DeepSeek-Reasonix

7,984 Commits 53 Branches 623 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
SivanCola	0d7a103fdd	Upgrade browser runtime and session diagnostics / 升级内置浏览器运行时与会话诊断 (#10635 ) * feat(browser): add task-bound runtime and scoped diagnostic evidence Problem: production page injection and invalid captures prevent reliable browser inspection, while session exports lack browser troubleshooting evidence. Root cause: host-coupled page scripts, missing render ownership and mixed viewport/input facts allow stale observations and callbacks across lifecycle changes. Fix: bundle isolated semantic scripts; coordinate rendering, cancellation and identity; validate images; add optional query, wait, responsive, picker, diagnostics, recording and recovery capabilities; export bounded session-owned evidence without changing standing tool schemas. Verification: 279 Electron tests and typecheck; prior full Go and native/package evidence documented in the acceptance report. Native OOPIF CDP stalls and expanded scaled-input routing remain explicit merge blockers; no retry or deadline workaround hides them. * fix(browser): preserve cancelled capability write error chains Problem: capability transport failures lost their underlying cancellation identity, and generated Desktop inventory locations were stale. Root cause: the unknown-outcome wrapper formatted the original error as text instead of wrapping it; browser diagnostic additions shifted inventory source positions. Fix: wrap both the unknown-outcome sentinel and original transport error, and regenerate the existing Desktop inventory. Verification: a server-admission cancellation regression failed before the fix and now passes for pointer, viewport and recording writes; browser tests, root/Desktop golangci-lint and inventory tests pass. * fix(browser): route pointer input through the owning renderer Problem: zoom and native surface changes could drop clicks or send their press and release to different frames. Root cause: root CDP input used asynchronous cross-process hit-test data from the previous surface; DOM geometry alone did not establish input routing readiness. Fix: resolve the current frame in isolated worlds, use direct native input for in-process targets and the owning CDP session for OOPIFs, preserve coordinate scaling, and fence preparation against cancellation and identity changes. Strengthen diagnostic export URL assertions and align the native diagnostic fixture with host observation leases. Verification: 284 Electron tests, TypeScript and production build pass; macOS production fixture passes three scale transitions and 100 mixed-frame lifecycle cycles. Windows ARM64 and Linux ARM64/Xvfb pass the renderer-owned input matrix. Historical CDP stalls remain a separate merge gate. * fix(browser): own iframe sessions for the debugger connection lifetime Problem: adjacent frame observations and actions repeatedly tore down and initialized the same OOPIF protocol domains, exposing world-creation and initialization stalls. Root cause: target attachment ownership was tied to individual operations instead of the page debugger generation; cancellation and shared initialization therefore lacked a common owner. Fix: pool target sessions per connection, retain operation-scoped contexts and object groups, retire failed sessions after their last borrower, and clean late attachments without affecting replacement sessions. Preserve the existing one-second protocol budget and unknown write outcomes. Verification: 287 Electron tests and TypeScript pass; deterministic shared-waiter, cancellation, late-attach and cleanup-order regressions pass. Native macOS validates one attachment across snapshot/ref/input/upload, a fresh attachment after idle reconnect, the scale matrix and 100 mixed-frame lifecycle cycles. Windows ARM64 and Linux ARM64/Xvfb native fixtures pass. * fix(browser): preserve renderer-local pointer coordinates Problem: Scaled iframe clicks could hit a broad button away from its observed centre, and nested same-process descendants used the wrong coordinate origin. Root cause: Child CDP sessions accept renderer-local CSS coordinates, but input reapplied outer Fit scaling and treated the innermost frame as the renderer owner. Fix: Carry the session-owning frame through the operation runtime and dispatch its unscaled traversal point. Native fixtures assert exact received coordinates for same-process descendants inside OOPIFs. Verification: 288 Electron tests, typecheck, macOS 100-cycle native fixture, Windows ARM64 and Linux ARM64 native matrices, and the complete macOS packaged browser toolchain passed. * fix(browser): publish