cli-channels runs in the studio-cli-channels environment and is the only job
with id-token: write. Its registry tokens are environment-only secrets
(STUDIO_NPM_TOKEN, STUDIO_HOMEBREW_TAP_TOKEN), and its first step fails unless
the environment has a required reviewer. npm publish passes --provenance,
matching the 1.x release line. A contract test parses every workflow and pins
the permissions, the secret references and the id-token grant. npm/ changes now
trigger the CI job that runs npm/publish.test.mjs.
neterr.IsConnReset fell back to any net.Error, so a *net.DNSError read as a
dropped stream and users saw "disconnected before completion after retry
attempts" for a host that never resolved and was never retried. DNS errors are
now excluded from the reset judgement, and explainError gives them their own
typed branch that names the host and separates a nonexistent name from a
temporary resolver failure.
Refs #11391
The storage panel showed "Measuring..." forever when one root (a huge or
slow directory, common on Windows) never finished, because GET /storage
walked all five roots synchronously with no limit and the client had no
timeout.
- Survey walks each root under a 10s budget and reports a lower bound with
Truncated set when it runs out, even if a filesystem call never returns.
- GET /storage?layout=1 answers at once with unmeasured roots and
GET /storage?root=<id> measures one root, so a slow root no longer holds
back the others.
- The panel draws rows immediately, fills each root in as it arrives, marks
a truncated count as a lower bound and shows "timed out" for a root the
kernel never answers.
Port of #11386 (main-v2). The recovery block now ends with a sentence
stating that the user's new message takes precedence, so an unrelated
message no longer makes the model resume the interrupted task.
Refs #11381
The docked workbench hides its canvas while the file list is open, and the
browser page and its address bar are drawn in that canvas. Selecting a tab or
opening a new browser tab left the list open, so the browser never appeared.
Every selection now goes through one helper that also closes the list.
The authoring guard skips any task without a solution/, so all twenty
verification-stress graders have only ever been checked against the pristine
seed - never against an answer that should pass. Ten now carry one.
The reference-solution test holds graders to both halves of the authoring rule
but skips memorybench, which ships no solution/ - the half #11329 fell through.
`-policy` is the MemoryBench experiment arm: `memory-off` hides the memory
store so a run can be compared against itself, and the only switch that
separates the two arms of that counterfactual. It is defined at
`cmd/e2ebench/main.go:268` and used in the recipe further down this README, but
the flag table never listed it.
Placed with the other suite-mode experiment arms (`-anchor`, `-cache`) rather
than beside `-ablate`, so it does not collide with the open #11364 that edits
that row.
ablation.Modules() has seven modules; the sentence documenting --ablate stops at
upstream. #11360 edited the same sentence to drop full-fold but left this one.
The bar named a field that does not exist (`PostSufficientSearches`) and a mode
that cannot produce counts (`-mode=calibrate`). The gate is the run's
`stopping_class` from the `-mode=run-index` report: a task qualifies when it is
neither `PostSufficientRetrieval` nor `PostSufficientRunaway`, so `SnippetStop`,
`SnippetThenRead` and `DefensiveRead` all qualify, and a defensive read is
deliberately not counted as waste. Also records that calibrate is not a
screening tool, which is why its cue-visibility profile is the same for every
task.
CloudDesktop only set Content-Type when the request had a body, so a
bodyless POST such as /runtimes/{id}/close reached csrfGuard without a
JSON type and was refused with 415 request.bad_content_type. Deleting a
project or session closes its panel first, so the delete failed in the
web Studio. csrfGuard is unchanged.
The benchmarks README still described this harness as the pre-#8244
comprehension/TTL/prune A/B, and taught a subcommand and flags the code has not
had since that rewrite.
A full-screen repaint draws every settled block, so when a background
[cli].diff_formatter run landed and the re-render hook was keyless, the
repaint dropped every diff block's cached rows and re-consulted the memo
for each. Once the transcript held more diff keys than the memo, the repaint
always re-missed at least one block, spawned a run for it, and that run
landed and repainted again — an endless loop of formatter runs and full
repaints.
Carry the landed DiffKey on the hook and remember, per block, the keys its
last render consulted, so a landed run drops only the blocks that asked for
its key. Gate the drop on the memo still holding the key: re-rendering a
block whose key was evicted would re-run the formatter and evict another
live key, so an evicted block keeps the rows it already shows.
The memo is raised to 128 so a normal transcript does not reach the eviction
path, and keyed by a 128-bit hash of the diff text rather than the text
itself, so an entry retains only the formatted output (~33-41% less
retained heap). Also record the formatter's 1 MiB size cap as a fallback
reason in the CLI reference.
ablation.FullFold has had no reader since #8244 (397ed30ec) replaced the
multi-threshold path with the single checkpoint design: foldSource and
carryPriorDigests lost their Off(FullFold) checks together with their test, so
-arm=incremental was identical to the default, and the default already folds the
model-visible projection. The checkpoint design is the intended one, so retire
the dead axis rather than restore the old re-read.
- ablation: drop the FullFold module (constant, comment, module list entry)
- compaction bench: drop the -arm flag, the arms struct, foldArm, and the arm
label from the report title and the JSON report
- benchmarks/README.md: drop the "Fold arms" section, and correct the paragraph
that claimed a fold re-derives its digest from the canonical transcript
- docs/CLI.md: drop full-fold from the --ablate list
Verified: go build ./...; go vet; go test ./benchmarks/compaction/
./internal/contract/ablation/; go run ./tools/repolint clean; golangci-lint
v2.12.2 (the version CI pins) 0 issues. -mode=cost still reports the same eight
generations, -arm is now an unknown flag, and the JSON report no longer carries
an arm label.
Fixes#11358.
studio's config.go sits exactly at its file-size budget, so the diff-fences
feature's added [cli] fields tipped it over repolint's ratchet. Extract the
CLIConfig type into cli.go, alongside the existing render_cli.go, to keep the
budget.
A shell tool result whose whole output is a unified diff — bash running
`git diff`, or `git show` in its default format — is tagged and rendered as a
diff: the TUI draws it through the same rows a ```diff fence produces, ACP
fences it for its client, and the desktop card renders it with DiffView.
The tag is computed once, at the one sink every emitter shares, and is gated by
the opt-in [agent].embedded_diff_detection (default false). Detection is
whole-text and conservative (diff.IsUnifiedDiff): every line must belong to the
diff grammar — including a `git show` / `git log -p` commit header and its
indented message — and a lossy Bound is never tagged, so a diff followed by
prose, a build log, or a truncation note stays prose. The tag is re-derived when
a session is rebuilt from /history, so a reopened session renders the same diff
the live one did.
The desktop DiffView splits a multi-file diff into per-file sections by the same
rule the CLI uses (git's "diff --git", else the "--- "/"+++ " pair) and names
each with its own "path +A -B" header row, so a `git diff` over several files no
longer shows only its first file's name over rows that belong to all of them.
A single-file diff keeps the card headline as its only name, so the fact is not
said twice.
trimDiffPreamble returning "" for a section with no --- line left a ```diff
fence without a --- /+++ pair rendering as an empty block. splitDiffSections now
returns sections untrimmed; the fence path trims each and falls back to the plain
code rail when it carries no file header, while the shell-diff path still drops a
pure preamble. A marked shell diff keeps the card's "⎿" connector on its first
row, like every other tool card's body. /history reads the embedded-diff flag the
session was built with instead of reloading config per request, and the hunk
parser rejects a body that overshoots its declared count.
[cli].diff_formatter names an optional external argv line (run without a shell)
that formats a diff before the CLI/TUI emits it — both a fenced
```diff/```patch block and a writer tool's diff card. The whole diff goes to the
command's stdin and its stdout is re-emitted with non-SGR control sequences
stripped. On failure, timeout, empty output, or an oversized block the built-in
renderer is used. Like [cli].update_channel it is user/global only: a
project-local reasonix.toml cannot run a command on the user's machine.
The run is memoised per (block content, width), because a View re-renders many
times while a fence streams and again on every resize. It runs only on a closed
fence, so a fence still streaming spawns no subprocess per delta, and the command
is handed the terminal width via COLUMNS with its output clamped to it. A
WaitDelay bounds the wait for a formatter's pipes, so one that leaves a child
holding stdout cannot block the render past the timeout. The writer card drops
the "--- /+++ " pair before piping, so the formatter cannot re-emit a raw host
path the card header already names.
This commit also wires [cli].diff_fences, the opt-in toggle that turns the
fenced-diff renderer on.
A fenced ```diff or ```patch block in the answer stream is drawn through the
colourised diff renderer — add/remove backgrounds, +/- gutter, line numbers,
chroma — instead of the generic code rail. A multi-file git-style fence is split
into per-file sections, each with a bold(accent(path)) +A -B header. Copy mode
keeps the plain rail path so the copied text stays byte-identical to the fence
source.
A fence that already carries ANSI (a pasted colourised diff) is shown verbatim,
with non-SGR control sequences stripped so a hostile payload cannot drive the
terminal.
It is off by default: the renderer runs only when activeDiffFences is set, so a
fence a model writes stays on the plain code rail unless the user opts in.
`@scope/[email protected]` and `[email protected]` were rejected by both
looksLikePackage implementations (Go installer and registry publish
validation), so an npm MCP entry could not pin its version. Both now accept
an optional `@<exact semver>` suffix and still refuse ranges, dist-tags,
empty versions, a repeated `@`, and anything with whitespace, shell
metacharacters, path segments or scheme prefixes.
A leading `-` is now refused as well, so a bare source can no longer be read
by npx as an option. The default MCP name drops the version suffix.
Pinning the top-level package does not pin its transitive dependencies.
Add owner headers to twelve contract and design documents, split their
over-wide paragraphs into rules, route their ownership to the primary
named in CODEOWNERS, and treat the generated protocol index as a
machine-read file. Baseline: doc-owner 40 -> 27, doc-prose 2276 -> 2147.
Add idle_timeout_seconds, a per-provider override of the 300s stream idle
watchdog. One knob bounds both windows a model call can spend silent: the
transport's pre-header deadline (prefill) and the read loop's inter-event
watchdog (generation). Zero or unset keeps the default.
The bound holds where the value is read: IdleTimeoutFromExtra clamps to
[1s, 32767s], so a hand-edited value — which never passes UpsertProvider's
validation — cannot overflow time.Duration(v) * time.Second into a negative
window the transport reads as "no timeout". validateProvider still rejects an
out-of-range value on the edit path.
The stall error names idle_timeout_seconds, and the docs note that a silent
pre-header wait is retried once, so the effective hold can reach ~2x the value.
A Studio install on another drive than the update cache never took the
chunked update: the swap's pre-flight renamed a probe from the install
into the cache, and a rename cannot cross volumes. The swap backup now
lives inside the install (<install>\.reasonix-update\<version>), the one
place guaranteed to share its volume; staged files still come from the
cache and are copied in when the rename fails.
Chunks are fetched through update.Transport, so they take the IPv4
route from the second attempt as the full download does, and chunks a
round could not fetch get a second round instead of voiding the delta.
Why a delta was abandoned is now a typed code (update.delta.*) that the
step giving up attaches; it rides on Progress.DeltaSkipped through the
full download and its failure, is logged, and the version panel says it
is downloading the full package and why.
Full downloads drop a connection that delivers nothing for 30 seconds
and resume on a new one; only attempts that made no progress count
against the retry budget. The artifact is written to a partial file in
the update cache named by its digest, so a timed-out or restarted update
resumes instead of starting over; a partial that fails verification is
removed. A body the manifest's size rules out (an error page served as
200) fails that address and moves to the fallback without being resumed.
With stalls caught, the fetch deadline is two hours rather than thirty
minutes.
A file copied in from another volume is written under a temporary name
beside its destination and renamed into place, so a crash mid-copy never
leaves a half-written file at the install path. A backup directory the
install refuses to create is ErrTreeNotSwappable. The delta phase has
its own 40-minute budget (update.delta.timed_out) and gives up after 16
chunks fail in a row, so a mirror that has gone quiet leaves the full
package its time. The reason is also exposed to screen readers.
"pnpm install" contains "npm install" as a substring, so verify.sh's
negative grep matched the very answer the positive grep demanded, and the
task could never pass. Disambiguate the negative check so it only matches
"npm install" when it is not preceded by "p", instead of anchoring the
positive check to line start, which would have moved the grader out of
line with every sibling task's plain substring convention.
Also extends TestSolvableCorpusSeedsMustNotGradeClean to the memorybench
corpus (it was not covered by the existing e2e/verification-stress/train
authoring guard) and adds a targeted regression test pinning the four
cases worked through by hand in the report.
Credit to chuiwenwei for the root-cause analysis and both candidate fixes.
Fixes#11329
The Studio manifest named only GitHub release URLs for full artifacts, so
every update downloaded the installer over the route CN users reach
slowest, even though the release workflow already uploads the same files
to the R2 mirror.
When the release is mirrored, studio-manifest now writes the mirror
address as each asset's url/sig and keeps the GitHub address in new
optional fallback/fallback_sig fields. Old clients ignore the new fields
and use the mirror, which the redirect allow-list already accepts.
The updater tries each address in order with its own retry budget,
resuming what the first delivered from the second. Signature, digest and
size checks are unchanged and apply to whichever address served the
bytes.
An approved market package whose reviewed version carries no content digest
was a dead end: the detail page showed "not pinned" and no way to install it.
It now offers "Trust and install". The request carries trust, and the kernel
plans it through install_source exactly like any other market install; the
preview's own contentDigest becomes the pin, apply must echo it, and content
that changes after the person confirmed is refused. The outcome and the ledger
record the install as unreviewed, and the confirmation says the content may
differ from what was reviewed.
A pinned version is unchanged: trust never replaces the reviewer's digest, a
digest other than the pin is refused as a version change, and moved content
still fails with market.content_changed. Without trust an unpinned version
still answers market.unpinned.
The publisher's own unreviewed install and the trusted install now share one
preview-pinned path, and market.unpreviewed is answered on both routes. The
list filter and badge read "pinned" instead of "installable", since an
unpinned package is now installable too.
A command the host cannot classify gets a before/after workspace scan,
and a scan that sees a change proves a write. An inline plan check such
as `python -c "import fizzbuzz; ..."` imports the module and writes its
bytecode, so the check was proven a change and owed itself another run.
Each check now measures "after the latest change" from the latest proven
change not counting its own residue: a run of exactly that check whose
written paths a complete workspace walk named, each of them a file whose
first touch this turn was its creation, none of them a file the plan
names or any other write this turn touched. A check that deletes a file
on one run and writes it back on the next is not its creator. Anything else counts: a run that does more than the check,
a check that rewrites the source it just checked, a check that rewrites
any file that predates the turn whether or not anything named it (go
generate, a whole-tree formatter, a lockfile rewrite), a path list cut
at the observation limit or never walked, and every run of
a different check - so a rebuild by one check voids another check's pass
taken against the stale build, and a check that never ran is not settled
because the only write came from another check. The plan deliverable and
the change criterion leave out the residue of every plan check.
The walk now also runs after a call whose watched paths already proved
a change, and records which files it saw appear: a new top-level entry
proves a change on its own, and without the walk a rewrite deeper in the
tree next to it went unnamed. The receipt says when its paths came from a
complete walk (paths_complete), so residue is never read off a list that
only holds what the host happened to watch.
The executor handoff now says what counts for a verify line: that exact
command, run as written after the latest change. It used to invite the
executor to validate and adapt inferred commands, which is how most held
runs ended up running a reworded variant.
Move the ProviderEntry/ProviderModelOverride types, their accessors and
validation into provider_entry.go, and the provider table rendering into
render_providers.go. Trim the moved doc comments to the <=3-line budget and
reclaim the freed repolint budget.
No behavior change: same types, accessors, validation and rendered output.
The TUI laid rows out with grapheme widths while bubbletea's renderer counts
per rune until the terminal answers the mode 2027 query, and so do the
terminals that never answer it (Terminal.app, legacy conhost). A VS16 emoji
pulled the scrollbar left, a ZWJ row lost its scrollbar cell, table lines
moved, and on conhost or behind an approval card those rows overflowed and
every row below was drawn twice. conhost also drew emoji as fallback glyphs
and `◆ ●` as `?`, and Windows Terminal drew boxes for flags and keycaps.
1.x has the alignment defect as well.
- termrender measures through one method, Cells(), with per-rune Truncate
and Cut of its own (the library's cut whole clusters and came out wider
than asked). The TUI sets it per rune and switches it to grapheme clusters
on the mode report bubbletea acts on; before the program starts it asks the
terminal how far U+26A0 U+FE0F advances, so one drawing it two wide gets
the grapheme count without answering 2027.
- Per rune, the whole frame is drawn stand-ins that keep the per-rune count:
joiners, selectors, keycap marks and tags go, a skin tone becomes its two
blank cells, a regional indicator its letter, and a one-column emoji with
only a two-column glyph is kept only before a blank.
- On conhost, told from a pseudoconsole by its window class, each rune is
asked of the console's own font (glyph and advance) and measurement; one it
cannot draw as counted takes a drawn symbol of the same meaning, its
halfwidth form, a flag letter, the OS best-fit when it really maps, or
blank cells. Windows Terminal gets letters for flags and base characters
for keycaps and tag flags.
- Live rows full screen are drawn at the transcript's width, so a pending
tool row is not wrapped again when it lands there.
Selection copies the original text; stand-ins change only what is drawn.
A desktop session whose person never named a posture now opens the way the
terminal does since #11256: Auto only where the OS sandbox confines writes
and the folder is trusted, Ask everywhere else (always on Windows). A named
posture - set in config or switched on the composer - is kept, and a value
this build does not know still opens in Ask with its notice.
- control: mode and "defaulted" are one approval sub-state; a trust answer
re-derives a defaulted posture with one check-and-set under the approval
lock, so a concurrent switch stays named. New FolderTrust port (Posture,
DecideWorkspaceTrust). TrustableFolder resolves symlinks and refuses a
filesystem root, anything holding a home directory, and anything inside or
holding the Reasonix home or state directory.
- config: desktop.default_tool_approval_mode is unset by default and renders
as a comment. A startup step releases a written "auto" once, recorded in
desktop-posture-released.json beside the config rather than in
config_version, which the 1.x line's own upgrades own; ask, yolo and
unknown values stay. The studio host now runs the startup upgrades.
- serve: POST /workspace-trust, approvalDefault on /status; the hub carries
only a named posture to later panes; a rebuild re-derives a default.
- studio: the terminal's "trust this folder?" question beside the composer
where a sandbox would confine what trust allows, and a note with a
one-click switch to Auto where no sandbox is in effect.
1.x's `reasonix run` and `-p` leave stderr empty on a clean run. Studio wrote
three slog records there on every run: `INFO boot: assembly timing`,
`WARN prompt refiner provider construction failed` (whenever the optional
refiner side model cannot be built) and, with -c, `INFO controller: resume
cache state`. A script that treats stderr output as a failure, or captures it
into a report, broke on every invocation.
All three are diagnostics nobody has to act on, so they log at debug level.
`run --debug` lowers the process log level while flags are parsed, before
assembly writes its first record, for whoever wants them back. Warnings the
user has to act on keep their own channel.
/events numbers frames from where a subscriber attaches, and Subscribe
connected in the background. An action taken right after it returned could
emit its frames before the connection registered, and the stream never
carried them. TestUnknownSlashCommandNeverReachesTheModel lost its
unknown-command notice this way whenever the kernel answered faster than the
subscription attached (every time on a Linux runner with GOMAXPROCS at 1 or 2, and on the coverage job), and the TUI's
own Init has the same order: it subscribes and then submits --prompt.
Subscribe now returns once the first connection has a response in hand (the
server registers the subscriber before it writes a byte) or has failed.
Every user-config save (reasonix config compact-ratio, the Studio settings
page, the serve settings endpoints, model and approval persistence) went
through Config.SaveTo, which re-rendered the whole file from the struct.
Anything the struct does not decode was dropped - [checkpoints],
browser.chrome_path, providers[].display_name, agent.web_search_model,
desktop.layout_style / status_bar_style_initialized,
remote.hosts[].credential_mode - and values the renderer normalises were
rewritten, so a 1.x default_tool_approval_mode = "danger-full-access"
became "ask". Losing credential_mode = "remote" flips a remote host from
using the host's credentials to tunnelling the local key.
An existing user config is now edited in place: the file is indexed by
table path (array elements by their name), the rendered form of the file
as it loads is compared with the rendered form of the config being saved,
and only the keys that differ are rewritten, added or removed. A key the
save changed but the renderer never writes (a retired field a setter
cleared) is removed, and the keys this build declares retired are still
stripped. Unknown keys and tables, comments, order, line endings and
values this build reads differently stay byte-for-byte. The edited text is
accepted only if it loads to the same configuration the full render would;
otherwise the full render is written and the previous bytes are kept
beside it as config.toml.rewrite-<time>. A missing or empty file is still
written from the template.
