engine. Tested: GOCACHE=/tmp/zero-go-cache go test ./... * Guard workspace write auto-allow Exclude protected workspace metadata from built-in file-tool auto-allow so writes under .git, .zero, and .agents re-prompt instead of silently running. Derive apply_patch targets from patch headers inside the sandbox engine so patch-body escapes and symlink traversal are denied before workspace auto-allow. Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox -run 'TestEngineAutoAllowsWorkspaceFileMutationTools|TestEngineDoesNotAutoAllowProtectedMetadataWrites|TestEngineDeniesApplyPatchEscapesFromPatchBody|TestEngineSessionGrantDoesNotMatchSiblingFile|TestEngineDeniesAutoAllowedSymlinkEscape|TestEngineDeniesWorkspaceSymlinkTraversal|TestDeriveScope' Tested: GOCACHE=/tmp/zero-go-cache go test ./internal/sandbox ./internal/agent ./internal/tui ./internal/tools Tested: GOCACHE=/tmp/zero-go-cache go test ./... Tested: git diff --check	2026-06-18 14:54:00 +05:30
Anandan	a1b9bbb07c	Align permission prompts for web tools (#242) ... Treat hosted web_search as an allowed read-only network discovery tool so normal searches do not stop on a permission prompt, while retaining sandbox network enforcement when tool-network policy is enabled. Add host-scoped persistent grants for web_fetch URLs so an always-allow decision is bounded to the requested host instead of becoming a blanket tool-wide fetch grant. Update permission prompt and transcript rendering to show network targets, scoped always labels, and preserved scope metadata across live rows, render caching, and session hydration. Tested: GOCACHE=/tmp/zero-go-cache go test ./...	2026-06-18 13:45:49 +05:30
Anandan	6a9f44a716	Polish TUI transcript and reasoning display (#200) ... * Polish TUI transcript and reasoning display * Address provider and transcript review fixes * Gate inline think tag parsing * Cover disabled think tag parsing config	2026-06-14 18:55:18 +05:30
3 people	6fb0231df8	TUI scrollback re-architecture, Lime chat surface, and deep-audit fixes (#158) ... * docs(design): add Lime TUI prototype and rebuild spec * tui: remove the zeroline skin system One design remains in the tree ahead of the Lime rebuild: the zeroline package, its TUI view/skin plumbing (Options.Skin/ThemeVariant/ThemeDark, model skin branches, theme picker), and the zeroline CLI subcommand are gone. /theme keeps its shell-only message. * tui: replace the cyan palette with the Lime token table theme.go is rebuilt around the Lime design tokens (docs/design/ zero_tui_lime.html): near-black panels, one lime accent, solid tint stand-ins for the prototype's rgba overlays. Existing render sites map onto the new role styles (ink/line/userPrompt/toolName/toolArg) without layout changes; no hex exists outside theme.go. * tui: build the Lime chat-surface components Title bar with brand badge + context window, empty state replacing the deleted splash (block-art 0, tagline, 1-3 starter suggestions), stream blocks (user prompt gutter, muted interim with cursor, final-answer accent rail, done line, bordered notes), tool cards with diff/read/ bash/grep bodies and MiniDot run spinner, borderless composer with run-state hints, and the grouped status line. Final answers are marked at append time; resolved tool calls collapse into their result cards. * tui: fix Stage 2 review findings Adversarial review of the chat-surface commit confirmed 15 issues, all fixed here: - wrapPlainText sliced wide runes by rune count: CJK/emoji prose could panic the TUI or emit lines ~2x the measure; split at width instead - a cancelled run's streamingText leaked into the next turn's interim block; cancelRun now clears it - orphaned tool-call cards (cancelled/errored turns) re-animated with the spinner on any later run; the glyph is now scoped to the call's own runID - starter-suggestion digit capture was active while the chips were off screen (/clear mid-run); the guard now mirrors the render condition - prompt submits while a deferred Ctrl+C quit is draining could start a run the quit would orphan; submission is blocked while exiting - the running placeholder advertised ctrl+c (which quits) as the interrupt key; it now says esc - read-card parser expected 'N: text' but read_file emits 'N | text', so the gutter and L-range never rendered on real output - toolCard borders were one column short of the body rows - diff tint bands now span the full row; NEW FILE renders green on addBg; preamble/no-newline lines are unnumbered meta and no longer shift hunk numbering - card bodies and system notes