recording completion after cleanup Problem: macOS native CI could reject a new recording immediately after the previous job reported completed. Root cause: WebM validation published terminal status before asynchronous file cleanup released the global recording slot. Fix: Keep cleanup in finalizing and publish the terminal result and artifact at the same synchronous boundary that releases admission. Apply the same invariant to cancellation and interruption. Verification: A deterministic cleanup barrier fails on the prior implementation and passes for completed and cancelled jobs. All 289 Electron tests and TypeScript checks pass; native and packaged validation continue on this head. * test(cli): join controller teardown before removing fixtures Problem: Windows CI failed removing a clear-command fixture because its recovery database was still open. Root cause: The CLI controller owner helper only requested asynchronous Close; a Running poll did not join final persistence and store release. Fix: Wait for the existing Closed signal in the shared test owner, matching control tests, and remove the redundant timed cancellation poll. Verification: Complete internal/cli tests, focused race tests, and Windows ARM64 clear/cancel native test cases passed. Product behavior and test deadlines are unchanged.	2026-09-22 00:00:38 +08:00
SivanCola	698ea9a436	fix(desktop): close Electron migration ownership and installation gaps Problem: The Electron migration could install incomplete releases, route a background task into the foreground browser, execute after takeover, and lose the distinction between an unexecuted operation and an unknown outcome. Root cause: Installation still assumed a flat Wails payload; browser actions crossed asynchronous ownership boundaries without rechecking; remote uploads used desktop paths; shell instance, geometry, event, and command contracts did not fully preserve the existing Go owners. Fix: Merge current main-v2 and preserve its model-settings/runtime work. Publish complete version units, fence browser operations and remote connection changes, stage task-owned upload bytes, add explicit trusted takeover, and keep native selection/layout/home identity aligned. Recover core event state without write replay or renderer reload. Generate source ownership and truthful cancellation metadata for all 587 commands. Document the first-upgrade and recovery limits. Verification: Root and Desktop Go suites; focused race suites; both module vets and Windows cross-vet; zero-issue golangci-lint and repolint; frontend build, typecheck, discovered and owned suites; 96 Electron tests; real Chromium runtime scenarios and real Electron shell/Go/browser smoke. Preserve existing parent ratchets and the 2434.2 KiB initial bundle ceiling (measured 2434.1 KiB). Native four-platform install/signing and full live-task/performance acceptance remain release gates. No merge or release is performed by this change.	2026-09-09 12:40:09 +08:00
SivanCola	f51ba228ab	feat(desktop): unify remote browser access through a loopback broker Remote Reasonix Serve processes now use the same browser.Executor contract as local tabs, with the browser itself running inside the local Electron shell: - internal/browser gains the JSON-over-HTTP contract (wire types, client executor with 409 sentinel mapping, constant-time bearer handler with 1MiB bodies) shared by both ends. - The remote bootstrap injects REASONIX_BROWSER_BROKER/TOKEN into fresh serve launches (environment only, after probing the optional browser-broker capability marker); reused serves are re-pointed through POST /browser/broker after the desktop rotates the route. - The desktop runs one loopback broker reached only through an SSH reverse forward, minting a random bearer token per host connection generation; registering a new generation revokes the old token at once, and the generation fence refuses requests the moment a connection is replaced. Tokens are independent from credential-proxy routes. - Every broker request carries the session header and is resolved to the one desktop tab showing that session; foreign or missing sessions fail with no_grant. Screenshots and downloads are staged onto the remote host over the existing SFTP channel (FileRelay), so serve-side tools only ever read paths local to them. - Serve advertises the browser capability in the /auth/token handshake header; older remote builds omit it and keep every existing feature. - CLI serve reads the broker from the environment and scopes each controller's executor to its session tag, including rebuilds and multi-session builds.	2026-09-09 03:50:12 +08:00