A config written from nothing now carries config_version = 12. The 1.x
line rewrites the whole file on start when the marker is below its latest
upgrade (12), dropping [storage], [memory] and the other tables it does
not know. This build's own upgrades still gate on version 6 and an
upgraded older file is still marked 6, so 1.x keeps running its 7-12
migrations for content that never had them.
Arrays of tables are edited per element, keyed by name. The whole array
is written from the render instead - leaving every other byte alone -
when an element the save changes or drops is not a block of its own in
the text, when an element has no name or shares one, when the save
reorders the elements, or when the file holds no such array yet (so
adding the first provider keeps the built-in ones). A new element is
placed before the next kept one, so a rename keeps its neighbours whole.
Dropped elements are removed in one pass over one index, so an element's
sub-tables are never handed to the element above it and removing many
elements is linear.
Keys and sub-tables Config does not decode are never dropped silently.
Rewriting an array carries each element's own into the rendered element
of the same name, verbatim; turning an inline table into a table carries
its plain entries as key lines. When an entry has nowhere to go (two
elements share a name, an element the load merged away, a nested table
value) the result is still written in place and the prior bytes are kept
beside it as config.toml.rewrite-<time>, as the full-rewrite fallback
does. An element the user deleted takes its entries with it.
A value the user sets is written even where the render would not show a
difference: a single-line key is rewritten when its encoded value
changed, so choosing Ask replaces a 1.x danger-full-access that already
loads as ask. A key nobody touched keeps its bytes.
A save never writes a file that does not load. system_prompt is
rendered as an escaped multi-line string (a backslash or """ in a prompt
used to produce an unparseable file). When the render still does not
load, the in-place edit is used if the lines the decoder refuses are the
same before and after the edit and the result loads as the render
describes; otherwise the save fails and the file is left as it was.
Inserted text takes the file's line ending outside strings only.
An unrecognised default_tool_approval_mode still opens a desktop window
in Ask, now with an approval_mode_unrecognized notice the frontend
localizes, and the file keeps the value until the user picks a mode.
The fixture is the file 1.x v1.39.5 writes through its own SaveTo with
the affected keys set.
A one-word message let the edit and rewind controls widen the card, and the
bubble then sat against the card's left edge, leaving a gap on the right.
The controls row no longer sizes the card (contain: inline-size), the bubble
is pushed to the right edge, and the controls drop to icons with their
accessible names, hints and keyboard focus when their labels need more room
than the bubble gives. Whether they fit is measured, not a fixed breakpoint.
Closes#11255
In the reading measure the transcript was 760px wide but replies and user
turns were still capped at --doc (706px), a value left over from when the
flow was a wide container with a narrower prose measure inside it. The
steps card inside a reply and the user bubble therefore stopped 60px short
of the composer's right edge, while the ask card and notices reached it.
The column now has one source: --column (760px) in tokens.css, with --doc
derived from it. The flow is laid at --doc, the composer and its shelves
at --column, and the per-row caps are gone, so every card shares the
composer's edges. The full measure still only moves --doc: the transcript
widens and the composer keeps the reading width. The studio-only
--measure variable that duplicated --doc is removed.
cards.mjs asserts the shared edges at 1440 and 1000px in the reading
measure, and that the full measure leaves the composer unchanged; the
new checks fail against the previous stylesheet.
Closes#11267
In 1.x a ! command is the user's own: it runs, its output is shown, and
nothing enters the conversation. The TUI handed it to RunShell, whose
answerShell puts the output into the conversation and starts a turn, so every
command cost a request and the model often replied with a question.
RunShellWith takes a ShellRun; LocalOnly skips answerShell. It sits on a new
LocalShell sub-port that only SessionAPI carries. serve's in-process /submit
takes localShell, and the TUI's shell mode sends through a RunShell client
call that sets it and echoes the command without waiting for a turn to name
it. RunShell keeps answering, so Studio is unchanged.
RunShell and its helpers move from controller.go to shell.go, which the
file-size ceiling on controller.go required.
With no terminal, 1.x printed usage for a bare `reasonix` and exited 0;
studio exited 2, the usage-error status, although nothing was wrong with the
command line. Session options with no terminal to open a session in remain a
usage error. bareUsage moves out of cli.go into its own file.
`reasonix doctor` warned on every install that the built-in review and
security-review skills allow use_capability, "which is not in the current
registry". Doctor checked allowed-tools against a hard-coded name list and
passed no tools; assembly always registers the proxy. It now checks against
the compile-time built-ins and the proxy, read from their owners.
1.x failed a request to an unreachable model service in about 0.3s. Studio
counted every transport error except cancellation as transient, so a refused
connect walked the whole MaxRetries backoff and `reasonix run` took about
92 seconds to report it, stalling every automated check pointed at a stopped
endpoint.
A refused connection (ECONNREFUSED, or WSAECONNREFUSED on Windows), a name
that does not resolve, and a certificate that does not verify are now
permanent: no backoff changes them. They are recognised by error identity.
Resets, timeouts and retryable statuses keep their retries.
1.x's `reasonix run` exited 0 once the model finished. Studio exited 1 with
`error_during_execution` whenever its final-readiness check stayed unmet (for
example, no check ran after the last write), so every 1.x script treated a
finished run as a failure.
Following the migration's decision 3 (in line with how other agent CLIs
report this):
- An unmet final-readiness judgement is a verdict, not a failed run: subtype
success, is_error false, exit 0, with `readiness` {attempts, missing} in the
result and in events-jsonl's run_done.
- `--fail-on-unverified` turns that verdict into exit status 3, kept apart
from 1 (run error) and 2 (usage) and documented.
- `permission_denials` in the result stays the gate's own list; run_done
carries its count and `-p` names the refused calls on stderr.
- `completion` repeats the turn's completion_summary when there was one.
1.x's `run --output-format stream-json` stamped every line with sessionId,
turnId, seq and status, opened the turn with turn_status (queued) and
user_message, reported tool_started between a call's dispatch and its result,
and closed with turn_done; --events-jsonl carried the same lifecycle records
without content. Studio's synchronous controller path publishes no turn
lifecycle, so both streams lacked all four kinds and the envelope, and they
leaked host-internal kinds (workspace_lease and friends) that no 1.x consumer
knows.
The run's output sink now supplies the lifecycle for the turn it drives and
stamps the envelope; only the kinds 1.x emitted reach either stream.
tool_started comes from a new host-only Tool.Executed on ToolResult, set when
the call cleared every gate and ran, so a refused call reports none.
The stats recorder swallowed RecordTurnCompletion instead of passing it to the
sink it wraps, so the run sink never learned a turn had finished: a failed run
reported num_turns 0. It now forwards the signal once (a TurnDone event still
records without a second completion).
Contract tests compare a real run against v1.39.5 output kept under
testdata/v1-run: lifecycle order, envelope keys, kind vocabulary.
* fix(goal): align Studio schema with report validation
Problem: schema-valid goal reports can fail execution for missing reasons or
blank verification commands.
Root cause: status-dependent requirements exist only in prose and execution
checks, not in the provider-visible JSON Schema.
Fix: encode conditional reason requirements and nonblank verification entries,
matching the executor's Unicode whitespace handling without relaxing Goal
authority or delivery validation. Update bilingual guidance and schema fixtures.
Verification: schema/executor agreement regressions and golden guards pass,
along with go vet ./..., make lint, and make check. The static schema changes
once on upgrade; system prompt bytes and within-version stability are preserved.
* fix(goal): keep report schema typed and within prefix budgets
The conditional status schemas omitted explicit types, which failed the
built-in provider compatibility gate. The added constraints also exceeded
both schema token budgets by 78 tokens.
Declare string enum and object branch types and trim descriptions whose
semantics are already explained by the tool. Keep every argument constraint
and the original budget ceilings, and refresh the serialized golden files.
Verified update-goal schema/execution tests, enum/type and schema-budget
guards, provider golden guards, go vet ./..., make lint, and make check.
* test(goal): keep whitespace validation coverage without schema changes
Problem: the schema hardening introduced provider compatibility risk through
a top-level anyOf and a new pattern constraint, and reduced model guidance
to fit the prefix budget.
Root cause: matching a general-purpose JSON Schema validator to execution
does not establish acceptance by model providers.
Fix: restore the original schema, descriptions, documentation, and golden
fixtures. Retain focused executor tests for blank reasons and verification
entries, optional completion fields, field diagnostics, and no report on
rejection. Existing error messages already identify the invalid fields.
Verification: update-goal tests, go vet ./..., make lint, and make check pass.
The owning suites retain the baseline ripgrep failure addressed by #11244.
The Regenerate and More menus on a finished reply were absolutely
positioned above the trigger inside the card. The card paints under
content-visibility containment and sits in the transcript scroller, so a
row near the scroller's top lost the upper part of the menu, and a short
reply lost it even mid-screen.
Both menus now go through one ReplyMenu: the list is portaled to the body,
placed by measurement, opens above the trigger when it fits and below it
otherwise, and follows the trigger on scroll and resize. The row keeps a
focus stop where the list used to sit, so Tab order through the menu is
unchanged; Escape now also returns focus to the trigger.
The scroll/resize follow effect that Picker and RewindControl each
carried is now one useFollow hook in place.ts, beside the shared beside()
flip arithmetic, which lowers the unnamed-input ceiling by one.
Closes#11250
/help was not a command, so it went to the model. /compact drew one line,
"context compacted", even for a fold that wrote nothing, and /context
dropped the breakdown the kernel attached to its summary.
/help is now answered on screen in 1.x's layout (commands, then built-in,
custom, skills and MCP prompts, eight rows a dynamic group), built from the
completion catalogue the session answers, the TUI's own commands included.
A finished fold draws 1.x's card: messages folded and trigger, the digest,
and the estimated tokens before and after (i18n CompactionEstimatedTokens,
the 1.x key); a fold with no digest draws none, and a running one says it is
working. The kernel names /context's notice with a context_report code, and
the TUI shows its detail under it.
Problem: A hidden directory could make grep search HOME and attribute its
matches to the requested external directory under Linux bubblewrap.
Root cause: Searching dot relied on the wrapper preserving the subprocess
working directory, but bubblewrap can fall back when that directory is masked.
Fix: Resolve directory roots to absolute physical paths and use the same path
as both cwd and the ripgrep argument. Restore requested output prefixes and
external-root error displays while preserving wrapped error identity.
Verification: Real Debian bubblewrap reproduced the prior failure for both
tmpfs and session-temp mounts; both cases pass with the fix. Grep regressions,
builtin and boot package tests, go vet, make lint, and make check pass.
The prologue was one chained assignment,
`$OutputEncoding=[Console]::OutputEncoding=[System.Text.Encoding]::UTF8`.
When the Console assignment throws (no console attached, or
ConstrainedLanguage refusing .NET property writes) neither encoding was
set and every command printed a 7-8 line error first. Each assignment is
now its own try/catch and .NET properties are only touched in
FullLanguage. Both encodings are BOM-less UTF8Encoding instances, so text
piped to native programs no longer starts with EF BB BF.
On Windows PowerShell 5.1 only, the shell tool also sets
$PSDefaultParameterValues['Out-File:Encoding']='utf8', so '>' and Out-File
write UTF-8 instead of UTF-16LE. '*:Encoding' is deliberately not set: it
would make Get-Content misread ANSI (GBK) files. Hooks keep only the output
part of the prologue, since they run the user's own scripts.
PowerShell discovery adds the Store install's execution alias
(%LOCALAPPDATA%\Microsoft\WindowsApps\pwsh.exe). An alias is a zero-byte
reparse point that stats fine but may fail to start the packaged app, so an
alias candidate (from the list or from PATH) must launch once before it is
selected; regular executables are taken as found.
A Chinese terminal still read English in the rows the TUI or the kernel wrote
themselves: "remembered → …" after a # note (1.x says 已记住), the session
picker's Search / No matches / Type to filter, a declined approval, a
sub-agent's call count, and the progress-watch notices. The completion menu
showed its key hint only past eight rows, and in English; 1.x always shows
it, from CompHintSlash / CompHintFile.
These now read from i18n, reusing 1.x's keys where 1.x had them. Text 1.x
itself prints in English (N lines, (active), N turns) stays English. The
language detection moves from i18n.go to detect.go; i18n.go was at the
800-line ceiling and the new keys need the room.
The memory-off arm hid the memory tool but still seeded the store, and the
state root was a sibling of the task workdir under the temp root, so agents
in the off arm found and read the seeded facts with shell commands.
- memory-off no longer seeds memory: the treatment is that no memory exists
- state roots live under the user cache dir with a random name, and a root
inside the workdir's parent is refused
- -trajectories is made absolute before the child, whose cwd is the task
workdir, receives it
A bare /rewind went to the kernel, which rewound the conversation one turn at
once, and /clear deleted the transcript with no question and left it on
screen. Both are destructive; 1.x asks first. Esc on an idle composer did
nothing, where 1.x clears what is typed and a second Esc opens the rewind
picker.
The TUI now answers /rewind with 1.x's picker (turn, then code+conversation,
conversation, code, or a fold before/after the turn; a partly covered file
restore asks again), prefills the turn's prompt and redraws the conversation
after a conversation rewind. /clear opens 1.x's Clear/Cancel question, the
cursor on Cancel, and clears at once in YOLO; the screen restarts under the
banner. Esc clears the composer, and twice within 600ms on an empty one opens
the picker. The kernel's /new and /clear notices now come from i18n.
Every todo_write and complete_step call drew a row ("● todo_write ⎿ 1
lines", "● Step"), though the task list above the composer already shows
what they changed; 1.x draws neither. A shell row previewed the result the
model reads, and the host appends its obligation notes to that result, so
"host obligations changed: - settled: …" appeared as if the command had
printed it.
A settled todo_write or complete_step that succeeded is now kept off the
screen, as 1.x keeps todo_write; a failed one still shows. A shell row
previews what the command streamed while it ran and falls back to the result
only when nothing streamed (a replayed session).
Found in an adversarial review of the new default posture:
- shellsafe: arguments that make a read-only command run another program or
write are refused in every spelling the program accepts (clustered short
flags, abbreviated long options): git grep -O, rg --pre, sort
--compress-program, go -toolexec/-exec/-vettool, file -C, uniq's output
operand, date -s, hostname NAME, git reflog expire/delete, npm audit fix,
kubectl --kubeconfig, gofmt -cpuprofile. less, man and cargo check/doc
leave the read-only tables.
- The headless gate and the posture decision live in the files REASONIX.md
declares sensitive again (approval_bridge.go, approval_orchestration.go);
the MCP fast-path refusal is decided in package permission.
- A sub-agent under an attended Auto no longer gets dynamic shell its parent
would have to ask about.
- Read-only keeps fresh human decisions human; a refusal no rule produced
names the posture instead of a deny list.
- The trust prompt and docs state what the sandbox actually bounds (temp,
toolchain caches, network) and that trust covers reasonix run; a home
directory or filesystem root is never trusted wholesale; the run result
names the posture it settled on.
- The desktop names each controller session in ready; a controller that
uses the name numbers its commands upward, and the desktop refuses a
command naming another session or an old number, so a relay cannot
replay a recorded command into a new session or twice into one.
- ready carries a per-process instance id. A state-changing request
already sent is resent only to that same instance; a restarted desktop
has no cached answer, so the request fails explicitly instead.
- The replay cache outlives controller sessions (the grace expiry no
longer clears it) and is reset only on device identity or account
change; its key binds method, path and body as well as the id.
- The phone seals and sends commands in one queue so their numbers
arrive in order; socket listeners are registered by the connection
itself; errors reach the banner through reason().
A terminal session with no named mode opens in auto only where the OS
sandbox demonstrably confines shell writes (sandbox.IntegrityEnforced) and
the person trusted the folder; everywhere else it asks, and a headless run
refuses writes and lists them as permission_denials in its result.
read-only is a real posture again: every call that is not a read is refused,
allow rules included, and an authorized MCP server's writers too. Gate
refusals carry a code (permission.unattended, read_only, deny_rule,
declined) that reaches the tool result and the run result.
YOLO keeps skipping prompts only; its first interactive use is confirmed
once and recorded under the Reasonix home. Shift+Tab follows 1.x's order,
Ctrl+Y returns to the posture it left, and a terminal's switch no longer
becomes the desktop's default. git -C/--no-pager classify as the
subcommand they wrap.
The kernel's slash menu drops the row that would replace the line with
itself, so a finished /tree left only fuzzy neighbours in the menu and Enter
accepted the first of them: /tree ran as /security-review. A finished /hooks
or /mcp stopped at their argument menu and a second Enter put its first
argument in the composer.
Complete now names the dropped row as Typed, which Studio ignores. The TUI
lists it first, and Enter sends the line when it already reads what the
highlighted row would make it: the command's label, or the argument in place.
That is the rule 1.x's composer follows; a half-typed name still completes.
Problem: Studio's ripgrep engine misses slash-glob matches under search
roots with symlinked ancestors, including macOS temporary directories.
Root cause: the absolute search argument keeps the symlink spelling while
ripgrep anchors globs against its physical process directory.
Fix: search dot from the requested subprocess directory and restore the
requested output prefix before external-root token projection. Both search
passes share the behavior; single-file targets and sandbox guards remain.
Verification: existing and new slash-glob regressions fail before the fix
and pass after it. Owning builtin/boot suites, go vet ./..., make lint, and
make check pass. The new test covers both passes and output path privacy.
The phone page reconnects silently when the relay closes for idleness, a
legacy admission expiry or a dropped socket, and resends in-flight requests
under the same id. A read is always safe to resend; a state change is
resent only to a desktop that advertises replay, and failed otherwise, so
nothing runs twice. Relay close codes decide the next step: 4401 asks the
user to sign in again (sign out, then the existing sign-in page), 4403 and
4004 stop for good.
The desktop keeps controller sessions across its own relay reconnects,
prunes them against the relay's relay_hello list, sends the relay's
heartbeat frame once the relay names it, and caches answers to
state-changing desktop requests for ten minutes so a resend is answered
from the cache instead of running again.
Refs #11226
The terminal typed /status, /help, /quit and the other 1.x commands studio
has not ported yet, and the kernel sent each line to the model as prose. That
spent a request, and for /status it ran git and asked for an approval.
A submission can now ask the controller to refuse a slash command no registry
resolves: it gets an unknown-command notice (i18n SlashUnknown, the wording
1.x uses) with the unknown_command code and starts no turn. Paths, code
comments and custom commands resolve exactly as before. The TUI always asks;
Studio does not, so its behaviour is unchanged.
A 1.x command line that reached one of these exited 2 on studio:
- `reasonix chat` / `reasonix code` were unknown commands. They are the
interactive session in 1.x, so they now route to the terminal UI.
- `reasonix --preset X -p task` was an unknown command because --preset was
not a leading session flag. It is again, so it becomes a print-mode run.
- `run --takeover` was an unknown flag. It is accepted; with no contention the
run proceeds as in 1.x. Taking a session away from another process has no
counterpart here, so a held session is still refused, and the refusal now
says --takeover cannot do it and points at --copy.
- `sessions reindex|diagnose|cleanup` fell through to the machine `session`
command. Sessions are listed straight from their directories here, so
reindex has no catalog to rebuild and reports the count it reads; diagnose
and cleanup report and trash covered conflict-recovery branches through the
sessionstore guards Desktop already uses, keeping 1.x's JSON key names for
what is measured and its dry-run-until---apply contract.
A provider entry gains display_name, the key 1.x already writes, so a
config shared with 1.x keeps it on every save. Name stays the identity:
refs, default_model, saved sessions and preset upgrades still point at it.
POST /providers/display-name relabels every entry shown as one account,
all or none, and refuses an over-long label or a control character with
its own code. The provider list, the model list and /status carry the
label; the settings list renames in place (pencil or F2, empty restores
the derived name), and the model picker, wallet header and ACP model
descriptions show it.
Closes#11237
resolveSetupTargets takes every unrecognized argument as the config path, so
`reasonix setup --help` wrote a file named --help and reported "Wrote --help".
1.x prints the setup usage for -h/--help and exits 0, and refuses any other
dashed argument with usage on stderr and exit 2. The ACP registry advertises
`reasonix setup` as the login method, so its help has to answer.
Port that guard, in its own file, ahead of target resolution.
The in-app find already searched the rows rather than the document, so
it sees messages the transcript has not mounted. What stood between a
person and it:
- The chord matched e.key exactly. Caps Lock sends "F", an input method
answers "Process", a Cyrillic layout sends "а" - none of them opened
anything. The window now reads the letter case-insensitively and falls
back to the key's position when the layout reports no Latin letter.