paint the panel surface; the head gains the separate faintest arg column (grep target + pattern) - title-bar overflow now truncates the minimal candidate instead of rendering the deleted design's 'ZERO … READY' line - untracked the stray snake-game.html (left on disk, ignored) * tui: restyle the interactive surfaces for Lime Permission prompts render as the amber permission card (PERMISSION badge, risk readout, key chips); resolved prompts collapse to one line (allowed once/always/denied · tool) and unprompted allows fold into the tool card's [auto] tag. Ask-user and spec-review prompts share the card language with line borders. Autocomplete and picker overlays move onto the panel/selection tints with the accent ❯ marker; model-picker rows gain the provider dot and ctx · KEY_ENV metadata from the registry and provider catalog. /resume renders its list as stacked session cards (id + age, title, meta). Key handling is untouched everywhere. * tui: adaptive width tiers, doc updates, final polish Width tiers re-evaluate from the live width: ≥100 renders the full spec; 80–99 drops the tool-arg column, header ctx, and the status 'interactive' group; 58–79 drops the diff/read gutters, bares the badge, and keeps provider+tokens+mode; <58 renders a single-segment header, rail-less cards, and a mode-only status line. Table-driven tests cover {58,70,80,100,120} plus a frame-wide invariant that no emitted line exceeds the terminal at any tier. Card bodies expand tabs so width math holds. Dead splash-chip machinery (startupCommandNames, startupOrder) is gone; README's TUI section now describes Lime. * tui: fix final-review findings across Stages 3-4 A second adversarial review confirmed 14 issues, all addressed: - permission collapse and tool-card pairing are now run-scoped (rcKey): providers with repeating synthetic ToolCallIDs (Gemini gemini_tool_N) could attribute a decision or result to a different run's call - rehydrated always-grants no longer mislabel as 'allowed once' (GrantMatched fallback) - the width invariant now actually holds everywhere: empty-state tagline/hint, ask-user rows, permission detail blobs, pending image chips, and the sessions trailing hint are wrapped or fitted; the invariant test renders the empty state and all of those rows at widths 24-120 - every card (permission, ask-user, spec-review, sessions, notes) drops side borders on tiny terminals, not just tool cards - /resume card fields are sanitized against separator bytes from user-controlled titles - the picker's selected row paints its gap so the selBg band is solid - dead splash helpers (normalizedStartupWidth, countLines, nonEmpty, unreachable rowWelcome branch) and stale /theme comments are gone - README no longer claims transcript scrolling keys or Tab-accept behavior that never existed; chatWidth documents its 24-col floor Tag tui-lime-s4 moves to this commit. * audit: deep-audit report, TUI scrollback re-architecture, and cross-module fixes TUI: settled-row flush frontier prints history to native terminal scrollback (tea.Println, ordered + ack-serialized); View() renders only the live tail. Full diffs (400-line flush cap) and OSC 8 file:// links land in history; streamed interim text, cancellation markers, ask_user exchanges, and composer input history are preserved; run-scoped dedup keys fix Gemini's repeating tool-call ids; /exit, Ctrl+C-after-Esc, and cross-session late flushes no longer orphan or contaminate checkpoints. Cross-module: zero search panic + offset mapping, usage report robustness, 529 retry, SSE keep-alive watchdog, registry corrections, update --check on dev builds, MCP ping + mcp list --json secret redaction, sandbox.network config knob, doctor apiKey presence, atomic config writes, C1-safe notifications, rune-safe truncation everywhere, gofmt + vet CI gates, dead glamour dependency dropped. Full audit report: docs/audit/2026-06-10-deep-audit.md (175 findings). Co-Authored-By: Claude Fable 5 <[email protected]> * tui: hide malformed ask_user tool errors * fix tui malformed tool retries * fix max-turn finalization * upgrade tui agent guardrails * fix coderabbit guardrail findings --------- Co-authored-by: Claude Fable 5 <[email protected]> Co-authored-by: Vasanthdev2004 <[email protected]>	2026-06-10 17:18:30 +05:30