Author

SHA1

Message

Date

SivanCola

0d7a103fdd

Upgrade browser runtime and session diagnostics / 升级内置浏览器运行时与会话诊断 (#10635 )

* feat(browser): add task-bound runtime and scoped diagnostic evidence

Problem: production page injection and invalid captures prevent reliable browser inspection, while session exports lack browser troubleshooting evidence.

Root cause: host-coupled page scripts, missing render ownership and mixed viewport/input facts allow stale observations and callbacks across lifecycle changes.

Fix: bundle isolated semantic scripts; coordinate rendering, cancellation and identity; validate images; add optional query, wait, responsive, picker, diagnostics, recording and recovery capabilities; export bounded session-owned evidence without changing standing tool schemas.

Verification: 279 Electron tests and typecheck; prior full Go and native/package evidence documented in the acceptance report. Native OOPIF CDP stalls and expanded scaled-input routing remain explicit merge blockers; no retry or deadline workaround hides them.

* fix(browser): preserve cancelled capability write error chains

Problem: capability transport failures lost their underlying cancellation identity, and generated Desktop inventory locations were stale.

Root cause: the unknown-outcome wrapper formatted the original error as text instead of wrapping it; browser diagnostic additions shifted inventory source positions.

Fix: wrap both the unknown-outcome sentinel and original transport error, and regenerate the existing Desktop inventory.

Verification: a server-admission cancellation regression failed before the fix and now passes for pointer, viewport and recording writes; browser tests, root/Desktop golangci-lint and inventory tests pass.

* fix(browser): route pointer input through the owning renderer

Problem: zoom and native surface changes could drop clicks or send their press and release to different frames.

Root cause: root CDP input used asynchronous cross-process hit-test data from the previous surface; DOM geometry alone did not establish input routing readiness.

Fix: resolve the current frame in isolated worlds, use direct native input for in-process targets and the owning CDP session for OOPIFs, preserve coordinate scaling, and fence preparation against cancellation and identity changes. Strengthen diagnostic export URL assertions and align the native diagnostic fixture with host observation leases.

Verification: 284 Electron tests, TypeScript and production build pass; macOS production fixture passes three scale transitions and 100 mixed-frame lifecycle cycles. Windows ARM64 and Linux ARM64/Xvfb pass the renderer-owned input matrix. Historical CDP stalls remain a separate merge gate.

* fix(browser): own iframe sessions for the debugger connection lifetime

Problem: adjacent frame observations and actions repeatedly tore down and initialized the same OOPIF protocol domains, exposing world-creation and initialization stalls.

Root cause: target attachment ownership was tied to individual operations instead of the page debugger generation; cancellation and shared initialization therefore lacked a common owner.

Fix: pool target sessions per connection, retain operation-scoped contexts and object groups, retire failed sessions after their last borrower, and clean late attachments without affecting replacement sessions. Preserve the existing one-second protocol budget and unknown write outcomes.

Verification: 287 Electron tests and TypeScript pass; deterministic shared-waiter, cancellation, late-attach and cleanup-order regressions pass. Native macOS validates one attachment across snapshot/ref/input/upload, a fresh attachment after idle reconnect, the scale matrix and 100 mixed-frame lifecycle cycles. Windows ARM64 and Linux ARM64/Xvfb native fixtures pass.

* fix(browser): preserve renderer-local pointer coordinates

Problem: Scaled iframe clicks could hit a broad button away from its observed centre, and nested same-process descendants used the wrong coordinate origin.

Root cause: Child CDP sessions accept renderer-local CSS coordinates, but input reapplied outer Fit scaling and treated the innermost frame as the renderer owner.

Fix: Carry the session-owning frame through the operation runtime and dispatch its unscaled traversal point. Native fixtures assert exact received coordinates for same-process descendants inside OOPIFs.

Verification: 288 Electron tests, typecheck, macOS 100-cycle native fixture, Windows ARM64 and Linux ARM64 native matrices, and the complete macOS packaged browser toolchain passed.