It takes Cmd on macOS and Ctrl elsewhere, so Ctrl+F in a macOS text
field keeps its Emacs meaning, and AltGr is not read as the modifier.
- Nothing on screen offered it. The title bar gets a find button (the
only way in on a phone) and the palette gets the command, both showing
the chord.
- It took the chord from every text field. A field hands the window's
chords through only when it says so (data-window-keys): the composer
and the find box do, a settings filter or the browser's address bar
does not. An editor that answered the press itself (CodeMirror's own
find) still spends it.
Stepping also moves within a row now. Twenty matches in one tool output
counted as twenty but painted and landed as one; the current occurrence
is the nth drawn in its row, and landing scrolls it - through the
output's own clip if it scrolls - to where it is read instead of leaving
the row's top under the bar. A newer landing cancels one still settling,
which typing a query used to race. Arrow keys step like Enter.
The current match was accent at 45%, which in the Studio theme is a
light grey behind light text in dark mode; it is the accent/accent-fg
pair now, neutral in both themes.
The window's key listener moved out of App.tsx into windowkeys.ts to
keep App under the line ceiling.
A workspace path concatenated into the sidecar is not valid JSON on
Windows, where its backslashes read as escapes; the meta then fails to
parse, the session is never routed to the blocked directory, and the copy
the test expects to fail succeeds.
A shell command whose command line exceeds CreateProcessW's 32,767 UTF-16
unit ceiling never starts; the model was told "fork/exec powershell.exe:
The filename or extension is too long." and read that as a file-size
problem. On Windows the PowerShell tool passes the whole script as one
-Command argument, so writing a large block of text (e.g. a Chinese
document in a here-string) hits this every time.
The host now counts the command line exactly as os/exec builds it and,
when it will not fit, refuses the call before launch with a typed error
(errCommandLineTooLong) that states the size, the limit, and that nothing
ran, and points at write_file/edit_file. The execution is recorded as
not run / not started. The not-run bookkeeping moves into one helper so
ExecuteDetailed stays within its size budget.
Refs #11229
Opening a session 1.x wrote deleted its <id>.context.json. 1.x writes
context schema 4 from 1.36.0; LoadCompactionState accepted only 1-3, and
loadProjectionSidecar removed the file on any load error. The model-written
compaction summary was lost for good, 1.x itself resent the full history on
its next turn, and 2.x sent the full history too.
A load error now drops the projection in memory only. Unknown schemas carry
ErrContextSchemaUnsupported. Schema 4 is schema 3 plus
projection.pinned_context_hash, so it is read when that hash is empty; a
pinned-context checkpoint is authenticated against 1.x provenance this build
does not model and stays unsupported. A load never rewrites another release's
file (lineage keys are normalised in memory), and dropping the projection of
an open 1.x event log leaves the file, since this build never changes that
log. When a 1.x conversation moves to a 2.x session, the projection is
inherited there in schema 3 if it still covers the transcript, so the first
2.x turn sends 1.x's summary instead of the folded history.
The effect test replays a schema 2 session captured from a real 1.38.7 build.
Problem: Clicking the Dock icon leaves a Studio window hidden after closing to tray.
Root cause: macOS activates the existing process without emitting second-instance, and the shell had no activate listener.
Fix: Route activation through the shared window reveal path and ignore reveal requests during shutdown. Extend native smoke coverage across activation, second-instance, and tray entry points.
Verification: macOS native smoke, Electron unit tests, frontend build, host build, go vet, and repository lint passed.
A phone reaching Studio through the account relay has no EventSource; the
page swaps in RemoteEventSource, which polls /events/replay over the
encrypted channel. It fell short of the stream it stands in for in three
ways:
- It found /replay by rewriting a URL that ends in /events. Since the
silence watchdog (#11216) a replacement stream carries ?lastEventId=, the
rewrite missed, and every poll asked for the live /events route, which the
desktop refuses over the relay. An idle pane went silent for 45s and then
stopped receiving events for good.
- It learned its starting position by asking for lastEventId=0, so each
attach downloaded the whole replay log (up to 8MB for a long running
session) through the relay and threw it away. Asking past the watermark
returns no frames and the watermark alone.
- It never said the frames SSE writes on its own, so a quiet stream looked
dead to the watchdog and a truncated log looked complete. A quiet poll now
restates the watermark, and complete=false becomes a stream_gap.
Separately, a reload always focused the first open pane, because which pane
the window showed lived only in React state. The relay's "reconnect" button
reloads the page, so the phone landed on the top project's first session
instead of the one it was on. The tab now keeps that id in sessionStorage
and takes it back when the pane is still open.
importJsonlSessions reported only artifact failures through hadArtifactFailure,
so a session whose own copy failed was skipped silently and the one-time import
marker still went down. The next launch then saw the marker and never retried,
leaving that session unimported for good.
Both copy paths now report the failure, so the marker stays off and the next
launch retries, matching what a failed artifact copy already did.
await_user's `need` is shown to the user as a one-line host notice. With
nothing bounding it, a model put the whole question there, numbered options
included, so the user got a wall of text to answer by typing instead of an
ask card they could click. The description now routes a pick among named
choices to ask, and the tool refuses a need longer than 200 characters with
an error that says to put the substance in the reply or call ask. Length is
a property of the argument, not a reading of its wording.
Closes#11220
The hand-back notice printed the model's `need` as one plain paragraph, so
its bold, lists and line breaks reached the user as literal markup. The
kernel now tags the notice with the await_user code and carries the need
verbatim as its detail; the text form stays for the TUI and CLI. Studio
titles the card from the code and renders the detail through the same
sanitized Markdown renderer replies use.
Closes#11219
Workspace configuration only takes effect once the workspace is approved,
so the perseveration boot effect tests reached the real provider instead
of the registered stub.
The perseveration guard fixtures are byte-exact recordings; checking them
out with CRLF on Windows shifts every offset the test asserts.
A phone paired over the LAN that sleeps, or whose Wi-Fi drops the link,
can leave its EventSource looking open on a socket nothing arrives on.
EventSource only reconnects on an error it is told about, so the pane
kept showing a live connection while no event reached it, and on plain
HTTP/1.1 each such dead stream also keeps holding one of the browser's
six connections to the host, starving the requests a session switch
makes.
The kernel already restates its position on every transport each 15s
(stream_watermark). The client now treats three silent intervals as a
dead stream: it closes it and opens a new one that resumes from the last
frame it folded (lastEventId), so nothing numbered is lost. Timers stop
while a phone sleeps, so becoming visible and coming back online check at
once instead of waiting for the next tick.
A workspace's reasonix.toml and .reasonix/settings.json are read as
untrusted input.
- [sandbox]: bash may only move to enforce and network only to false;
forbid_read and denied_domains add to the user's; allow_write entries
and workspace_root apply only when they resolve inside the workspace.
${VAR} in sandbox and proxy paths expands from the process environment
only.
- [permissions] mode, allow and allow_dynamic_bash, [network] proxy
settings and [desktop] default_tool_approval_mode are read from the
user config only; deny and ask add to the user's. An "always allow"
given in a workspace is stored under the Reasonix home
(project-grants.json) rather than in the checkout.
- Programs a workspace declares (hooks, language servers, providers,
tools.search.rg_path, tools.shell.path, [browser], tools.system_one
endpoints and the local Laya runtime) run only once approved for that
folder. An approval records the declaration and a digest of the files
it names, is kept under the Reasonix home, and is checked again before
each start; a change refuses the start with ErrProjectProgramChanged.
`reasonix trust` lists and approves them, and saving hooks from the
hooks page approves the block written. Model settings that named only
a held-back provider fall back to the user's choice.
- Single program paths may not point into the workspace, a temporary
directory, an allow_write root or a toolchain cache.
- Sandbox write roots and host write directories keep the identity they
had when first granted; a root whose identity changed is dropped with
sandbox.write_root_redirected or sandbox.write_root_changed. The
host-writable directory list lives in internal/base/hostwrite.
- Every ignored value is reported as a load warning with a typed reason
(Config.IgnoredProjectSettings); held-back programs raise the
project_programs_awaiting_approval notice.
The workspace explorer leaves every dot entry out, so folders such as
.reasonix, .github or a .gitignore could not be browsed from Studio at
all. The explorer head now has a toggle that asks the kernel for them.
GET /workspace/files takes hidden=1 to include dot entries in both the
folder listing and the search. VCS stores (fileutil.IsVCSStoreDir) and
dependency trees stay out either way. The default is unchanged: dot
entries hold tool state and local configuration, so they appear only for
a reader who asked, and the choice is remembered per machine.
The explorer's head moves into its own component so WorkbenchPanel
stays under the file-size ceiling.
Closing the last tab folded the docked workbench even when the file
explorer was open beside it, so dismissing a browser tab took the file
list away with it. An open explorer is now a reason to keep the column,
the same as any tab still open; the column still folds with its last tab
when the explorer is closed.
The speed meter already opens with a sparkline of recent throughput, so
the gauge glyph before it said the same thing twice and cost width in a
rail that is tight next to the composer. The cache and context meters
carry no leading icon either; the speed meter now reads the same way.
Under 760px the workbench collapses to one column and the stylesheet hid
the explorer unconditionally, so on a phone paired over the LAN (or any
window that narrow) the files button toggled to pressed over an empty
body and the workspace tree could not be reached at all.
At that width the explorer and the canvas now take turns in the single
column through the existing data-files toggle, the same way a docked
workbench already does. Picking a file still puts the list away and
shows the file.
The guard detects a degenerate generation loop — a model echoing one short block
of text or reasoning byte-for-byte — by default, and reports it through the
progress-watch channel as a new `perseveration` cause. Nothing is cut and nothing
reaches the model unless the caller opts in: a byte-identical block is sometimes
legitimate output (printing a value 300 times, a run of identical table or log
rows, a page of `=` or `A`), so cutting it by default was the wrong trade. The
notice is said once per loop episode — a scan that trips again while the previous
scan also tripped stays quiet, and the next scan that does not trip re-arms it.
The user's `progress_watch.pause` setting is what ends a run on a detected loop.
Cutting the stream and nudging an unattended retry is opt-in with
`perseveration_retries`, under [progress_watch] or per provider on a [[providers]]
entry (the provider value overrides the global default). Unset or 0 reports only;
a positive value also cuts and nudges up to that many retries; a negative value
disables the guard entirely.
The cut path records best-effort usage, lets extensions rule on the terminal
before it is persisted, and never executes the aborted stream's tool calls. It
collapses the loop to the phrase and its last repetition in what is shown and
stored alike, so the transcript follows the trim instead of silently diverging
from the stored turn — no history rewrite is needed. It then shows the user a
`[retrying (N) avoiding perseveration]` interjection, appends a host-authored
nudge through the mid-turn steer path, and retries. Once the budget is spent the
run stops with a typed perseveration pause and emits the `perseveration_loop`
notice, so a parent cannot mistake the loop for a clean result. The retry budget
lives on the run, so the next user message starts fresh.
Adds a boot-level effect test asserting what reaches the provider request and the
frontend sink, and updates the guide.
The version panel's install ran download, install and restart as one act:
once the signature checked, the application ended with no prompt. It also
wrote the pin before downloading anything, for every target, so an update
that failed (or a Windows chunked swap that rolled back after restart, the
2.20.x case behind #11115) left "pinned to 2.21.0" on a 2.20.0 install,
with its only way out disabled while any other move was in flight.
- StartInstall now stops at a verified, staged release (phase "ready").
POST /update/restart commits it; it is refused with
update.restart_busy while a local turn or background job is running,
unless the request says the person saw that (force).
- The pin is written when the install is committed, only for a rollback;
a move forward releases any pin. A failed or dismissed install puts the
previous pin back. A pin naming a build other than the running one is
released at launch.
- A failed move carries a dotted code from the step that failed
(catalog, download, signature, disk, no package, installer). A forward
move records itself; the next launch, still on the old build, reports
update.not_applied with the swap helper's reason, which the helper now
writes instead of printing to a stderr nobody reads.
- The panel explains each code, links the full installer where installing
once by hand is the way out, and drops wording that promised automatic
updates Studio does not perform.
Add an opt-in vi command mode to the composer prompt ([ui].commandmode =
"vi"). At the prompt Esc enters command mode for navigation and editing
rather than interrupting a turn; command mode owns the keys h l j k 0 $ ^
i a x I A p D and the mode switch.
The composer lives in internal/frontend/tui, so the mode is implemented
there against its textarea: vimode.go carries the command-mode keys and
the mode switch, input.go routes keys through it, and ask.go and
prompts.go keep Esc from dismissing an open question card or deciding an
approval card. Command mode consumes any key carrying printable text, so
a CJK/IME character is eaten rather than inserted.
Because the interrupt key now depends on the composer mode, the
running-turn hint can no longer name a fixed key: with ui.commandmode off
Esc stops a running turn, while in vi mode only ^C interrupts, since Esc
is a mode switch whether or not a turn runs. The thinking
status line therefore names the key that actually interrupts — "(Esc
cancels)" or "(Ctrl+C cancels)" — across en/zh/zh-TW, and the footer names
the composer's input mode, NORMAL in command mode and INSERT otherwise.
The cancelling line drops its "Ctrl+C exits" hint in vi mode, where Ctrl+C
re-cancels instead of exiting, and the approval, ask and plan card hints —
plus the plan choice list — drop their Esc mention there, where Esc is
ignored.
At the prompt, ^C with a non-empty prompt clears it and leaves shell mode,
in vi mode and out. In vi mode it first saves the trimmed draft to the
cmdline history when there is one, as send() does, so an accidental
interrupt never loses it (Up recalls it); a whitespace-only prompt is
cleared without being saved. In vi mode Esc no longer decides an approval
or ask card, where it is pressed out of habit; a row key or Ctrl+C decides
instead, and Ctrl+C still cancels a running turn even while an ask answer
is being typed.
[ui].commandmode is user-global only: a project reasonix.toml cannot set
it, so a cloned repo never rebinds the user's keys.
The fresh-start fallback was inferred from `--continue` being set, so a
bare `-r` picker run with `--continue` also skipped --copy even though the
picker resumes its choice in place and has nothing to duplicate. Carry an
explicit `startedFresh` out of session resolution instead, so only a
`--continue` that found no session skips --copy; the picker and `--copy`
alone stay usage errors.
`--continue --copy` with no saved session failed with "--copy requires
--resume or --continue", even though --continue had been passed. --continue
already falls back to a fresh session when it finds nothing, so there is
nothing to duplicate; --copy is now skipped and the run proceeds.
`--copy` with neither --resume nor --continue is still a usage error. Fixed on
both the run path (cli.go) and the TUI (tui_command.go).
The run path's copy resolution moves into applyRunCopy, which keeps runAgent
within its complexity ratchet.
OpenAI documents that GPT-6 Sol and Luna take function calls on Chat
Completions only at reasoning_effort=none, and that GPT-6 Astra's tool
calling requires Responses. The curated OpenAI preset nevertheless shipped
kind "openai" (Chat Completions) with default gpt-6-sol, effort medium and a
ladder without none, so every default turn was Chat Completions + tools +
effort medium: the one combination the model table (gpt6Capability,
Responses-only) already says cannot call tools.
- The preset's entry moves to kind "responses". Its effort list and default
are unchanged; both are inside every GPT-6 model's Responses ladder.
- shippedPresets gains the Chat Completions shape as a generation, with a
Kind field on shippedPreset: an entry still identified by preset_id
"openai", our base URL, the shipped catalog, window 1,050,000 and default
gpt-6-sol is moved onto the Responses wire. Anything its user changed in
that shape is left alone, and a second pass changes nothing.
- A consistency test walks every curated preset: a model whose table row
names its wires must be served on one of them, and declared efforts and
default must sit inside that model's ladder. The old preset fails it for
all three GPT-6 models.
- Effect tests through boot.Build hold a fresh install and an install of the
old shape to a Responses body carrying tools and reasoning.effort=medium.
Docs: https://developers.openai.com/api/docs/guides/latest-model,
https://developers.openai.com/api/docs/models/gpt-6-sol,
https://developers.openai.com/api/docs/models/gpt-6-luna,
https://developers.openai.com/api/docs/guides/reasoningCloses#11199
The agent's browser panel put its page away and showed "the page is hidden
while something covers it" when nothing a person could see was over it, and
sometimes stayed that way after the cover left.
Why it misfired:
- The check took the topmost element at nine points as the answer. A layer at
opacity 0, or a transparent full-window layer that only catches clicks, is
the topmost element and paints nothing, yet it hid the whole page.
- A cover that leaves by a CSS transition, an animation or a hover changes no
attribute the panel watched, so the page stayed away until something
unrelated moved. The observer also only listened to five attribute names.
- A popover reaching into one corner hid the whole page and replaced it with
a sentence.
What changes:
- ui/occlusion.ts decides from hit testing plus computed style and geometry:
an element counts only if it paints at the probe point (effective opacity,
visibility, background, backdrop filter, a border band, its own text rects,
or a replaced element). The slot's own content, its ancestors, and layers
that paint nothing are skipped. The rectangle sent to the shell is the part
of the slot the window shows, cut to clipping ancestors. A layer reaching no
more than 8px into the edge, like a column gutter's grip, does not count.
- Recovery no longer depends on a mutation: transition and animation
end events reschedule the check, all attributes are observed, and a 400ms poll
brings the live page back whatever moved.
- A covered page is frozen instead of hidden: the shell takes a picture of the
page on screen with capturePage before putting it away, and the panel draws
that picture in the slot until the cover leaves. The sentence is gone.
The picture channel (browser:freeze) takes only the page already shown in
this window, answers only this window's own page, and the picture is drawn in
an <img> and sent nowhere else. A freeze overtaken by a show does not put the
page away. An older shell without the verb falls back to hiding the page.
Tests: browser-panel.interaction.test.tsx covers invisible, transparent and
hidden layers, the slot's own content, recovery with no DOM change, stale
pictures and view transitions. test/freeze_live.js checks the channel in a
real Electron window.
A relay that serves several vendors' models under one address and key could
only declare one supported_efforts list for all of them. Each model can now
carry its own, stored where per-model settings already live
(model_overrides.<model>.supported_efforts / default_effort) and applied by
the same model resolution every request and every level picker reads, so a
level the picker offers is the level the request carries.
Precedence: the model's own list, then the connection's supported_efforts,
then the model table for the endpoint, then the protocol's generic ladder. A
model with no declaration inherits; installed configs need no migration.
- config: ModelEffortDeclaration / SetModelEffortDeclaration (keeps every
other override field, drops an emptied override, ErrModelDefaultEffortNotListed
for a default outside the levels) and InheritedEffortCapability. ResolveModel's
three branches share one forModel step.
- EffectiveEffort: the stored level is one per connection, so after a model
switch it can fall outside the next model's levels. That model now runs at
its own default, the level its picker's "auto" names, instead of omitting
the field while the picker says auto means something else.
- An override that only sets max_output_tokens is no longer dropped as empty
on load.
- serve: /providers lists each chat model's own, inherited and protocol
declarations; /providers/edit takes modelEfforts as the whole answer for the
listed models, refusing with provider.model_default_effort_not_listed and
provider.model_effort_unlisted.
- Studio: the "Thinking and reasoning levels" fold gains "Levels per model":
inherit (showing what that means) or pick the model's own levels and default.
The effect test builds a mixed relay through boot.Build and checks the
request body for every offered level of both models, and that a level a
model does not take never reaches the wire.
Closes#11192
The check that refuses a click as browser.covered answered a different
question from the one it was asked, in four ways:
- DOM.getNodeForLocation takes document coordinates, and it was given
viewport ones. On a page scrolled by less than the target's distance
from the top of the viewport it hit-tested a point that far above the
target and reported whatever sat there (a banner, a nav bar) as
covering it; scrolled further, the lookup found nothing and the check
passed, so a click under a fixed header or a veil went through to the
wrong element.
- ignorePointerEventsNone: true makes the hit test count
pointer-events:none elements as hits, the opposite of what a pointer
does, so decorative overlays were reported as covering.
- Newer Chromium (Edge 154) resolves a hit on a ::before/::after to a
CSSPseudoElement, which has no parentNode, so a button with a ripple
layer was refused as covered by its own pseudo-element.
- A form control drawn by its label (a zero-size or visually hidden
checkbox, a radio painted over by a span in its label) was refused as
not_visible or covered, although a person clicks the label.
The hit point is now converted to document coordinates, pointer-events:none
is left to the browser, a pseudo-element hit counts as its element, a hit
inside one of the target's labels counts unless it passes through other
interactive content (a link in the label follows the link), and before
refusing, the element is scrolled to the middle of the viewport, which
clears fixed headers and footers. A real cover is still refused, now
naming what is on top by ref. The label list comes from the page, so it is
capped and checked to be labels on the host side.