KRATOSandKRATOS	402d22de04	TUI shell: ask_user modal, pickers, autocomplete, zeroline skin (#127) ... * TUI shell: ask_user modal, pickers, autocomplete, zeroline skin Lands the interactive TUI shell on main. (The earlier PR for this content targeted the stacked agent-runtime branch and never reached main, which already has the agent runtime via #125; this re-targets the same reviewed content onto main.) - ask_user: interactive questionnaire modal wired to agent.OnAskUser via an answer channel; transcript rows + session payloads; degrades gracefully without an interactive surface. - compaction sizing: modelContextWindow() sets the agent ContextWindow from the active model's registry entry (unknown models -> 0, compaction off). - pickers (model/theme/effort/mode) + slash-command autocomplete overlay; zeroline skin rendering (boot/home/chat) behind Options.Skin. - checkpoint recording: before each mutating tool the run batches an EventSessionCheckpoint in order and flushes it at end-of-run and on cancel; /rewind reloads in-memory session state so dropped events don't re-reach the agent. Exposes sessions.SnapshotForCheckpoint with an orphan-blob safe-usage contract for the batch-in-order path. build/vet/-race/full-suite + GOOS=windows build green; 116 tui tests; no new deps. * Address #127 review (CodeRabbit): validate checkpoint session id, fix mode toggle, harden ask_user/rewind/flush - sessions.SnapshotForCheckpoint validates the session id (ValidSessionID), matching CaptureToolCheckpoint, so an exported caller can't route blob writes through an invalid session path. - nextPermissionMode: Unsafe now folds to Ask (the stricter landing), not Auto — toggling an Unsafe session must never make it less strict. Test added. - ask_user: a request with zero questions resolves immediately instead of opening a prompt that stalls the run. - cancelled-run flush: surface appendSessionEvents persist-failure rows instead of discarding them (a silently-failed checkpoint flush would degrade /rewind). - /rewind: handle post-rewind reload failures explicitly — on ReadEvents error, clear in-memory context and report, so stale rewound-away events can't reach the next prompt. - transcript dedupe: key ask_user rows on row.id (survives rehydration when row.askUser is nil). - ask_user Esc test: replaced the empty branch with a real assertion (run stays pending after Esc cancels only the prompt). build/vet/-race/full-suite + GOOS=windows build green. * Address #127 re-review: mirror normal flow for zero-question ask_user The zero-question fast path now records the (empty) request in the transcript and answers with an empty slice ([]string{}) instead of nil, so it matches the normal resolveAskUser flow and downstream sees a consistent Answers shape. (Skipped the suggested 'defer Ctrl+C quit until flush failures are acknowledged': blocking quit on Ctrl+C contradicts prompt-exit expectations, is a non-minimal UX change, and the edge is rare with graceful impact — the failure rows are already appended for the common non-exit cancel, and a missed checkpoint only makes that one /rewind unavailable.) --------- Co-authored-by: KRATOS <[email protected]>	2026-06-07 23:11:47 +05:30
Vasanth T	52fbb6d9e7	feat: add runtime permission decisions (#95)	2026-06-06 15:26:33 +05:30
Vasanth T	5b1b7edf74	feat(tui): surface sandbox permission events (#93) ... * feat(tui): surface sandbox permission events * fix(tui): stream permission rows live	2026-06-06 14:18:36 +05:30
Vasanth T	4f4f96511e	feat(tui): premium splash + working-view redesign (#83) ... * feat(tui): premium splash + working-view redesign Centralized truecolor theme and a visual-first session UI. Splash: - Two-tone ANSI Shadow ZERO wordmark (bright blocks / dim shadow) - Replace Enter/Tab/Ctrl+C keycaps with a permission-mode status line - Rounded boxes for header and prompt Working view (3 zones): - Header bar: cwd, git branch, provider/model, run state - Role-gutter rows (you / zero), tool rows with ok/err status and arg hints - Colorized diff cards for patch/edit output - Pinned status line: mode (left) + model, tokens, cost (right) Internals: - Centralized palette in theme.go (role/status/diff/mode styles) - Enrich transcriptRow with tool/status/detail for structured rendering - gitBranch resolves .git/HEAD including worktrees * fix: stabilize tui startup rendering * fix: preserve tui tool row metadata * test: document tui event rendering contract	2026-06-06 13:14:15 +05:30
Vasanth T	ef20e4bcae	feat: add Go command center (#63) ... * feat: add Go command center * fix: address command center review * fix: redact command center base urls * test: cover command center redaction streams	2026-06-05 13:26:22 +05:30
Vasanthdev2004	b4c374c6a2	feat: add go provider config and tui foundations	2026-06-04 17:11:40 +05:30