* fix(browser): publish recording completion after cleanup

Problem: macOS native CI could reject a new recording immediately after the previous job reported completed.

Root cause: WebM validation published terminal status before asynchronous file cleanup released the global recording slot.

Fix: Keep cleanup in finalizing and publish the terminal result and artifact at the same synchronous boundary that releases admission. Apply the same invariant to cancellation and interruption.

Verification: A deterministic cleanup barrier fails on the prior implementation and passes for completed and cancelled jobs. All 289 Electron tests and TypeScript checks pass; native and packaged validation continue on this head.

* test(cli): join controller teardown before removing fixtures

Problem: Windows CI failed removing a clear-command fixture because its recovery database was still open.

Root cause: The CLI controller owner helper only requested asynchronous Close; a Running poll did not join final persistence and store release.

Fix: Wait for the existing Closed signal in the shared test owner, matching control tests, and remove the redundant timed cancellation poll.

Verification: Complete internal/cli tests, focused race tests, and Windows ARM64 clear/cancel native test cases passed. Product behavior and test deadlines are unchanged.

2026-09-22 00:00:38 +08:00

SivanCola

698ea9a436

fix(desktop): close Electron migration ownership and installation gaps

Problem: The Electron migration could install incomplete releases, route a
background task into the foreground browser, execute after takeover, and lose
the distinction between an unexecuted operation and an unknown outcome.

Root cause: Installation still assumed a flat Wails payload; browser actions
crossed asynchronous ownership boundaries without rechecking; remote uploads
used desktop paths; shell instance, geometry, event, and command contracts did
not fully preserve the existing Go owners.

Fix: Merge current main-v2 and preserve its model-settings/runtime work. Publish
complete version units, fence browser operations and remote connection changes,
stage task-owned upload bytes, add explicit trusted takeover, and keep native
selection/layout/home identity aligned. Recover core event state without write
replay or renderer reload. Generate source ownership and truthful cancellation
metadata for all 587 commands. Document the first-upgrade and recovery limits.

Verification: Root and Desktop Go suites; focused race suites; both module vets
and Windows cross-vet; zero-issue golangci-lint and repolint; frontend build,
typecheck, discovered and owned suites; 96 Electron tests; real Chromium runtime
scenarios and real Electron shell/Go/browser smoke. Preserve existing parent
ratchets and the 2434.2 KiB initial bundle ceiling (measured 2434.1 KiB).

Native four-platform install/signing and full live-task/performance acceptance
remain release gates. No merge or release is performed by this change.

2026-09-09 12:40:09 +08:00

SivanCola

f51ba228ab

feat(desktop): unify remote browser access through a loopback broker

Remote Reasonix Serve processes now use the same browser.Executor contract
as local tabs, with the browser itself running inside the local Electron
shell:

- internal/browser gains the JSON-over-HTTP contract (wire types, client
  executor with 409 sentinel mapping, constant-time bearer handler with
  1MiB bodies) shared by both ends.
- The remote bootstrap injects REASONIX_BROWSER_BROKER/TOKEN into fresh
  serve launches (environment only, after probing the optional
  browser-broker capability marker); reused serves are re-pointed through
  POST /browser/broker after the desktop rotates the route.
- The desktop runs one loopback broker reached only through an SSH reverse
  forward, minting a random bearer token per host connection generation;
  registering a new generation revokes the old token at once, and the
  generation fence refuses requests the moment a connection is replaced.
  Tokens are independent from credential-proxy routes.
- Every broker request carries the session header and is resolved to the
  one desktop tab showing that session; foreign or missing sessions fail
  with no_grant. Screenshots and downloads are staged onto the remote host
  over the existing SFTP channel (FileRelay), so serve-side tools only
  ever read paths local to them.
- Serve advertises the browser capability in the /auth/token handshake
  header; older remote builds omit it and keep every existing feature.
- CLI serve reads the broker from the environment and scopes each
  controller's executor to its session tag, including rebuilds and
  multi-session builds.

2026-09-09 03:50:12 +08:00