Measured with a table of pages at 1x and 1.5x device scale on Chromium 151
and Edge 154: before, 6 false refusals (7 on Edge), one click silently
landing on a fixed header and one passing through a veil; after, none,
and the true covers are still refused.
Every curated preset so far points at a Chinese coding plan or a
multi-model relay, so a user arriving with an OpenRouter, OpenAI or
Gemini key has to write the provider by hand.
- openrouter: DeepSeek, GPT-6, Gemini, Kimi, GLM, Qwen and MiniMax ids
checked against /api/v1/models; credits balance via the existing
OpenRouter decoder; HTTP-Referer / X-OpenRouter-Title /
X-OpenRouter-Categories so the traffic is attributed to Reasonix in
OpenRouter's app rankings. Claude ids are left out: on the openai
dialect no cache_control is sent, so every prompt token would bill at
the full input rate (claude-dialect).
- openai: GPT-6 Sol/Astra/Luna on Chat Completions, which already sends
max_completion_tokens to api.openai.com; declares the documented
low..max effort ladder.
- gemini: the Developer API's OpenAI-compatible endpoint.
- volcengine-coding-plan: the Coding Plan endpoint with ark-code-latest,
which follows the model chosen in the Ark console.
The presets live in their own file; provider_presets.go only appends
them.
A model can now declare optional run modes beside its effort ladder, in the
same model capability table. Each declaration names its id, the frontend's
label/hint keys, how it maps onto the request, the wires (kinds) and the
vendor endpoint it was established on, and whether it costs noticeably more.
GPT-5.6 (gpt-5.6 alias, sol/terra/luna) and GPT-6 (sol/luna/astra) declare
"pro", sent as Responses reasoning.mode "pro" beside reasoning.effort, on the
Responses API at api.openai.com only (developers.openai.com/api/docs/guides/
reasoning: mode and effort are independent; pro does more model work and is
billed at the model's rates for more tokens).
The mode is session state, not config and not prompt text:
- control.Controller lists the modes the session's model declares and sets
one; an undeclared mode is refused with ErrModelModeUnsupported.
- The agent carries the chosen id on every main-loop provider.Request; a new
conversation starts with it off. Subagents, compaction and side models
never carry it.
- The Responses adapter sends reasoning.mode only for a mode its endpoint
declared (projected by boot into the provider config), so a relay, Chat
Completions or a model without the declaration never sees the field.
- A rebuild carries the mode onto a model that declares it and drops it
otherwise, so a model switch turns Pro off.
- serve: POST /model-mode, refused as model_mode.unsupported; /status lists
modes only for a model that declares any.
Studio shows a switch at the bottom of the effort menu only when the model
declares a mode, marked as costing more; the trigger reads "... · Pro mode"
while it is on. The row stays pinned to the bottom of a scrolling menu.
Documents how Reasonix discovers and runs Agent Skills: the project,
custom, global and built-in roots, run_skill and slash invocation,
references/ and scripts/ handling, the extra frontmatter keys, and the
/skills and [skills] controls. agentskills.io asks listed clients to link
a page describing their implementation; this is that page.
Persist always-allow rules in private per-workspace user state and load them into the effective policy. Default skill installs to user scope unless project scope is requested, so neither action creates reasonix.toml in the workspace.
The model table named GPT-5.6's none..max ladder, but the provider was only
ever told a user-declared supported_efforts list, so on api.openai.com the
request builder refused "none" and "xhigh" at build time and clamped "max" to
"high". RequestEffortLevels now projects the resolved ladder (declared list
first, then the model table for the endpoint in hand) into the provider
config, so every rung the composer offers reaches the wire as itself.
Ladders, each from the vendor's own documentation:
- gpt-5.6 (alias of gpt-5.6-sol), sol/terra/luna: none|low|medium|high|xhigh|max,
default medium, on Chat Completions and Responses.
- gpt-6-sol / gpt-6-luna: none..max, default medium; gpt-6-astra: low..max
(none answers 400). Responses only: on Chat Completions GPT-6 takes
function calls only at reasoning_effort=none, and every turn carries tools.
- Model Studio Qwen3.8 (qwen3.8-max, -max-0902, -flash, -2.4t-a95b, -27b):
low|medium|xhigh plus none (enable_thinking=false), default xhigh; high and
max fold to xhigh, minimal to low. Vendor hosts: dashscope(-intl).aliyuncs.com
and <workspace>.<region>.maas.aliyuncs.com.
A ladder's vendor is now a host set with suffixes (vendorEndpoint), and a
ladder names the provider kinds it was declared for. The model table moves to
effort_models.go. The composer names none ("No reasoning") and tells xhigh
("Extra deep") apart from max, which shared one label.
reasoning.mode "pro" is not added here: it is a Responses-only dimension
independent of effort and needs its own control.
approval.go went 10 lines over repolint's 800-line ceiling with the MCP
origin handling. The ask-notification text builder now sits beside its
existing test file; no behaviour change.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The rewind menu's three scope labels and the bash coverage-gap reason are
Chinese literals held in a table and rendered as written:
<span className="lb">{s.label}</span>
Neither static guard could see them. The catalogue test only collects
Chinese inside a t() call, and the JSX test only reads text between tags or
in a rendered attribute. A table holding Chinese is correct exactly when its
render site calls t(), so the render site was the thing that was wrong. The
browser sweep that is meant to be the judge never opens this menu either:
tools/steps.mjs walks no rewind step.
Route both render sites through t() and add the four keys to the English
catalogue. A Chinese window is unchanged - zh still falls back to the key.
Verified: pnpm typecheck; pnpm test (169 files, 1035 tests).
Extract ProjectConfigPath(root) as the single place the project config
path is computed, and route every caller through it: load, credentials,
edit, retired-key migration, MCP migration and boot. It still resolves to
<root>/reasonix.toml, so behaviour is unchanged.
MigrateV2 rewrites a fact and then the index. When the index is unreadable,
reindexIn fails after the fact has already been rewritten, and the next run
skips facts that carry an id, so the entry stays out of the index for good.
The migration now reads the index once per directory before touching any fact,
the same guard RestoreArchived uses, so a failure happens before the first
write and a retry still sees the fact as unmigrated.
Cache note: no prefix bytes move; this only decides whether a migration starts.
Add a user-global [tools.shell] env table so every command the bash tool
runs inherits extra KEY=value variables (for example
`BASH_ENV = "~/.reasonix/bashsandbox.rc"`). The value is applied over the
inherited environment but under the host-owned session/egress overrides, so
a preset value never displaces TMPDIR or an egress token.
The variables ride the sandbox spec (sandbox.Spec.ShellEnv), so foreground,
background, and host-terminal runs all inherit them alike. It is
user-global: a cloned repo's reasonix.toml cannot inject variables, because
the shell env is held across the project merge next to the sandbox grants.
Presetting a variable that names a host endpoint (SSH_AUTH_SOCK, DOCKER_HOST,
CONTAINER_HOST, XDG_RUNTIME_DIR) does not unmask it: the denied authority set
resolves from both the host environment and the effective one, so a preset
that points a client elsewhere still leaves the host's own socket masked. The
egress loopback proxy ports are unioned the same way, so a preset proxy is
closed and overriding a variable cannot reopen the host's.
The interpreter itself is still resolved by [tools.shell] prefer/path. A key
that cannot appear in an environment entry is dropped rather than written as
a malformed one, and keys are sorted so identical config yields identical
environment bytes.
The recall diagnostic reported one Omitted count for two different decisions:
the per-turn hit cap and the character budget. The note the model reads already
names both, so a reader could not tell which one dropped a fact.
RecallResult now reports OmittedByLimit and OmittedByBudget apart, and the
/memory recall diagnostic prints both. The trajectory audit keeps its combined
Omitted value, so the persisted shape is unchanged, and the model-visible note
still carries the sum of the two.
From #11146's review: "Splitting omitted into limit vs budget would be a nice
separate diagnostic."
Address the two non-blocking nits from #11148's review: state the constraint
the test pins instead of narrating the implementation, and assert the error is
the pinned-budget refusal rather than any error.
The assertion matches on identity rather than on the message:
validatePinnedBudget wraps ErrPinnedBudget, and both the recovery test and the
save path's own test assert with errors.Is. The sentinel's text is the setting
the message already names, so the user-visible message stays byte-identical.
Between roughly 470px and 720px of conversation column (a wide browser
pane is the usual way there) every toolbar control was flex: none, so the
model/effort group ran past the toolbar's box: the send or stop button sat
on the effort picker and the effort label painted outside the composer.
Below 470px the send cluster was taken out of flow with a fixed 38px
reserve, which the wider stop button does not fit in.
The row now lays out in flow at every width: the send cluster keeps its
own slot at the end of the line, the toolbar wraps inside what is left,
and the model group has a minimum basis, grows to fill the line and lets
the model name shrink to an ellipsis before it moves to a line of its
own. The spacer and the per-width offsets it needed are gone.
perf/composer.mjs sweeps 340-760px idle and running with a long model
name and fails on any control outside the composer, any two controls
overlapping, or a model name narrower than 40px; it fails on the old
stylesheet at 340px (running) and 480-720px (both states).
Fixes#11159
A run that keeps calling tools without changing anything the host can
observe (#11153: dozens of successful `echo` calls with varying arguments,
about 1.1M input tokens) had no signal short of reading the transcript.
This adds one, without bringing back any round-count guard: nothing is
sent to the model, no call is refused, and the cache-stable prefix and
the per-turn execution-policy block are untouched.
Judgement (kernel, structure only):
- evidence.EffectWatch scores each round's receipts. An effect is a
successful mutation or named write, a task step moving (StepProof,
TodoStep, or the host's todo progress counter), a verification whose
outcome changed since it last ran, a first read (a read-only tool
answering a request not seen before in this run, or a shell command
naming an existing path not named before, resolved by stat), or a
delegated result coming back. A command merely being new is not.
- agent.settleProgressRound runs at each tool-round boundary; the count
lives in turnRuntime, so a user message zeroes it. A second,
model-independent backstop compares the input tokens spent since the
last round with an effect against context window x N; an effect
restarts both counts, so a long run that keeps doing observable work
is never flagged however much it spends. Without a ledger the round
judgement stays silent rather than guess.
Feature 2 (default on): a content-free progress_watch event carries the
reading; Studio shows a one-line strip above the composer with Stop
(the ordinary cancel) and "don't show again (this session)". It clears
itself when an effect lands or the turn ends. The TUI says it once per
stall.
Feature 3 (default off): [progress_watch] pause = true ends the run at
the round boundary through a resumable pause (RunPauseInfo Kind
no_progress, TurnDone outcome no_progress). No finalization nudge is
injected. Continue sends an ordinary message, which starts a new run
with the count at zero. The section is user-level only: load restores
the user's value over a project reasonix.toml. Settings > Session edits
it through GET/POST /progress-watch, which persists to the user file
and hands the new watch to the running executor without a rebuild.
Out-of-range values refuse with progress_watch.out_of_range.
Refs #11153
The market entry gains up/down vote buttons that show the signed-in
account's vote; pressing the lit one withdraws it. Signed out, the entry
offers sign-in (a jump to the account section); a publisher, an
unverified account and a paired device each say why they cannot vote.
List rows show approval and install count, and the listing defaults to
the registry's new recommended order.
The kernel owns the calls: market.Client gains MyVote/Vote, which send
the account token only to the fixed registry host with redirects
refused, and ReportInstall. Registry refusals keep their identity
(signed_out, email_unverified, own_package, rate_limited; an identity
outage stays market.unreachable) through market.* refusal codes. Vote routes sit
behind accountAuthAllowed like every other account route.
A successful market install reports once, carrying only the slug and a
random id kept only for the market (market/install-id under the Reasonix
home, unrelated to the usage-statistics id), and only when the host allows
it (release builds), both desktop statistics switches are on, and
neither DO_NOT_TRACK, REASONIX_TELEMETRY=off nor CI opts out.
The [desktop] telemetry and metrics switch descriptions now say that
per-package market install counts are reported (anonymous, no content).
A publisher's own unreviewed install is never reported.
The usage panel summed every turn in the currency its price table was
kept in, and ignored the display currency the rest of Studio reads
costs in. A DeepSeek entry holds the vendor's USD table, so a user who
pinned CNY, or whose CNY wallet selected it, saw "US$" on the panel
while the pane's cost meter said "¥".
Every quote already carries the vendor's own table in both currencies,
and the stats line records both valuations; nothing had to be converted,
only read. The usage catalog now keeps each row's valuations and tallies
one partition per view: a row the vendor priced in the display currency
moves into it, and any other row keeps its billed currency, so a relay's
USD price is still shown as USD rather than converted at an invented
rate. The schema version moves to 5, which rebuilds the projection from
the JSONL it is derived from.
The live projection path also dropped the cost of every row a running
process appended, marking the file indexed all the same, so today's
spend vanished from the panel until the next restart. It now carries
the same cost a reindex would.
A skill in the Studio composer was only the text "/name", and only a
leading one ran: the kernel reads a slash at the start of a line and
nowhere else, so "/review" typed mid-sentence reached the model as prose.
Picking a skill or subagent from the slash menu now places a chip, at the
start of the line or after any "/" that opens a word. A "/" past the start
asks the kernel's completion as if it opened the line and keeps only
skills and subagents, since a command is not something a sentence can
hold. The chip is the record of the pick; the same letters typed by hand
stay prose, so nothing reads the submitted wording to find a skill.
The chip is drawn by a mirror laid over the textarea at the textarea's own
computed metrics, so caret, selection, IME and undo stay native. Edits are
reconciled from the text the chips were last placed in, so every way into
the box (typing, drops, prompt refine, a refused send) carries them, and an
edit that reaches into a chip removes it whole. Skills take --net and
subagents --deleg.
On send the line goes out as typed (input), the text with the chips taken
out (submit), and the chips (invocations). /submit and POST /inbox/items
route a chip line through the inbox envelope, which already carries
invocations to prepareInvocationTurn, so a mid-line chip reaches the model
byte-identical to a leading "/name task". A kernel that predates this reads
only input and still runs a leading chip. TryEnqueueAndSteer queues a line
holding an invocation as a follow-up: a steer is read as guidance and would
drop the skill.
Closes#11145
RestoreArchived checked id and name collisions but skipped the rest of what a
save validates: a recovered fact could take a subject_key another active fact
now holds, or push pinned guidance over the configured budget. The fact model
states the subject rule unconditionally, and the save path refuses both.
Validate the restored fact with the same validator SaveWithOptions uses, before
any part of the restore is written.
studio still drops the read error when it rewrites the MEMORY.md index:
store.go reads the existing index for indexLinesExceptIn and flushIndexIn
with `existing, _ :=`, so an unreadable index reads as empty and the next
save rebuilds it from the managed lines alone, silently discarding
hand-written content while reporting success.
main-v2 already fixed this in 2eb878989 ("preserve index when reads fail"),
with 79acaf6e9 moving the readers into store_index.go to stay inside the
repolint budgets. This ports the same shape to studio so both lines behave
alike:
- readIndexIn keeps treating a missing index as empty but returns any other
read error; indexLinesExceptIn reports that error and whether the name was
present, which lets indexContainsIn go away.
- flushIndexIn and reindexIn propagate the read error instead of rebuilding
the index from an empty read.
- archiveLocked and archiveMemoryInDir read the index before archiving, so a
failed read happens before any side effect.
- SaveWithOptions reuses removeMemoryFromDir and archiveMemoryInDir, dropping
the duplicated remove/flush and archive/flush pairs and keeping the
function inside its size and complexity budgets.
AppendDoc discarded the read error, so an existing but unreadable doc-memory
file (REASONIX.md/AGENTS.md) was treated as empty and rebuilt from scratch,
silently destroying the user's standing instructions. Surface the read error
unless the file is simply missing.
Ported from 1.x (#8319), which fixed the same defect on main-v2; the 2.x
writer still had the original discard.
Entries may carry a discussion number instead of an issue number. Discussions
have no REST comment API, so the reply goes through addDiscussionComment and
skips a body the bot already posted there.
A publisher can now keep a package to themselves and install their own
packages before, or without, review.
- Publishing takes a visibility. "Only me" saves the package as private:
it skips review and never appears in the market. My packages marks it
private and offers "Submit for review", which moves it to pending.
- Every row in My packages can be installed. The kernel reads the package
from the registry's /v1/me/packages/:handle/:name as the signed-in
account, never from what the window sends, so another account's package
is refused (market.not_yours).
- A live version keeps its reviewer's pin. Any other version has none, so
the preview's own contentDigest becomes the pin: apply must echo it
(market.unpreviewed otherwise) and install_source refuses material that
changed since the preview. The confirmation says "Unreviewed, visible
only to you", and the ledger records the install as unreviewed.
- The plan, the risk grades, the multi-skill confirmation and the
themes-only check are the same ones every market install passes; the
confirmation view is shared with the market entry page.
Each market row is now two lines: name, kind, verified/installed badges and
the install count on the first; a one-line truncated summary with the
publisher and version, de-emphasised, on the second. Rows stay buttons, so
they open with the keyboard, and truncate rather than overflow at phone width.
The listing now says which packages can be installed from the market. The
kernel reads the registry's `pinned` per listed package (nil when an older
registry does not say, so nothing is claimed) and forwards `pinned=1` for the
new "Installable only" toggle. The registry applies that filter, so pages stay
whole; a registry that answers a filtered ask with an unfiltered page is
refused as market.filter_unsupported rather than trimmed client-side. The
install path is unchanged and still checks the approved version's digest.
The chunked update stages the new tree in the update cache and a helper
swaps it in after exit, renaming each installed file into a backup
directory beside the staged tree. Two installs can never complete that
first rename: an all-users install under Program Files, which grants its
users read and execute only, and an install on another volume than the
user's cache, where MoveFileEx without MOVEFILE_COPY_ALLOWED refuses.
For both, the helper rolled every file back and relaunched the old build
with nothing shown, so the update downloaded, "installed", and the
application came back on the version it started from. Before chunked
updates these installs took the full installer, which raises its own
consent and writes wherever it installed.
tryDelta now proves that move before fetching anything: it creates an
entry in the install root and renames it into the cache's delta
directory. If either step fails the full package is downloaded instead,
as for any other delta that cannot be used.
Closes#11115
In a conversation column of 460px or less, app.css stretches the send
cluster to width: 100%, and at 470px or less studio.css takes the same
element out of flow (position: absolute; right: 0; bottom: 0). The two
rules combined into an invisible full-width strip over the composer's
last line, so every tap on the model picker or the effort picker landed
on the send cluster. The pickers rendered but never opened on a phone,
over LAN and over the relay alike.
The absolute rule now declares width: auto, so the cluster is only as
wide as the send button. A stylesheet test resolves the cascade for
the cluster at phone widths and fails if it is out of flow and a full
row wide.
Closes#11116
An over-budget worktrees/ or modules/ group was bound read-only as a whole,
but the exact mounts for the gitdirs inside it were still emitted first, so
planting submodule gitdirs kept growing the bubblewrap argument list. Paths
beneath a read-only tree are now left to that tree.
The serve launch-token sandbox test placed its files under /tmp outside the
write root, which bubblewrap masks with a tmpfs: the control read failed and
the denied reads passed without exercising the forbid-read mounts. The files
now live inside the write root on every platform.
Add English wording for the serve.host_rejected and
auth.launch_token_required refusals.
Signed-in users can now submit skills, plugins, MCP servers and themes to
the community registry from Settings > Extensions > Discover, and follow
each submission's review state.
- internal/ext/market: Client.Publish (POST /v1/packages) and Client.Mine
(GET /v1/me/packages) send the account session as a Bearer token to the
same fixed https host the listing reads, with redirects refused, so the
token never reaches another host. The registry's refusal codes are
projected onto sentinels (ErrSignedOut, ErrEmailUnverified, ErrNotOwner,
ErrVersionExists, ErrRateLimited, ErrRejected).
- A submission is checked against the same source rule an approved
version must pass to install (sourceInstallable, shared with
installable): plugins and themes must name a GitHub tree pinned to a
full commit. Nothing is sent for review that could never be installed.
- theme is its own listing kind that installs through the plugin
installer (Installer("theme") == "plugin") under the same commit pin and
digest check. The plan must consist only of plugin packages that carry
themes and nothing else (no skills, commands, agents, hooks, MCP servers,
prompts or runtime); otherwise market.not_theme.
- serve: POST /market/publish and GET /market/mine, gated like every
account route (host grant plus a stored session), each failure a dotted
code (market.signed_out, market.unpublishable, market.rejected, ...).
- Frontend: Browse / My packages / Publish views inside the market group
while signed in, a sign-in prompt otherwise; a Theme category filter.
- A theme's apply re-plans and checks themes-only before writing, because
a planId binds the source and actions but not the listing kind. A
registry accounts_unavailable answer reads as market.unreachable, not
as signed out.
The host's own git reads the workspace repository's configuration and hooks,
so a confined command that can rewrite them can make the host run a program
of its choosing. The OS sandbox now denies writes to them while leaving the
rest of .git writable.
For the repository git itself discovers from each writable root, protected
paths are: config, config.worktree, commondir and hooks/ of the gitdir and
of the common dir; config, config.worktree and commondir of every existing
linked worktree entry (new entries stay creatable); config, config.worktree,
commondir and hooks/ of every submodule gitdir under modules/. A .git file is followed to the gitdir it names
exactly as git resolves it, and the pointer file and commondir are
protected, so a repository cannot aim the protection at a decoy while git
reads something else. The .git entry, the gitdir, the common dir, every
symlink on the way to them and each writable ancestor are pinned: they
cannot be removed, renamed away or replaced by a symlink, while their own
mode and times stay writable (touch and chmod on the workspace root work).
- macOS: deny rules after every write allowance. Existing worktree and
submodule gitdirs (up to 128 each, found without following symlinks) get
exact rules and pins; patterns anchored at the common dir cover the rest
and gitdirs created later, skipping refs/ and logs/ segments so a branch
or tag named config or hooks stays writable. The profile stops growing
past the limit.
- Linux: pinned directories become their own bind mounts and protected files
and hook trees are bound read-only; only real directories and regular
files are mount targets. Up to 512 gitdirs per group get exact mounts;
past that the whole group directory is bound read-only, so planted HEAD
files cannot overflow the argument list. Only existing paths can be
mounted and symlinks cannot be pinned.
- Windows has no Bash sandbox; the guide says so.
A protected file with another hard link refuses the confined launch with
sandbox.git_metadata_linked (ErrGitMetadataLinked), since no path rule sees
a write through the other name. Whenever a confined command's output names
a protected path, also on exit 0 (git reports some refused config writes
and exits 0), the bash result carries sandbox.git_metadata_protected.
Real-sandbox tests cover each protected path, pointer and symlink
retargeting, patterns for gitdirs created later, bounded rule size with
2000 submodule gitdirs, ordinary git work, and the git operations that now
fail or silently skip their config write.
Every git invocation the host makes goes through gitcmd, and each one must
leave the programs a repository's own configuration names unexecuted:
filter and merge drivers, textconv and external diff, fsmonitor, hooks,
signature verifiers, submodule-boundary programs and lazy-fetch transport.
- Fixed keys are overridden with -c: core.fsmonitor (empty, not "false",
which git before 2.35.2 reads as a hook name), core.hooksPath,
log.showSignature, merge.verifySignatures, diff.submodule, gc.auto and
maintenance.auto and safe.bareRepository=explicit; submodule.recurse=false
for checkout, switch, restore, reset, merge and read-tree (host tree
updates never update submodules), and elsewhere only where the
repository's own config sets it.
GIT_NO_LAZY_FETCH=1 stops a missing object becoming a fetch through the
repository's remote (git 2.44+); a historical patch that fails for that
reason returns gitcmd.ErrObjectNotLocal, decided by git's own
--missing=print listing.
- diff, log and show carry --no-ext-diff and --no-textconv; status and diff
carry --ignore-submodules=dirty. The subcommand is found past global
options, so a call passing -C inside args is hardened too.
- Filter and merge drivers defined at local or worktree scope are listed by
git itself before each invocation (includes followed) and overridden empty;
user and system scope stay live; a name -c cannot address fails closed
(ErrRepositoryDrivers).
- worktree add uses --no-checkout and populates through gitcmd inside the new
worktree, so a conditional include keyed on the new gitdir or branch is
seen by the driver listing there rather than run by the add's checkout.
The reset takes the worktree-mutation timeout, and a failed reset removes
both the worktree and the branch the add created.
- Launcher ls-remote runs Detached with gitcmd's environment (only PATH is
taken from the launcher's declared env), requires an https://, ssh:// or
git:// remote (case-insensitive; http:// and local paths are refused), and
passes the remote and ref past -- so a leading-dash value is an operand.
- frontend/cli runGit passes its directory through gitcmd so enumeration runs
in the target repository, not the process cwd.
- Repository identity is resolved once, when a session opens: boot runs
gitcmd.Open (rev-parse --absolute-git-dir --git-common-dir --show-toplevel)
before any command, the controller carries the resulting gitcmd.Repo, and a
rebuild of the same workspace passes it on. Every later host call runs
through the Repo with GIT_DIR, GIT_COMMON_DIR and GIT_WORK_TREE set, so a
nested .git, a commondir file or a damaged HEAD written afterwards cannot
substitute another repository or its config; a damaged HEAD fails closed.
Threaded through gitstatus Status/Diff (serve /changes and diff),
worktree Inspect/Create/TakeSnapshot and the candidate/apply/remove paths
(Snapshot and Candidate carry their Repo; host-created worktrees are opened
right after worktree add), the isolation store, best_of_n, and cli review
(resolved once before the review agent runs; ObjectsMissing is a Repo
method).
- Open accepts only a git dir belonging to the work tree that holds the
directory: the work tree's own .git (sharing no other common dir) or a
linked worktree's admin dir under <common>/worktrees whose gitdir file
names that work tree's .git. A .git file or core.worktree pointing at
another checkout is ErrNotRepository. Submodule checkouts and
--separate-git-dir repositories opened directly are therefore treated as
not version-controlled.
- Repo.Verify applies Open's test to a stored identity; Snapshot and
Candidate identities are verified when used again.
- The snapshot's private index copy keeps the real index's mtime: with a
fresh mtime git trusted stat for entries written in the index's own
second, so a same-size edit made in that second was left out.
- Snapshot staging uses gitcmd Repo.StageAll: gitlinks present as directories
and untracked nested repositories are excluded with :(exclude,literal)
pathspecs, because add -A checks a submodule by running git inside it under
its own config. A gitlink keeps the commit the index records; an untracked
nested repository is left out (it previously failed the snapshot when it had
no commit).
Regression tests use real git with payload scripts: the gitcmd config-key
matrix (signatures, lazy fetch, submodule boundary), the worktree call sites
(conditional includes on Create and CreateCandidate), the launcher's non-URL
remote rejection, identity pinning after a nested .git, a commondir file and
a damaged HEAD (config origin and filter marker), Open refusing another
checkout's git dir (.git file, core.worktree, foreign admin dir), StageAll
with nested repositories named like pathspec magic or globs, StageAll and TakeSnapshot
past a gitlink with its own filter, the listing and snapshot of a workspace
that later gains its own .git, and a global submodule.recurse=true against
host checkout and reset. The list-then-run race is left to a follow-up that
denies sandboxed writes to .git config and hooks.
`reasonix serve` now generates a per-launch token unless `--auth` or
`[serve].auth_mode` chooses otherwise. `none` remains an explicit opt-out for
deployments fronted by their own authentication: reads stay open to loopback
and bound names only (421 `serve.host_rejected` otherwise), and every
state-changing request, approvals included, needs the launch token (bearer
header or the /auth/token cookie) and otherwise refuses with
`auth.launch_token_required`. A request the loopback gate, a paired-device
gate or the in-process transport already admitted counts as holding it, so
Studio and the TUI keep working unchanged. Token mode also accepts the bearer
header.
The token never reaches the terminal: serve writes it to a 0600 file under the
remote state directory and prints the path, or names the --token-file of a
managed launch. Runtime sandboxes and read tools deny that directory and every
`--token-file`, `--provider-broker-file` and `--provider-broker-token-file`.
[serve] is read from the user config only, so a project reasonix.toml cannot
choose the token, the auth mode, or trust in forwarded headers.
Studio can now browse, search and install from the community registry
(Settings > Extensions > Discover). The market is a source, not a trust root:
- internal/ext/market reads the registry read-only: https to the fixed
crash.reasonix.io host, 15s timeout, capped bodies, redirects refused,
non-active rows dropped. Registry text is untrusted data.
- Only the approved version is installable, and only when its row carries a
content digest. The digest travels to install_source as expectDigest.
- install_source gains a contentDigest on every plan (machine-independent:
SKILL.md bytes, plugin commit, MCP entry) and refuses a plan whose material
differs (ErrDigestMismatch) or cannot be pinned (ErrNotPinnable). Preview
and apply both pass the check, and apply writes what its own plan read.
- GitHub plugin sources pinned to a full commit (tree/<sha>) now clone and
check out that commit instead of failing on --branch <sha>.
- A remote source that expands into more than one skill is graded high, so
the permission layer asks a person even under a blanket allow, and the
market confirmation lists every skill and holds the install button until
the person ticks that they read them.
- Market installs require the planId of the plan that was shown, go to the
global scope, and are recorded in <home>/market/installed.json; "installed"
is read back only while the recorded targets still exist.
- serve: GET /market/packages, GET /market/packages/{handle}/{name},
POST /market/plan, POST /market/install, each failure a dotted code
(market.unpinned, market.content_changed, market.unreachable, ...).
Adds an opt-in cloud backup under Settings > Account, shown only while
signed in. The kernel collects the user-level setup by category, seals
it locally (gzip, then XChaCha20-Poly1305 under an Argon2id key derived
from a passphrase the user sets), and uploads only the envelope to the
accounts service; the service never sees plaintext.
Categories: settings (providers, default model, interface look),
extensions (user skills, plugin references by source and version, MCP
servers), memory (user-level instruction files and global facts),
automation (global hooks, status line) and secrets (stored provider
keys, off by default). Without secrets, literal env/header values are
stripped with the plugin exporter's StripCredentials and URL userinfo
is dropped; the account session token never travels. Approval mode,
permissions and sandbox are deliberately not restorable.
Restore is preview-then-apply. The preview decrypts, diffs each item
against this machine, shows everything an item would write (endpoints,
env, headers, cwd, instruction file bodies) and holds the snapshot under
a single-use plan id. Apply recomputes consent against the machine at
apply time and refuses, writing nothing, unless each of these is named
in `consented`: hooks, the status line and MCP servers (code that runs
here); a provider that is new or changes endpoint, and a default model
pointing at one (conversations and keys go there); a key that replaces
one already stored; an instruction file that imports other files.
A snapshot is rejected outright when a key is not read by a provider it
carries, when a provider reads REASONIX_* or a host-steering variable
(proxy, TLS, loader, PATH), or when a unit's payload names another item.
Plugins are never installed by restore; they come back as sources for
the ordinary plugin install flow and its plan approval. File items are
written only under their named root, through validated relative paths
that may not cross a symlink; hidden files are not exported. Config
writes go through config.EditConfigFile, hooks through hook.Save, keys
through config.SetCredential.
Serve: GET/POST /backups, DELETE /backups/{id}, POST /backups/{id}/preview,
POST /backups/apply, gated by the account grant and a signed-in token,
with dotted refusal codes the frontend words in both languages.
The hosted build has no kernel behind its origin, so opening
studio.reasonix.io directly probed /runtimes, got the SPA shell and
reported that the kernel did not answer. The deploy now declares where a
visitor picks a computer, and a visit without ?device goes there.
A plan whose steps name candidate files owes a change the host proved.
The shadow verdict and the receipt already said so; the gate now holds
an answer that changed nothing, and releases a turn that concluded
blocked, is waiting on the user, or carries a change a restart brought
in. The hold names all three ways out.
The executor-handoff nudge now runs before the gate ends the run: an
executor that has not acted yet gets its one in-turn nudge first, and
the gate holds only what the nudge could not recover.
publish downloads studio-windows-signed by name, but any job in the run can
upload an artifact. windows-sign-installer now outputs the SHA-256 of the
installer it signed and verified, and publish requires the downloaded
artifact to hold exactly the installer and the portable zip, hashing to
that output and to windows-verify-package's archive hash. A mismatch, a
missing hash or an extra file fails with a studio-signing.* title before
anything is signed or published.
The Microsoft-signed d3dcompiler_47.dll and dxil.dll must now also chain to
Microsoft Root Certificate Authority 2010, pinned by thumbprint; subject and
issuer names alone can be issued under any trusted root.
The plan-criteria gate and the frozen contract verdict measured "passed
after the latest change" from LatestSuccessfulMutationIndex, which counts
an unclassified command as a change. A plan check such as `python -c ...`
is exactly such a command, so it became the latest change and owed itself
a later run that could never come: every plan whose checks were inline
scripts ended with its criteria outstanding, graded pass or not.
Both now read LatestProvenMutationIndex, the baseline project checks and
owed review already use: the latest proven write, or the latest unproven
one only when nothing was proven.
The Windows release signed only the three executables Studio builds. The
installed tree also ships Electron's ffmpeg.dll, dxcompiler.dll,
vk_swiftshader.dll and vulkan-1.dll unsigned, and Smart App Control / WDAC
can refuse to load an unsigned low-reputation DLL, so the app may not start.
Every PE file the Windows bundle may hold is now declared in
scripts/windows-signing-lib.ps1: seven the release signs, and
d3dcompiler_47.dll and dxil.dll, which Electron ships signed by Microsoft
and which are kept that way and verified as Microsoft-signed. A bundle with
an undeclared or missing PE file (.exe, .dll, .node, or any MZ header) fails
until a person updates the list.
windows-sign-payload signs the declared files, verifies all nine, and
records a SHA-256 digest of the whole signed tree as a job output. The
signed tree is the payload artifact; windows-package packages it as it
came. A new job, windows-verify-package, with no secrets and no
environment, checks the payload against that digest, unpacks the zip and
the installer's app-64.7z, requires both trees to equal the payload file
for file (plus resources/elevate.exe, pinned by SHA-256), and outputs the
SHA-256 of both packages. windows-sign-installer only requires the packages
to hash to those values before signing, and afterwards only runs SignTool
verification, so no archive is parsed in a job holding the Certum
credentials and Certum never signs an installer whose contents did not
match.
Signatures are read from the file itself through SignTool and the embedded
signer certificate. Get-AuthenticodeSignature answers from the OS catalog
for d3dcompiler_47.dll and reports a catalog signature whatever the file
carries.
The contract pins the new scripts, and validate now refuses a fingerprint
file that runs a script under scripts/ which is not pinned.
Root cause: some Anthropic-compatible gateways, DeepSeek's among them, open
the web_search_tool_result block with an empty content array and send the
results in a later web_search_tool_result_delta. The stream decoder declared
the delta's results field but never handled the event, so the search produced
no provider-run call: no card, and the only visible source list was whatever
the model wrote into its answer. 1.x fixed the same gap in #9197.
Fix: the server-run search state (serverBlock) now remembers result blocks
that opened empty and completes them from the delta, once per block. The
block-start and argument handling moved onto serverBlock with it, which keeps
readStream within its size and complexity budget.
Test: TestStreamSurfacesWebSearchResultDelta fails on origin/studio
("want 1 provider-run call from the result delta, got 0") and passes after
the fix; go test ./internal/model/anthropic/ passes on macOS and Windows.
Fixes#8900
Settings > Appearance > open theme folder failed on Windows with
`exec: "explorer.exe": executable file not found in %PATH%`.
Root cause: revealFolder started a bare "explorer.exe", which exec
resolves through PATH. explorer.exe lives only in %SystemRoot%, and the
environment Studio is launched with does not always carry that directory
on PATH, so the lookup failed before anything started.
Fix: resolve explorer.exe from %SystemRoot% (falling back to %windir%),
the same way the 1.x desktop's revealPath already does, and keep the
bare name only when neither variable is set.
Test: TestFolderCommandFindsExplorerWithoutPath sets PATH to an empty
directory and asserts the command resolves to %SystemRoot%\explorer.exe.
On Windows it failed on the base with the reporter's exact error and
passes after the fix; the serve Folder/Theme tests pass.
Fixes#11079
ACP clients render their token/cost meter from the stable usage_update
session notification (Session Context Size and Cost). The ACP server
never sent it, so clients such as Paseo showed no usage at all even
though the controller already measures the context gauge and the
session status telemetry already totals cost.
After every prompt turn, and after session/load and session/resume,
the server now sends usage_update with used/size from the controller's
ContextSnapshot (the same measurement the compaction trigger uses) and,
when every priced event produced a quote, the cumulative session cost
with its ISO currency. A session with no context window yet sends
nothing, since used and size are required by the protocol.
Test: TestPromptTurnReportsUsageUpdate drives session/prompt through the
real controller and agent with a scripted provider; it fails on the base
("usage_update notifications = 0, want 1 per turn") and passes with the
change. TestUsageUpdateForCarriesCostOnlyWhenPriced pins the wire shape.
Root cause: the live transcript draws a question from ask_request and
hides the ask tool call, since both describe the same prompt. A reload
has no event stream, so fromHistory rebuilt only the tool call - which
the transcript then hid. An answered question vanished entirely after a
reload, session switch or restart, even though its arguments (questions,
options, descriptions) and its result (the recorded answer) are both in
the history.
Fix: when an ask call has a successful result, fromHistory rebuilds it
as a sealed ask card from the call's own arguments, shaped the way
agent.AskTool shapes them for the wire, and carries the result verbatim
as the recorded answer. The card shows every question and option and,
in place of the per-question picks it cannot know, what the kernel
recorded the user said. A call with no result or a failed result stays
a plain tool call. The recorded answer is also searchable.
Test: src/state/ask_history.test.ts and
src/ui/cards/AskCard.recorded.test.tsx fail on the base (no ask item
after fromHistory; the footer reads "Library：未答") and pass with the
fix. Full frontend-next vitest 988/988, tsc clean, make check clean.
TestStreamSurfacesEarlyConnResetAsInterrupt and
TestStreamDoesNotReplayAfterOutput forced a real TCP RST right after
writing the 200 head. Whether net/http observes that RST before or after
the head is up to the OS scheduler. When it lands first, the failure is a
header-phase connection error, which SendWithRetry retries by design, so
the server counts several requests and the reqs == 1 assertion fails
(#8327). A local probe that resets before the head shows the path: the
server saw 11 requests and the call spent 92s in backoff.
The fixture is now a scripted RoundTripper: a 200 SSE response whose body
yields the prelude and then fails with a net.OpError(ECONNRESET). The
phase is fixed, the request counter is atomic, and no socket is involved.
Header-phase retry keeps its own coverage in provider's retry_test.go
(TestTransientErr, TestSendWithRetryRecoversAndNotifies).
Test: both tests pass 500/500 on Windows and on macOS. Mutating ReadCut
and streamFailure so a reset is no longer a StreamInterruptedError makes
both fail, so the fixture still guards the contract.
A Windows launch from a shortcut has no console, so every way Studio
could fail to start -- boot() throwing, the host exiting before its
handshake, the host never starting -- ended in app.quit() with nothing
on screen and nothing on disk.
The shell now writes <userData>/logs/shell.log (start, lock refusal,
host start/exit/spawn failure, boot failure with stack) and tees the
host's stderr into host.log, each rotated at 1 MB x 3. The launch
credential and any token-, secret- or password-named value are
redacted before reaching either file. A launch that fails shows an
error box (zh/en by the system locale) with the reason, the host's
last stderr lines when it never handshook, and the log folder, then
quits. A second launch refused the instance lock stays silent and only
leaves a log line.
Models often wrap an address in backticks ("open `http://127.0.0.1:8787`").
Markdown links and bare URLs were clickable in the transcript, but a code
span had no link handling, so the address could only be copied out.
Root cause: GFM autolinking never looks inside inline code, and nothing
else turned a code span into a link.
Fix: a remark plugin rewrites an mdast inlineCode node into a link when its
whole value parses as one http(s) URL with a host. mdast keeps inline code
apart from fenced code, so listings are untouched; a span already inside a
link is left alone. The existing click routing (closest a[href]) opens it
like any other link, and the code inherits the link colour.
Test: Markdown.plugins.test.tsx gains two cases. "links a code span that
holds exactly one web address" fails on origin/studio (expected null to be
truthy) and passes after; the negative case (command with a URL, file://,
bare scheme, fenced block) stays unlinked. tsc and the full frontend-next
vitest suite (155 files, 985 tests) pass; make check is clean. Real-browser
screenshots of the perf build, before and after, light and dark, show the
span underlined in the link colour and the fenced block unchanged.
Problem: files the agent creates or deletes appear in the Studio explorer
only once the whole turn ends (or the window regains focus), so a long
turn shows a stale tree for its full duration.
Root cause: the pane re-read the working-tree change list only on turn
boundaries, and the explorer reloaded its listing only when that list,
the running flag, the query or the focus glance changed. Nothing between
turn start and turn end asked the disk again.
Fix: count the finished tool calls that are not read-only (the kernel's
own readOnly declaration on each call) and use that count as a trigger:
the pane re-reads /changes and the explorer re-lists its tree and the
open file whenever it moves. Read-only calls cost nothing extra.
Test: pane-tree-refresh.interaction.test.tsx asserts /changes is read
again after a write_file result and not after a read_file result;
WorkbenchPanel.test.tsx asserts the tree picks up a new file when the
count moves mid-turn. Both fail on origin/studio ("expected changes to be
called 1 times, but got 0 times"; draft.txt never listed) and pass with
the fix. tsc --noEmit and repolint -changed pass; the full frontend-next
vitest run passes 982 of 983, the one failure being a 5s timeout in
session-new.interaction.test.tsx under full-suite load that passes when
run alone, with and without this change.
Fixes#7338
An edit whose old_string drops (or adds) a blank line the file has between
two otherwise identical lines never matches: the fuzzy matcher frees only a
blank-line run's length, never its presence. The failure then read as
"not found (nearest line N)" plus "re-read the file, check for stale
context", so the model re-read the file and reproduced the same span the
same way, over and over (#6337).
The host can tell this case apart structurally: with blank lines dropped on
both sides, old_string names exactly one span, and that span's blank-line
layout differs from old_string's. oldStringNotFoundError now reports that
span and its cause. Matching is unchanged; nothing new is accepted.
Test: TestEditFileNotFoundNamesBlankLinePresenceDrift (edit_file and
multi_edit, CRLF file) fails on studio with the generic nearest-line
message and passes after; two negative cases hold the claim to one span
with a genuinely different layout.
Fixes#6337
desktop/ replaces reasonix with the parent module, so the root bumps raise
its graph too, and the Studio desktop and package jobs failed with
"updates to go.mod needed". go mod tidy in desktop/ moves only the
versions the root already requires. This also covers #11033.
Model requests on the OpenAI Chat Completions, Anthropic Messages and
Responses wires, and the /models listing, carried no User-Agent, so Go's
default Go-http-client/1.1 went out. Gateways and relays in front of an
endpoint could not attribute the traffic, and some risk controls aimed at
generic Go clients blocked it.
provider.ApplyClientIdentity now sets User-Agent: Reasonix/<version> on
those requests unless one is already present, so a configured custom
header and the OpenCode Go identity still win. Both hosts (cmd/reasonix
and cmd/reasonix-studio-host) record their ldflags version once at start
through provider.SetClientVersion; an unversioned build reports "dev".
Test: TestRequestsIdentifyReasonix (chat + model listing),
TestMessagesIdentifyReasonix and TestResponsesIdentifyReasonix record the
User-Agent an httptest endpoint receives. Before the wiring all three saw
"Go-http-client/1.1" and failed; after it they see "Reasonix/9.8.7".
TestConfiguredUserAgentWins keeps a custom User-Agent header; the existing
OpenCode Go tests still require exactly "Reasonix" there.
Root cause: on DeepSeek's Anthropic endpoint in thinking mode, every
assistant tool_use turn in history must carry a thinking block. replayThinking
emitted one only when the turn had stored reasoning. A tool-call turn can be
committed without reasoning (the missing-reasoning fallback in the run loop
keeps the first complete response), and from then on every request in the
session, subagent review sessions included, was refused with HTTP 400
"content[].thinking in the thinking mode must be passed back to the API".
Studio has no repair path for that 400, so the session stayed broken.
Fix: while DeepSeek thinking is enabled, a tool-call turn without stored
reasoning replays {"type":"thinking","thinking":""}, which the endpoint
accepts (live-probed in #8927). contentBlock keeps the "thinking" field when
it is empty, because a thinking block without the field is refused as well.
This matches the OpenAI-compatible DeepSeek path, which already sends an
empty reasoning_content key on such turns. Turns with reasoning and thinking-off
requests serialize exactly as before.
Test: TestDeepSeekToolCallTurnWithoutReasoningStillReplaysThinking drives
Stream against an httptest server that answers like DeepSeek. On origin/studio
it fails with "status 400: ... content[].thinking ... must be passed back";
with the fix it passes. TestDeepSeekThinkingOffSendsNoEmptyThinking guards the
thinking-off shape. go test ./internal/model/anthropic/ ./internal/runtime/agent/
./internal/assembly/boot/, go vet, make check and golangci-lint are clean.
The P4 demonstration showed the shadow verdict calling a turn done when the
model changed nothing and said the task was complete: with no deliverable
in the contract, a turn that owes nothing reads as finished (#11056 made
such turns "none", which is honest but still not "owed").
Deliverables come from structure, never from the task's wording: a plan
whose steps name candidate files is a plan that expects its work to land
somewhere. Such a plan now adds one criterion, change@plan, satisfied by any
change the host proved in the task. It binds no path: candidate files are
the planner's inference, the right change may touch a subset, and a replan
moves them. Files the planner only read do not count, since an analysis
plan reads files too.
- A turn under such a plan that changed nothing ends incomplete on the
sealed verdict, and the receipt lists "the plan names files to change,
and no change was proven".
- Losing the deliverable is a relaxation like any plan check: a later plan
naming no files is routed to the user when an approver exists, and a
replan that still names files keeps it.
- Plans with no candidate files, and turns with no plan, are unchanged.
The readiness gate does not hold it yet; that follows the same measured
switch plan criteria took.
A blank-line run may drift in length only when non-blank lines bound the
window on both sides, so a blank-only old_string no longer names every run
in the file, and the window now applies the same trailing-newline rule as
the other fuzzy modes instead of writing a newline the file never had.
The P4 rollout demonstration ran a system-prompt candidate that told the
model not to edit files and to say the task was complete. The rollout gate
rejected it, but most of its 29 false completions were turns the shadow
verdict called completed with no obligations at all: the model changed
nothing, so it owed nothing, and owing nothing read as done. The contract
has no deliverables yet, and the rules forbid guessing from the task text
that a change was asked for.
Such a turn now gets outcome "none": nothing owed and no change the host
saw is no evidence of completing anything. A turn with a successful change
and nothing owed still completes; a failed write is not a change. "none"
agrees with a report that gave no verdict and diverges from one that said
done.
Nothing the user sees changes: the gate never inspected such turns and the
receipt was already absent for them. What changes is the bundle outcome
and every rate built on "completed", which it overstated.
The design doc records the new outcome and the P4 demonstration (promote a
harmless prompt candidate, reject a harmful one, both from bundle metrics).
First P4 slice of docs/design/TRUSTED_EXECUTION.md: the offline rollout
gate (K1: promotion authority is the offline corpus with repeated samples;
I11: false completion must not rise beyond the noise floor on a corpus with
no-solution tasks).
e2ebench -mode rollout reads baseline reports, "--", then candidate
reports (repeated samples are pooled) and decides:
- hold when the comparison means nothing: a side with no capability record
or more than one set (rollout.version_unknown), both sides the same set
(rollout.same_version), different tasks (rollout.corpus_mismatch), no
no-solution tasks to catch a false completion (rollout.corpus_lacks_no_solution),
or fewer than 50 solvable runs a side (rollout.insufficient_samples);
- reject when false completion or grader pass is significantly worse, its
whole 95% interval on the bad side (rollout.false_completion_rose,
rollout.pass_dropped);
- promote otherwise.
A rise inside the noise floor passes: ruling out any rise at all would take
hundreds of runs. The intervals are printed so the resolution is seen. With
-json the decision is written as a machine-readable record, reasons as
codes.
On the P3 reproduction data (one version, 29 solvable runs a side) it holds
for rollout.same_version and rollout.insufficient_samples.
Second P3 slice. compare mode printed two reports' metrics side by side and
left the reader to decide whether a difference meant anything. It now adds
a reproduction section:
- version: one capability set on both sides, two sets (a comparison, not a
reproduction), mixed, or unknown for reports that predate the set;
- corpus: whether both ran the same task ids with the same prompts;
- grader pass on solvable tasks, bundle completed, and false completion,
each with B - A and its 95% interval from Newcombe's method over Wilson
intervals, which stays sensible at the small counts and 0%/100% rates
these reports produce.
A report pair that is one version on one corpus with every interval
containing zero is reported as reproducing within the noise floor.
On existing data, one binary run twice over 82 tasks gives intervals of
about +/-15pp, and twice over 30 tasks one rate moved 20pp and was still
inside its interval: the resolution a single run has, now printed rather
than assumed.
First P3 slice of docs/design/TRUSTED_EXECUTION.md (I10: a rollout metric
counts only runs whose capability digests match). Until now a trajectory
said which model ran and hashed the prompt and tool schemas as a whole, but
not which skills, and no single field said whether two runs had the same
capabilities.
The run header now lists every capability version the run could use, and a
digest of the set:
- host: the build (version and commit), which carries the planner, memory
and compaction policies compiled into it;
- prompt: the system prompt;
- tool: each tool schema, MCP tools included, which is where an MCP
integration's behaviour shows (its launch config can hold secrets and is
not a version);
- skill: each skill by what it says and how it runs, never by where it was
found, so one skill on two machines is one version.
e2ebench reads the set digest and reports how many sets a report spans; a
report over more than one is an average over versions and says so.
Checked with a real reasonix.exe run on the Windows box: the header carried
1 host, 1 prompt, 9 skills and 18 tools and a set digest.
Stage two of moving completion onto the contract revision: the readiness
gate stops reading the replayed contract, where a complete_step citation of
kind manual settled a plan criterion on the model's word.
A required plan criterion now holds the turn only when its step names a
verification command that has not passed since the latest change (or has
never passed, when nothing changed). The message names the check that
settles it. A criterion no command checks is no longer held: the host
cannot settle it, and holding it only ever asked for a citation. It is
listed on the receipt instead (stage one).
Delivery sign-off still requires complete_step; only its role in settling
plan criteria is gone.
Stage one of moving completion onto the contract revision: what the user
reads changes, what blocks a turn does not.
The receipt's unproven plan criteria came from the replayed contract, where
a complete_step citation marks a criterion satisfied on the model's word.
They now come from the sealed verdict: a required plan criterion is proven
only when every verification command its step names passed after the latest
change. A criterion whose step names no command is listed as unproven with
"no command checks it", instead of being settled by a citation. Every other
gap is unchanged, and a turn with no sealed verdict (no trusted state, or no
contract revision in force) keeps the report's gaps as before.
The receipt card renders gaps, not a verdict noun, so this shows up as
listed items where a citation used to leave none.
Not changed: the readiness gate still reads the citation. Moving it is
stage two, measured first for the extra rounds it costs.
Plan criterion ids are positional within one plan (c1, c2, ...), so
#11017's plan@c1 meant different criteria in two plans of the same goal: a
reordered plan could pass as unchanged, a reworded one went unseen, and an
inserted criterion could read as a dropped one. What decides whether a plan
criterion is verifiable is the command its step names, and a command's
canonical identity does hold across plans. The contract now freezes those
commands, deduplicated with the project's checks, and answers each plan
criterion through the check its step names; a criterion whose step names
none is left to the replayed contract as unverifiable.
The plan flow asked the user only when a revision expanded scope. Dropping
a verification command narrows the work and relaxes the contract, and it
never reached the user. Now:
- a plan the user approved carries that, host-stamped (ApprovedByUser is
not part of the planner's JSON), and a derivation under it that loses
only plan checks is accepted as the user's (user:plan_approval);
- a later plan that would drop a check the task accepted is routed to
approval when an approver exists, even if neither the route nor the
planner asked for it;
- with no approver the plan runs and the dropped check stays owed.
The report still reads complete_step citations. Retiring that changes
what users see for every planned task with a criterion no command checks,
so it moves with the gate switch, where the incomplete terminal is
designed.
SignPath has no quota left, so Studio Windows builds could only ship
unsigned. Port the 1.x Certum SimplySign signer, pointed at Studio's own
account and certificate.
- Signing runs only when STUDIO_SIGNING_ENABLED=true, as three jobs, so
the SimplySign session is never up while third-party code runs:
windows-sign-payload signs the window, kernel and computer-use helper;
windows-package builds the installer and zip on a separate runner with
no environment or secrets; windows-sign-installer signs the installer.
The two signing jobs check out only workflow_sha, install no
toolchain, leave Defender on, and stop SimplySign after signing.
- Verification checks trust, the pinned thumbprint, the
STUDIO_SIGNING_SUBJECT subject, an issuer and a timestamp on every
signed executable, on the installer, and on the zip's copies.
- The SimplySign MSI is pinned by SHA-256 as well as by its signature.
- With the switch on, a missing secret or subject, or any signing
failure, blocks publish. The release body's Windows sentence follows
windows-sign-installer's result.
- Credentials are STUDIO_CERTUM_USERNAME, STUDIO_CERTUM_OTP_URI and
STUDIO_CERTUM_KEY_ID only. The concurrency group is
studio-certum-signing, shared with a new non-publishing smoke workflow.
- publish downloads every package artifact by its exact name, taking
Windows from windows-sign-installer when it ran, and fails when two
artifacts carry the same file name.
- signing-contract validates and fingerprints both the tag's tree and the
workflow_sha tree.
- The SignPath request steps, artifact configurations and request helper
are removed. The contract now covers the Certum files, and its call
graph detects Certum credentials.
- The runbook lists the repository settings to decide on before enabling
and says which PE files stay unsigned (Electron DLLs, elevate.exe, the
NSIS uninstaller).
The approved plan's acceptance criteria join the canonical contract. Each
is verified by the verification commands of the step it belongs to: the
user approved those commands with the plan, so they are the plan's own
verifiers, not a check the model picked. A criterion counts only when
every one of them passed after the latest change; a step naming none gives
the criterion no verifier, recorded as verifier.none rather than guessed.
This gives the shadow verdict a host answer for plan criteria that were
otherwise answered by complete_step citations, where the model binds a
check to a criterion. The frozen contract never reads that binding, and a
plan criterion it holds is not counted a second time from the replayed
contract.
Satisfying a criterion with its own step's commands discharges nothing the
host itself owes: stale verification and the project's checks are still
derived separately.
Open, recorded in the design doc: a plan revision the user approves that
drops a criterion is refused like any relaxation, and the report still
reads the citation. Both must change before the gate reads the revision.
On an unplanned turn the shadow contract turned every todo into a required
criterion and resolved it Satisfied when the model marked it completed.
Nothing but the model's own call stood behind that, and it reached the
user: a turn whose only action was marking a todo completed got a
completion receipt saying done. P1 measured it as the claim_only
divergence.
A todo is the model's own breakdown of the work, not a criterion anyone
accepted, so it is now recorded as optional and never resolved from its
status. Dropping only the resolution would have left every unplanned
multi-step turn reporting incomplete however well its change was proven;
making todos optional leaves completion to what the host proved, as on a
turn with no todos. An unfinished todo is still the readiness gate's to
hold: it counts open todos itself and never read this contract.
The report's "anything declared" test now counts required criteria only,
so a turn that only marked todos gives no verdict instead of done.
Still open: a complete_step citation binds a check to a plan criterion on
the model's word; that edge goes when plan criteria carry frozen verifiers.
Background and fleet children could not settle an unclassified command:
their walks would see siblings and the parent writing too, so #11009 left
them unknown. A run that declared write paths now takes a change the walk
sees inside them as its own, even while other writers run, and ignores
everything outside them.
This is an inference the user accepted, not a proof: claims are proven
disjoint up front and writer tools are fenced to them, but a sibling's
shell command writing into another run's paths is not excluded. A call
that only saw changes outside its paths stays unknown and is never read as
having changed nothing. A run with no declared paths, the root included,
attributes a walk only while no other background writer runs, and that
check no longer counts a background child as running beside itself.
The design doc records the inference as W11.
Not measured: on current studio the unproven_mutation divergence was 1/21
across seven delegation tasks (#11009), and a comparison costs about
CNY 8 for a difference that small.
A bare "/name" line or a lone skill chip reached the provider as the raw
rendered skill body in plain user prose: no <skill-pin> sentinel, and on the
structured (composer) path the typed text trailed as an unlabeled paragraph
instead of an Arguments line. The model-invoked path (run_skill,
read_only_skill, read_skill) already sent the pinned form, so one skill had
two payload shapes depending on who invoked it.
Every invocation site now renders through skill.RenderInvocation: the
string submit path, the structured path, RunSkill (ACP prompts) and the
slash_command tool. A lone inline chip takes the typed text as its
arguments, matching "/name task"; several inline chips, or chips mixed with
subagents, keep appending the shared text once. Nothing moves into the
cache-stable prefix. Store.Render is removed and Render is unexported, so the
pinned form is the only one an invocation can take.
An effect test through the real Build asserts the pinned payload at the
provider boundary for the bare and argument-carrying forms of both paths.
Refs #11004
A command the host cannot classify (sed -i, an inline interpreter) is
settled by walking the workspace before and after it. Only the root agent
had a root to walk: sub-agents are built without the write root, so a
child's unclassified command stayed unknown, merged into the parent that
way, and left an unproven_mutation no later check can discharge. On the P1
macOS run this was the cause behind the forced-delegation divergences
(sed -i '' and python3 -c inside children).
- agent.Options gains ObserveRoot, used only for that walk; the root agent
keeps walking its write root, so nothing else about it changes.
- Delegation hands a writer child the workspace as its observe root only
when it runs in the foreground: the parent is waiting on it, so what
changes during one of its calls is that call's. Background and fleet
writers get none, since their walks would claim their siblings' writes.
- While any background writer is registered, no agent settles by walking,
the root included: the difference between the two walks is not the
call's alone.
Measured on the Windows box, 7 delegation tasks x 3 samples per arm: the
unproven_mutation divergence was 1/21 on current studio and 0/21 with this
change, grader 21/21 on both. At that frequency the effect is not
measurable; the change stands on the mechanism and its tests, not on the
number.
A shell command that runs code the host cannot prove read-only, and that is
not a recognized check, counts as a possible change: after it the model is
handed a new stale_verification debt keyed on its own command, and nothing
says why. The model reads that as its check having run, or as the host
asking for the same thing again. The host already knows the reason, so the
first such command in a turn now carries it, with the commands the host
does recognize. The decision reads the host's own classification (not
read-only, verification not_verification, stale verification owed after),
never the command's wording, and it rides the tool result, not the prefix.
Measured on the Windows box, 30 tasks x 2 samples per arm, same binary
apart from this change, run back to back:
stale_verification divergences control 34/60 (57%) notice 19/60 (32%)
grader pass rate control 58/60 notice 58/60
tool calls per task control 20.0 notice 24.2
tokens per task control 199k notice 221k
Two-proportion z = 2.76 (p ~ 0.006). The tasks were selected for having
shown the divergence before, so the earlier 70% rate is not the baseline;
the control arm is. The extra calls are the recognized checks the model
now runs.
Expanding ${REASONIX_WORKSPACE_ROOT}/secret on Windows leaves a forward
slash after the drive-letter path, so the raw string never equals
filepath.Join's result even when the root came from the environment.
Studio and the 1.x line share config.toml and both read [browser] enabled,
with opposite defaults: 1.x writes enabled = false on every save of the
user file, which Studio then read as the person turning its browser tools
off, and a Studio save wrote enabled = true, which switched the 1.x command
line's browser on.
Studio now decides on [tools] browser_tools (unset = on) and carries
[browser] enabled through a save exactly as read, never writing it where the
file had none. Boot binds the browser tools from the new key.
The settings screen gets a built-in browser switch under Tools, backed by
GET/POST /browser-tools on the provider-edit grant. The save writes the user
file and rebuilds the runtime, declared as runtime-rebuild.
First P2 slice of docs/design/TRUSTED_EXECUTION.md. The task contract is now
a host-owned record with an identity and immutable revisions, not a replay
rebuilt from receipts each turn.
- internal/runtime/contract derives criteria only from sources the host
owns: the check identities a task began requiring and the test criteria
captured as host-owned bytes. Derivation is canonical, so the same sources
give byte-identical revisions. Host policy accepts a first revision and
any revision that keeps every criterion and adds to them; one that would
drop or alter a criterion is refused and the revision in force stands.
- Revisions are sealed as contract/1 records in the workspace stream. The
delivery checkpoint names the record, so a goal resumed in another
process is held to the revision it accepted, read back from Trusted Host
State. A name the store cannot produce is reported, never replaced by a
fresh acceptance. A new task starts a new contract.
- The shadow verdict answers each accepted criterion from the ledger, not
from the checkpoint's copy of the declaration, and drops the host
obligation that owes the same verifier so one debt is not counted twice.
The audit and trajectory carry the revision, the policy decision and any
load failure.
Still shadow: the readiness gate is unchanged. The refusal test edits a
checkpoint by hand, which nothing in production does; it demonstrates that
the checkpoint is not the authority, not a reachable bypass.
With the variable set empty the pattern expands to "/secret", which is
absolute on Unix but drive-relative on Windows, so it resolved under the
workspace root and the test failed on every Windows run since 0a0e1989a.
Pointing the variable at a separate directory asserts the actual property -
the value comes from the environment, not the root - on every platform.
The notes landed with section headings outside the allowed set and changes
that name no pull request, which pushed the repo-wide release-note count past
its ceiling and turned lint red on studio. Same content, each change now cites
#10970, #10980 or #10982.
The publish job now renders release-notes/studio/<semver>.md before it
signs anything. A #N that is a pull request gains "by @author"; a #N that
is an issue gains "fixed in #M by @author" for each merged pull request
GitHub links as closing it (the ClosedEvent closer and
closedByPullRequestsReferences, read over GraphQL; mentions are not
fixes). An issue fixed by a direct push stays plain. A 贡献者 list of the
credited humans, in first-appearance order, closes the notes. Bot authors
are never credited; the source file is not rewritten.
scripts/markdown-refs.mjs decides what is a reference: #N at a line start
or after whitespace, "(", "（" or a list separator, outside code spans,
backtick and tilde fences (each closed only by its own kind), indented
code, HTML comments and link targets. A number that names a discussion or
nothing stays plain with a warning instead of failing the release.
Lookups retry with backoff on 5xx, rate limits and dropped connections. A
failure that persists, or an authorisation failure, fails the job with a
release_credits.* code before signing. The publish job gains
issues: read and pull-requests: read.
CI gains a release-notes-scripts job, gated on scripts/ and
release-notes/studio/, that runs the three test files with contents: read.
scripts/release-credits.mjs is the same module the 1.x renderer uses.
A full e2ebench run put ten of eighteen divergences under one reason,
obligation.outstanding, and e2ebench gives every task its own state root
and deletes it afterwards, so the sealed bundle that said which obligation
it was does not survive the run. The kind is a content-free enum and is
what decides which old path owes the difference, so the audit now carries
host:<kind> in its place.
Every save replays the event log before it appends, and the reader refused a
log past 128 MiB. Images were stored inline as data URLs, so a session with
about 2 MiB of images per turn crossed the budget around turn 63: from then on
LoadSession failed and every Save failed with the same error, and later turns
never reached disk.
New records write each data-URL image to <id>.blobs/<sha256>, fsynced before
the record that names it, and carry an image_blobs side table instead. Replay
reads each blob back byte for byte and verifies its hash. Such records are
stamped schema_version 3, so older studio and 1.x builds refuse the log
instead of loading it without its images and saving that loss back.
A missing blob is restored from the copy the .jsonl checkpoint still inlines
and written back. With no copy left, the message keeps its text and records
the lost image as provider.UnavailableImage (hash and position); only
ModelMessages renders a note, and the blob reappearing restores the image. A
transcript missing an image never rewrites a checkpoint that still holds it,
and a runtime still holding an image whose blob vanished writes it back
instead of being reported as diverged; what cannot be restored fails under
ErrSessionImagesUnavailable.
The reader ceiling is 512 MiB. A save folds a log past 128 MiB only when the
fold drops at least 64 MiB, so a legacy inline-image log is folded to its text
once, while a large text-only log is not rewritten on every save. A compaction
sweeps blobs that neither the published log nor a salvage or recovery
sidecar (.events.jsonl.damaged, .superseded, .context.json) names, and stale
temp files; a sidecar it cannot read whole stops the sweep. The stored
compaction projection is built with ProjectionMessages, so an unavailable
image stays a host record there instead of rendered text. The
blob directory is a session sidecar dir: delete, rename (blobs before the
log), recovery trash, native re-homing and sub-agent delete take it along.
Refs #10965
Problem: on start-up the sidebar said "No folders yet" (尚无文件夹) and
"0 projects" under This machine, and the empty transcript asked to open a
project first, until the kernel answered the first tree read. A slow start
looked exactly like a machine whose folders had been lost.
Root cause: App held the tree as TreeWorkspace[] initialised to [], so "not
read yet" and "read, and empty" were the same value, and every reader of it
(the sidebar empty row, the project count, needsProject) drew the latter.
Fix: App tracks treeRead, set once the first hub.tree() read settles. Until
then the sidebar shows a "Reading folders…" status row instead of the empty
row, hides the project count, and needsProject stays false. With no pane
open, the main area says only that no session is open, without the
add-folder prompt it gives once the tree is read and empty. A failed read
still settles, as before, so the window never waits forever.
The row carries the clock icon on the existing tool-running spin (still
under prefers-reduced-motion) and, past one second, the elapsed time via
format.seconds, ticking once a second. The tick is display only and is
aria-hidden, so the status region is not re-announced every second; the
interval lives with the row and is cleared when the read settles or the
row unmounts.
Test: sidebar-first-read.interaction.test.tsx holds hub.tree() pending,
asserts the loading row and no empty-state wording, then resolves [] and
asserts "No folders yet"; a second case with no panes asserts the main
area's add-folder hint is absent until the read settles. Both fail on origin/studio (no loading row) and
passes with this change. tree-reading.interaction.test.tsx uses fake
timers: the elapsed value reads 3s then 5s, is aria-hidden inside the
status, disappears with no timers left once the read settles, and the
interval is cleared on unmount. The perf harness gains ?treems= to hold
tree reads back and ?panes=0 to open with no pane, used for before/after
screenshots in light and dark; perf/motion.mjs counts the reading row's
spin as live work.
Third slice of the trusted execution layer (P1). Every shadow bundle now
carries an outcome derived only from host evidence, and how that outcome
diverges from the completion report's verdict.
- internal/runtime/verdict: Evaluate turns the contract's criteria and
checks, the receipts and the ledger's outstanding obligations into one
verdict per obligation and an outcome (completed, incomplete, failed,
blocked). It never reads a criterion's status, because todo_write and
complete_step can set it; before contracts freeze verifiers, the only
criterion host evidence satisfies is an atomic ask proven by a successful
mutation. Checks keep the state the contract derives from receipts.
- Classify compares that outcome with the report's verdict: agree,
new_stricter or new_looser, with reason codes (claim_only, evidence.stale,
evidence.missing, check.failed, obligation.outstanding, verifier.none,
old_gaps, old_criteria).
- The EvidenceBundle audit carries outcome, class and reasons, and
e2ebench prices them like the completion report: false completion is a
completed bundle on a run the grader failed, next to the divergence and
reason census.
TestEffectClaimOnlyCompletionDivergesThroughRealBuild runs the known hole
through boot.Build: a todo marked completed with no other action finishes
the turn and the report says done; the sealed bundle says incomplete,
new_stricter, claim_only.
Second slice of the trusted execution layer (P1). The shadow bundle now
records the workspace as each turn found and left it, what changed during
the turn, and what changed between sealed turns while nobody observed it.
- internal/state/observation: a snapshot is a tree of directory nodes stored
as content-addressed index objects in Trusted Host State, so an unchanged
directory costs nothing to record again and two snapshots diff by walking
only subtrees whose digests differ. The policy is host-owned; the default
excludes version-control stores and the host's own state root, each with a
reason, and keeps dependency trees observed because verifiers read them.
Ignore files and workspace config are never consulted.
- A file is identified by its stamp (size, mtime, and on macOS/Linux ctime,
inode, device), not a content hash. On this repository's main checkout
(107,803 entries, 2.1 GB of node_modules) a cold snapshot takes 1.9 s and a
warm one about 0.2 s; hashing every file would cost seconds per process.
- trustedstate gains PutIndexObject, which skips the per-object fsync: tree
nodes are an index, not a seal, and with fsync the first snapshot of this
repository took 31 s. A node lost to a crash makes a later diff
unverifiable, never a satisfied comparison.
- The turn-start snapshot runs while the first model request is in flight;
the first tool batch waits for it, so nothing the turn does lands in its
own baseline. The previous snapshot is read from the stream's head record,
so edits made between sessions are seen too.
- The EvidenceBundle audit adds snapshot completeness and the count of
unobserved changes.
The design doc's W1/W3 now say what was built and why (W8-W10).
First slice of the trusted execution layer (docs/design/TRUSTED_EXECUTION.md,
P1). Nothing reads the bundle back to decide a turn.
- internal/state/trustedstate: content-addressed objects, one record chain
per stream, a head file replaced by rename. A head this process already
observed refuses rollback, a same-generation swap and a history that no
longer reaches it; a store with no observed head cannot tell a forged but
self-consistent chain, and the tests pin exactly that. Failures carry
sentinels and a typed code.
- IntegrityLevel is supplied by the components that confine what the model
drives: sandbox.WriteProtects (the platform's effective write roots, both
overlap directions, symlinked ancestors), plus one-way flags set by the MCP
launcher and the extension sidecar launcher whenever they start a process
outside the sandbox, including a "confined" MCP launch that fell back
because no backend was available.
- File tools refuse writes into <state>/trusted with a typed refusal
(workspace.trusted_state_write); an explicit allow_write entry keeps raw
access and also reaches the bash write roots, which drops the level.
- The root agent seals the contract, completion report and receipts at the
end of every turn, including turns the readiness gate stopped. Receipt
arguments are kept as digests only. A new content-free EvidenceBundle
audit reaches the trajectory with the record digest, generation, integrity
and the typed cause when sealing failed.
The design doc records what implementing this showed: MCP servers default to
host mode and sidecars always run unconfined, so installs with either are
tamper-evident only, and the level is per process (another process running
as the same user can write the store).
Define the host-owned layer behind "allowed to start", "completed with
evidence" and "allowed to ship": trust boundary, canonical objects
(Task Contract, Evidence Bundle, Capability Rollout, RiskPolicy,
ObservationPolicy, WorkspaceSnapshot, TrustedHead), state machines,
invariants and typed failure semantics. No UI and no implementation.
Workspace content, including REASONIX.md and .gitignore, is source
material for revision requests and never changes enforcement. Hash
chaining is tamper evidence relative to a trusted head, not an
authority boundary, so L3 enforcement requires host-protected state.
The document lives under docs/design/ so the embedded product-doc
corpus (docs/*.md) cannot present unshipped design as a feature.
Delete (and Cmd+Backspace on macOS) on the focused session row, or on a
kept version/recovery copy row, opens the same inline confirmation the row
menu's delete opens. Only a row holding focus reacts: the handler requires
the row itself to be the event target, never a hover target, and stays out
of the way while the row is being renamed.
The confirmation now also answers Escape as cancel, without letting the key
reach the window's stop-the-run handler, and focus returns to the row the
key asked about so a keyboard is not stranded on the page body.
Focus goes back only when the question is dismissed, not when another
row's question replaces it; after a delete lands it moves to the next row,
or the previous one when the deleted row was last.
The row keydown declares both session.open and session.delete, and the
copy row's delete button and the confirmation's cancel carry their action
ids, keeping the census's unnamed-write count where it was.
Fixes#3220
A screen share or a recording leaks the account balance and the session's
spend as readily as anything else in the meter bar. An eye button beside the
wallet masks both as ••• and persists per machine (rx-hide-amounts), so they
stay hidden across restarts. The sidebar's wallet entry and every amount in
the cost card (session total, this turn, original currency, per-source rows,
wallet) are masked too. Only the drawing changes: the wallet keeps being
read, so revealing shows the current value without a request.
Fixes#4135
The file writers refuse a target outside workspace_root and allow_write on
every OS, including Windows where bash is never OS-sandboxed. The refusal
was a plain error whose text said writes were "confined" and told the
reader to "widen [sandbox] workspace_root / allow_write", so a Windows user
who never enabled a sandbox was told by the agent that it had been
sandboxed.
confine now returns a tool.Refusal coded workspace.write_outside_scope that
names the refused path, the writable directories, that this is the file
tools' scope rather than an OS sandbox, and the setting that allows it. The
agent carries a tool.Refusal's code onto the tool result on the error path,
so the frontend receives the cause as an identity, and the tool card renders
the localized cause from that code. The scope itself is unchanged.
An option can ask for more than itself ("paste the output"), but once it
was picked there was nowhere to type: in Studio the pick and the free-text
box were mutually exclusive, and in the TUI a pick answered at once.
Studio keeps the box open under a single-choice pick as an optional note,
so the answer goes out as [pick, note]; the kernel already joins several
selections. The note is its own state: an Other answer left behind when a
pick is made is not sent as a note, and going back to Other finds it still
typed. Choosing Other still makes the typed text the whole answer, Enter in
the note box answers like Enter in the Other box, and a sealed card shows a
pick's note under the pick rather than as Other.
The TUI takes Tab on a single-choice option as "pick and add a note": the
composer opens for the note, Enter sends it after the pick, Esc keeps the
pick without one. Picking an option now also drops a previously typed
answer, which a single-choice question used to send alongside the pick.
Fixes#8136
A directory claim overlaps every path beneath it, so two writers that
name the same directory serialize even when they touch different files.
The task and fleet descriptions and their write_paths properties now say
to declare file paths when the targets are known.
Both tools sit behind use_capability, so the provider-visible prefix and
the boot golden fixtures are unchanged.
OpenCode Go refuses third-party requests that carry no session:
"Request is missing x-opencode-session and cannot be routed efficiently"
(HTTP 400). The 1.x provider layer sends that header; the studio adapters
never did, so every OpenCode Go call failed on its first request while
the same configuration worked in 1.x.
Each of the three adapters (chat, messages, responses) now mints one
session id per client and presents it, together with a Reasonix
User-Agent, on every request whose URL is on opencode.ai/zen/go. A
header the user configured is kept. Other hosts are untouched.
With the session in place the first tool round trip still failed:
OpenCode Go's chat route rejects a role=tool message carrying "name"
(fixed on 1.x in #10852). The chat adapter omits it there only.
The responses client groups the new id with the DashScope session-cache
flag, and the anthropic client with its custom headers, so neither
guarded struct grows a scalar.
Test: a local gateway that answers 400 without x-opencode-session,
reached through a transport that keeps the opencode.ai URL.
Before: all three adapters fail with "status 400: ... missing
x-opencode-session"; TestOpenCodeGoChatToolResultOmitsName fails with
tool message carries name "read_file". After: all pass, and two
clients present distinct ids while one client keeps its own.
Fixes#10921
ask also carries MCP elicitation, so the Notification hook forwarded an
MCP server's prompt verbatim to whatever channel the hook feeds. Name the
server for an elicitation ("answer needed (MCP <source>): ..."), prefer
its own message over the first field's prompt, and clip every forwarded
prompt to one line of 120 runes.
Follow-up to #10812.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
On a Chinese Windows, cmd.exe reports a missing command in the console
code page (GBK), not UTF-8. The stdio transport kept the stderr tail as
raw bytes, so an MCP startup failure such as "'read-only-mysql-mcp-server'
is not recognized as an internal or external command" reached the settings
page as U+FFFD mojibake and the user could not see why the server failed.
The stderr tail now goes through encoding.DecodeOutput, the one decoder
for process output. The buffer keeps the last 16 KiB, so only its head
can be cut: tailBuffer records when it dropped bytes and passes
Cut{Head: cut}. The end is never cut, because it is whatever the server
last wrote. Output that is not UTF-8 is decoded from the raw bytes, so a
GBK tail that begins with a CJK character keeps that character.
Tests:
- TestStdioFailureDecodesCodePageStderr starts a real child that writes
GBK to stderr and exits.
- TestStderrTailDecodesTheServersCodePage covers GBK that starts with a
CJK character, both uncut and cut, plus UTF-8 cut mid-character.
All of them fail on origin/studio and pass with this change.
Fixes#7857
DecodeOutput trims a partial rune only at an edge the caller cut. Output
that nothing cut but that stops inside a character still has invalid raw
bytes, so it went through charset detection and fell back to GB18030,
and the whole output turned into mojibake: "编译成功…正在运行" plus half
of "中" read as "缂栬瘧鎴愬姛…". This is common in real use:
- a process killed on timeout mid-write;
- a persistent shell's partial() read;
- a block-buffered pipe.
The output is now read as UTF-8, less the final incomplete rune, when
two things hold: that rune is the only invalid part, and a multi-byte
UTF-8 character has already appeared. Both are structural evidence. When
only ASCII precedes the half rune, nothing says UTF-8, so the bytes
still go through detection. The uncut GBK probes (价, 啊\r\n, ok 洹,
啊 ok) are unchanged.
Test: TestDecodeOutputReadsUncutUTF8EndingInPartialRune fails before
this change with the mojibake above and passes after it. It also pins
ASCII plus half a rune (read as a GBK pair) and uncut, tail-cut and
head-cut GBK.
Refs #6488
The edit_file fuzzy matcher already tolerates trailing whitespace, tab-vs-space
indentation and copied read_file line prefixes, but not a blank-line run the
caller reproduced at a different length. PEP 8 asks for two blank lines between
top-level definitions and a model routinely writes one, so the span fails to
match a file it otherwise quotes exactly.
blankRunRanges collapses each run of consecutive blank lines into one token, so
a run's length is free while its presence is not: a blank line absent from the
file still never matches one the caller invented. Non-blank lines keep the
exact-match rule modulo trailing whitespace, and the single-match requirement is
unchanged. The relaxation is a standalone last resort rather than a fuzzyMode,
so a span that drifted in two dimensions at once still fails.
An ACP client had no way to bring back a Goal the session still held.
session/set_mode goal always drafts a new Goal, so the next prompt replaced
the retained objective and reset its counters, while the controller's
ResumeGoal/PauseGoal (reached through /goal in the CLI and Studio composer)
were never driven by a frontend directly.
ACP gains two vendor methods, advertised in agentCapabilities._meta with
schemaVersion 1:
- _reasonix.io/session/goal/resume re-enters a stopped, blocked, paused
or cancelled Goal with its objective, counters, todos and delivery
checkpoint. It does not start a turn; the next session/prompt continues
it. A running, complete or absent Goal fails with -32010.
- _reasonix.io/session/goal/pause pauses a running Goal at its next
continuation boundary, or fails with -32011.
On success both clear the turn-outcome label (cancelled, failed) the
status showed in place of the Goal state, return the Goal in the status
shape, publish a status_update with event "goal", and emit
current_mode_update when the mode moves. docs/ACP.md documents that a
"failed" status labels the last turn while the Goal keeps running.
serve drives the same capabilities through POST /goal/resume and
POST /goal/pause, answering {changed, status, goal}, so frontend-parity
holds without a scope exception.
The rule that a running Goal cannot be resumed moves into
goalMachine.resume under its lock. Before, resume accepted a running Goal
and bumped its continuation epoch, dropping the continuation in flight;
this also affected /goal resume in the CLI and Studio.
initialize/authenticate move unchanged to handshake.go so service.go stays
inside its size budget.
Tests:
- acp: TestServeGoalResumeKeepsTheRetainedObjective and
TestServeGoalPauseStopsARunningGoal fail with only the declarations
present (capability not advertised; -32601 method not found) and pass
after. TestServeGoalFailedLabelKeepsTheGoalRunning fails when pause does
not clear the label (pause reports "failed") and passes after.
- control: TestControllerResumeGoalRefusesARunningGoal and the new
TestGoalAdvanceResultCannotCrossGoalLifecycle subtest fail on the base
("resume accepted a goal that is already running") and pass after.
- serve: TestServeGoalPauseAndResumeKeepTheObjective.
A Studio window can go blank in three ways, and none had a way back
short of quitting, although the kernel keeps running the turn and a
loaded page reattaches to it:
- A render error outside the per-block boundaries unmounts the React
tree while the renderer lives on. The shell installs no menu with a
reload role, so nothing reloads the page.
- The renderer dies while the window is visible. main.js handled
render-process-gone only before the window first showed, so the
window stayed dead.
- The renderer dies while the window is hidden in the tray. showWindow
then revealed the dead page.
installReload binds Cmd+R on macOS, Ctrl+R elsewhere (by key or by the
KeyR code, so non-Latin layouts work) and a bare F5 via
before-input-event. A dead renderer's input never reaches that event, so
it also reloads on render-process-gone while the window is visible,
except for a clean exit. It returns revive(), which showWindow calls
before showing: it reloads when webContents.isCrashed(). Crash reloads
share a guard of at most 3 within 60 s; past that the window is left
alone instead of looping.
Test: desktop/electron/test/unit.mjs, three tests (reload key; visible
crash plus loop guard; hidden crash revived before show). They fail on
the base (Cannot find module '../src/reload.js'), and the hidden-crash
test also fails against the previous revision (no revive); all pass
after, suite 46/46. On Electron 44.1.0: a visible
forcefullyCrashRenderer was followed by did-finish-load; crashing on
every load gave three reloads and then stopped; crashing a hidden
window and then revive() plus show() reloaded it (isCrashed=true, then
did-finish-load).
Refs #10319
Running Reasonix in a git repository left pasted attachments under
.reasonix/attachments and background-task state under .reasonix/tasks as
untracked files, so users added .reasonix to their .gitignore by hand.
Root cause: both stores created their directories in the workspace with no
marker telling git they hold host runtime state. Ignoring all of .reasonix
is not the answer: the same directory holds files a project commits on
purpose (settings.json hooks, skills, output styles, instructions).
Fix: fileutil.MarkUntracked drops a ".gitignore" containing "*" into a
directory the host owns. The marker is written to a temp file in the same
directory and published with os.Link, so a failed write or a crash never
leaves an empty marker that would read as present forever; Link also
refuses an existing target and does not follow a symlink there, so a
marker already in place is kept. The attachment writer and the task store
(task dirs and idempotency records) mark their own roots, best effort in
both: the marker is a courtesy to the user's git, and a filesystem without
hard links must still store the state. The user's .gitignore is never
touched.
Test: TestSavedAttachmentsStayOutOfGitStatus and
TestFileStoreStateStaysOutOfGitStatus run real `git status --porcelain
--untracked-files=all` in a fresh repository with the machine's git config
cut off (GIT_CONFIG_GLOBAL at a missing temp file, GIT_CONFIG_NOSYSTEM,
XDG_CONFIG_HOME at a temp dir, -c core.excludesFile=). With the base
store code they fail listing .reasonix/attachments/* and
.reasonix/tasks/{t1,.idempotency}/*; with the fix the status is empty.
TestMarkUntrackedLeavesNothingWhenTheWriteFails fails against a
create-then-write marker ("failed write left [.gitignore] behind") and
passes with the linked temp file; a symlinked marker is not followed.
Bold text in the transcript could only be told apart by weight. The
.md strong rule painted it with --text, and the theme vocabulary had no
entry a pack could use for it, so the only way to colour it was editing
the shipped stylesheet.
Add an fgStrong colour token. The kernel accepts it, the frontend maps it
to --text-strong, and .md strong reads var(--text-strong, var(--text)),
so every pack that does not name it renders exactly as before. It steps
with the reader's contrast setting like fg does, and the shipped-pack
contrast test now holds it to AA on the same surfaces as the other inks.
Test: TestDecodeAcceptsAStrongTextColour fails on the base (the token is
dropped with a "not a theme token" warning) and passes after; the two new
theme.test.ts cases fail on the base (--text-strong never set) and pass
after. Real-browser screenshots of the perf build, light and dark: before,
setting --text-strong leaves bold at the body colour; after, bold takes
it, and the default rendering is unchanged.
The root .gitignore already lists /workgroupassay; the 10 MB binary was
committed with 491016f8c alongside the tool's source and is rebuilt by
go run ./tools/workgroupassay.
TestEffectRestartKeepsTheReviewAHighRiskGoalOwes (internal/assembly/boot)
failed on windows-latest in runs 36256346762, 36232402249, 36230551992,
36229537444 and 36258827818 (#10901): "PHASE-1 ... never settled", goal
running, 25-26 requests after 20s.
Root cause: the goal in that test can never finish by design and stops only
on its token budget. At 30000 tokens and 1000 per reply, each phase ran about
30 provider requests, 23 of them refused "done" claims, each a full host
turn: about 65 ms on macOS here and, from the CI tail, about 0.8 s on a
hosted Windows runner. 30 turns at that rate do not fit the 20 s settle window. The
assertion only reads whether phase two carried the review nudge and whether
the goal ended incomplete, and the first refused claim already settles both.
At 8000 tokens each phase makes its planned calls plus three nudged
continuations, 16 requests per arm instead of 60, with the same outcome
(blocked, review demanded, in both arms). Settling now waits for the goal to
leave running while the controller is idle. The old test read "idle for
500 ms" as settled, but an idle gap between two continuations is not the
end of the goal.
TestTrySteerRejectedBecomesFollowup (internal/session/control) waited 1 s
for the gated runner. TrySteerInboxItem dispatches the rejected steer
before it returns, so the claim is already durable (state running, intent
follow-up, controller running) when the call comes back. What was being
timed is the turn goroutine reaching the runner. Before that it goes through
a chain of fsyncs: checkpoint begin, branch meta, in-flight marker, recovery
snapshot. That chain takes 100-670 ms on macOS here and can pass a second on
a loaded Windows runner. The test now asserts the admission synchronously.
The 8-minute package timeout in 36258827818 attempt 2 came from
TestThirtySteersApplyAndAckExactlyOnce. Its initial turn missed the same 1 s
start window, t.Fatal ran, and the deferred autosaveWG.Wait blocked forever:
the fake provider's first round was parked on p.release, which only the
test body closed. Every test that parks a fake on a release channel now
closes it idempotently (sync.OnceFunc) before waiting on autosaveWG, in
steeringTurn's cleanup and in TestSteerUnreadAtTurnEndIsDeliveredAsAFollowup.
TestThirtySteers now uses steeringTurn, whose existing 10 s start bound
remains a hang guard only. That wait also returns on TurnDone, so a turn that ends without reaching the provider fails at once
with the event. A deliberate t.Fatal right after steeringTurn used to hang
until -timeout. It now fails in 0.15 s.
TestBackgroundJobWakesSessionThroughManager failed the same way on this
PR's first Windows run (36263202340): a 1 s wait covered the job goroutine
queueing the continuation and the woken turn's fsync chain. The test now
takes the observer's own result for the publish step. It then waits for the
runner input, and the only other exit is a TurnDone. Every step ends in an
event the product always emits, so no clock races the disk. The note check
stays after the runner input: by then the turn's composition has drained
the note, or the ack has dropped it.
Local: -race -count=20 of the five control tests and of the boot test pass
(the boot test drops from about 18 s to about 4 s locally).
Root cause: the 1.x settings editor mirrored base_url into request_url
(and older ones into chat_url), and 1.x and Studio read the same
config.toml. Studio used either override verbatim, so a relay such as
https://router.shengsuanyun.com/api/v1 received its chat POST on the API
root and answered "404 page not found" while /models still listed the
catalog. 1.x fixed this in #9464 and its follow-up 73b6d9b4b; Studio never got
the comparison.
Fix: port provider.EndpointOverrideRepeatsBase into
internal/contract/provider (scheme and host case-insensitive, path exact
apart from a trailing slash, an override with a query or fragment is
deliberate and kept). The openai provider applies it to request_url and
chat_url, anthropic to its root with and without /v1, responses to its
base. Chat URL resolution moves into chaturl.go to keep openai.go inside
its budget.
Test: TestStreamIgnoresEndpointOverridesThatRepeatBaseURL (openai,
request_url and chat_url) and TestStreamIgnoresRequestURLThatRepeatsBaseURL
(anthropic, responses) stream against an httptest server whose base is
/api/v1. On the base they POST to "/api/v1/", "/api/v1" or "/api"; with
the fix they POST to /api/v1/chat/completions, /api/v1/messages and
/api/v1/responses. TestEndpointOverrideRepeatsBase covers the comparison.
Fixes#9658
The config template documents [statusline].command as a command whose
first stdout line replaces the built-in status data row, but the
terminal UI never read the key: nothing passed it from config into
tui.Options, so a configured command was silently ignored.
runTUI now hands the TUI a runner built from the loaded config. When
the footer refreshes its between-turn meters (startup, turn end,
session switch) the TUI fetches the kernel status, feeds
{model, contextUsed, contextWindow, cwd} as JSON on stdin, and shows
the command's first line in place of the telemetry row. Empty output
or a failed run keeps the built-in row. The spawn goes through the
hook spawner with a 2s timeout and without searching the working
directory for a bare executable name.
Statusline is user-level configuration and is never taken from a
project file: LoadForRoot restores the user/global value after the
project merge, the project render scope omits [statusline], and the
project delta never writes it. The template and reasonix.example.toml
say so.
Test:
- tui: TestStatuslineCommandReplacesTheTelemetryRowAfterATurn and
TestEmptyStatuslineOutputKeepsTheBuiltInRow drive the model through a
turn_done update against an HTTP kernel stub.
- cli: TestStatuslineRunnerFeedsStdinAndKeepsTheFirstLine runs a real
shell command; TestStatuslineRunnerIgnoresAProjectCommand loads a
project-only command and expects no runner.
- config: TestProjectStatuslineIsIgnored, TestUserStatuslineWinsOverProject,
TestStatuslineNeverRendersIntoAProjectFile.
Before the scope change the config and project-command tests fail on
their assertions (project value resolved and rendered); after it all
pass.
Problem: adding a source could write over, or read, a credential that belongs
to another endpoint (#9178):
- a name that folds to another provider's slot ("deepseek" beside the
official DEEPSEEK_API_KEY entries) wrote its key over that slot;
- adding under a name that already exists upserted over the entry and
inherited its slot, so a keyless source at a relay resolved and sent the
old key there;
- a removed provider's credential stays stored, and a later source whose
name derives the same slot read it.
Root cause: POST /providers derived the slot from the name alone and
treated an add as an upsert.
Fix:
- config.FreeAPIKeyEnvFor keeps the name's own slot only while no config
entry holds it and nothing is stored there; otherwise it allocates a
private REASONIX_CONNECTION_<id>_KEY slot, the scheme 1.x uses.
- POST /providers refuses a name that already exists (409
provider.name_taken) unless the body says replace. Onboarding, which fills
in the entry a fresh install already names, sends replace; a replace at
that entry's own host keeps its slot, anywhere else it gets a free one.
- An unreadable config refuses the save (500 provider.config_unreadable)
instead of falling back to the name-derived slot.
- The same-host keyless "second door" still shares a slot on purpose.
Test: on origin/studio, TestANewSourceNeverWritesAnotherProvidersKeySlot,
TestAKeylessSourceElsewhereDoesNotBorrowAFoldedSlot,
TestAddingUnderAnExistingNameIsRefused (200, want 409) and
TestAKeylessSourceDoesNotInheritARemovedProvidersKey (relay-b resolved
"sk-a") fail; all pass after, with TestReplacingAnEntryKeepsItsSlotOnlyAtItsHost
and the existing key-reuse tests. Onboarding.test asserts replace is sent.
edit_file on a UTF-8 file carrying CJK text rewrote bytes it never touched:
continuation bytes of characters far from the edit came back as 84 31 A4 37.
Detect took a nil error from the GB18030 decoder as proof the file was
GB18030. The decoder never fails: it maps every invalid sequence to U+FFFD.
So any file that was not valid UTF-8 -- one stray byte is enough -- was read
as GB18030, and the read-modify-write tools (edit_file, multi_edit,
delete_range, write_file over an existing file), checkpoint restore and the
config migrations then re-encoded every unreadable sequence as the GB18030
form of U+FFFD.
Detect now names a charset only when decoding and re-encoding restores the
input byte for byte. GB18030 is tried first, then GBK, which restores what
GB18030 cannot such as CP936's single-byte euro 0x80, so such a file stays
editable in its own encoding; anything else is LossyUTF8, whose bytes pass
through untouched. The new Kind is appended because checkpoints persist it
by value.
GBK cannot hold every character, so Encode now returns an error instead of
falling back to UTF-8, which rewrote a whole CP936 file as UTF-8 when an edit
added a character such as an emoji. A legacy charset that cannot represent a
character answers an *UnencodableError naming it, its byte offset and the
charset, with ErrUnencodable as its identity; the file tools, checkpoint
restore and the config migration refuse the write and leave the file as it
was. Fixtures encode through encodingtest.MustEncode.
Readers that hold only part of a stream say so rather than inherit the
whole-file answer:
- DetectFragment runs the round trip on the prefix the decoder consumes when
not at EOF, so a character the cut split is dropped structurally. grep's
8 KiB peek and read_file's 256 KiB sample use it.
- DecodeOutput is the one entry point for bytes that are only displayed.
The producer says which ends its bound cut (Cut{Head, Tail}); UTF-8 is read
without a character split at a cut end, and an uncut end keeps its bytes,
since a GBK pair there is output rather than half a rune. What no charset
restores is still read as GB18030. Hook output (tail cut when truncated),
the shell tail (head cut once it drops bytes) and the shell's combined
output (uncut) call only it.
- DetectAndDecode decodes a legacy charset once; the edit tools and
DecodeToUTF8 use it instead of detecting and decoding separately.
Tests that fail before this change (on the base or an earlier revision of it)
and pass here:
- TestE2EEditKeepsBytesOfUTF8FileWithStrayByte: e4 b8 ad became
e4 b8 84 31 a4 37 outside the edit (fails on origin/studio).
- TestDetectUTF8WithStrayByteIsNotGB18030 (fails on origin/studio).
- TestWritesRefuseCharacterCP936CannotHold (edit_file, multi_edit,
write_file): nil error and the whole CP936 file rewritten as UTF-8.
- TestDecodeOutputTrimsCutUTF8Edges: UTF-8 cut at the front read as mojibake.
- TestDecodeOutputKeepsUncutCodePageEdges, TestDecodeHookOutputKeepsUncutCodePageEdges:
GBK pairs at an uncut edge (bc db, b0 a1 0d 0a, 6f 6b 20 e4 a1,
b0 a1 20 6f 6b) were dropped as partial UTF-8 runes.
- TestEditKeepsCP936FileWithEuroByte: an edit adding Chinese wrote UTF-8
into a CP936 file.
- TestGrepGB18030PeekWithoutNewline, TestGrepGB18030PeekCutMidCharacter:
no matches past a peek cut mid-character.
- TestReadFileGB18030SampleWithoutNewline: garbled text past the sample.
- TestDecodeHookOutputReadsTruncatedCodePageText,
TestDecodeHookOutputReadsCP936Euro, TestCodePageOutputCutMidCharacterIsReadable:
mojibake for cut or euro-carrying cmd.exe output.
- TestEncodeRefusesCharacterTheCharsetCannotHold, TestDetectGBKWithEuroByte,
TestDetectFragmentDropsTheSplitCharacter, TestDecodeOutputReadsCutCodePageText:
the API's contract.
A balance_url pointing at https://openrouter.ai/api/v1/credits left the
balance readout empty. The wallet decoder is chosen by the endpoint's
host, and openrouter.ai had no entry, so the body was read as DeepSeek's
shape; {"data":{"total_credits","total_usage"}} carries no balance_infos
and was rejected as unreadable.
Add an openrouter.ai decoder: remaining = total_credits - total_usage,
in USD, available while positive. A body missing either field stays
ErrUnreadable rather than rendering as a zero balance.
Test: TestOpenRouterCreditsDecode and TestOpenRouterSpentWalletIsUnavailable
fail on the base ("wallet response not in this endpoint's shape") and pass
with the decoder; go test ./internal/model/billing/ is green.
`reasonix run` rejected --yolo and --dangerously-skip-permissions with
"unknown flag", `reasonix -y run "task"` failed with "unknown command",
and `reasonix --permission-mode auto run "task"` opened the terminal UI
with "run task" as its prompt instead of running headless. Print mode
disagreed with itself: `--yolo run -p hi` ran the task "run hi" and
`-y -p hi` was an unknown command.
Root cause: run's flag set never registered the yolo spellings the
terminal UI takes, and normalizeCommand only looked at argv[0], so a
leading session flag sent everything to the terminal UI, -y was read as
the command name, and the leading -p scan ran past the verb.
Fix:
- run registers --yolo/--dangerously-skip-permissions as an alias for
--permission-mode bypassPermissions; each conflict (-y with --yolo,
either with --permission-mode) names only the flags involved.
- run's flags move into runFlags/newRunFlags so they can be consulted
before dispatch.
- The verb is located with the union of the terminal UI's flags and
run's on the resume-normalized argv, as runTUI reads it, so a value of
either is never taken for it. Leading flags move after `run` only when
the session flags (the terminal UI's plus -y and -p) and run's both
parse them to the same flags with the same values. Otherwise the line stays the terminal
UI's: `--resume run hi`, `-r run hi` and `--inline run hi` keep their
meaning, and a run-only leading flag (--metrics, --output-format) is
reported by the terminal UI.
- -y and -p may lead like the other session flags, and the leading -p
scan stops at the verb even when a run-only flag precedes it.
- The first word after the leading flags is the verb, as it is with no
flags; CLI.md documents that, and interspersed run flags.
Test:
- TestRunApprovalFlagsReachTheHeadlessGate runs Run() against a fake
provider whose first reply calls write_file. The file appears only
where the resolved mode lets an unattended write through (ask and
dontAsk stay unwritten). On origin/studio the five new spellings exit
2 with no file. A mutation that drops the leading flags while routing
fails it for the three leading-flag spellings.
- TestNormalizeCommandCarriesLeadingFlagsIntoRun fails on origin/studio
(10 cases) and on the previous revision of this change (9 cases,
including the three terminal-UI regressions). The revision before this
one fails 2 cases: `--model m --metrics x run -p hi` and the same with
--output-format ran the task "run hi". The revision before this one
fails 2 more: `--resume --permission-mode
--permission-mode=bypassPermissions run hi` and `--resume --resume=abc
run hi` were forwarded to run although the two sets read different
values. It passes now.
- TestRunTakesTheYoloSpellings covers the alias and the per-flag
conflict messages.
Gates: gofmt, go vet (also GOOS=windows), make check clean,
golangci-lint 0 issues (also GOOS=windows), go test
./internal/frontend/cli/.
Refs #8355
Root cause: the todo_write schema declared "level" as
{"type":"integer","enum":[0,1]}. Gemini's function-declaration validator
accepts enum only on string properties with string members, so any Gemini
model behind an OpenAI-compatible relay rejected the whole request with
400 INVALID_ARGUMENT (TYPE_STRING on enum[0]/enum[1]), whatever the prompt.
Fix: express the same range as "minimum":0,"maximum":1. Execute already
rejects any level outside 0..1, so accepted input is unchanged. The level
description loses its "Nesting level:" lead-in to stay inside the schema
token budget. Boot golden fixtures are regenerated for the new bytes.
Test: TestBuiltinSchemaEnumsAreStrings walks every registered built-in
schema and fails on an enum that is not on a string property or has a
non-string member. On origin/studio it fails with three findings on
todo_write's level; with the fix it passes, as do
go test ./internal/tools/builtin/ ./internal/assembly/boot/.
Fixes#9005
A Responses turn could end with a tool call the model issued and never
run it. The stream reader dispatched a function call only when its
function_call_arguments.done or output_item.done event arrived; a relay
that forwards the added and delta events but not the done events (or
sends deltas without the item id) left the call open, the terminal
response.completed ended the attempt, and the turn committed as a clean
answer with no calls. The run then finished ok after one round.
The terminal response's output array is the response's own list of what
it issued. On response.completed and response.incomplete, every
function_call item there that the stream did not already close (matched
by call id) is now completed from that item; one whose status is set and
is not "completed" is left alone, so a call truncated at the output
limit is still not dispatched, and one listed without a call id is not
dispatched either.
The output array decodes one item at a time. Decoded as a typed slice, a
single item with a non-string field (arguments sent as an object by a
non-conforming relay) would fail the whole terminal event, which is then
skipped and the turn ends with unexpected EOF where it used to finish.
A call with no name, such as an arguments.done event that named no
item, is no longer dispatched as an empty call; it stays open for a
later event to name.
Test: wire_gap_test.go drives the real HTTP stream reader. On
origin/studio the "done events never came" and "deltas without item id"
cases fail with calls = nil; both pass after the change, and the
no-duplicate and truncated-call guards pass on both. The
unreadable-item, empty-call-id and unnamed-arguments.done cases fail
before the per-item decode and the skips, and pass after.
go test ./internal/model/... ./internal/runtime/agent/ passes.
The full-screen transcript showed an answer's thinking only as a
"thought for Ns" marker, with no way to read it; a long shell output
could already be opened with a click, the thinking could not.
Full screen, the marker now reads ▸ while shut and ▾ while open, with a
(Ctrl+O) hint. A left click on it, or Ctrl+O for the newest one (for a
terminal whose mouse is handed back to it), opens and shuts the thinking
underneath. Each opened row carries its own faint style, since the
transcript is split into rows after rendering. A streamed answer's first
chunk keeps its row, and when the answer settles that row takes the
final thinking and elapsed time, so thinking that kept arriving after
the text started is not lost. Inline mode, where printed rows cannot be
redrawn, keeps the fixed ▎ marker.
Tests (internal/frontend/tui/screen_test.go):
- TestThinkingOpensAndShutsOnAClick: streamed and settled answers open
and shut on a click of the marker row (FAIL on origin/studio).
- TestOpenedThinkingIsFaintOnEveryRow: every opened row starts with the
faint SGR under an ANSI256 profile (FAIL with one style around the block).
- TestStreamedThinkingOpensAsItSettled: thinking arriving after the text
and the final "thought for 4s" show when opened (FAIL with the row
copied at the first chunk).
- TestCtrlOOpensTheLatestThinking: Ctrl+O opens and shuts it with the
mouse handed to the terminal (FAIL without the key).
Fixes#7934
Root cause: POST /providers/edit saved the entry and answered 204 without
rebuilding the runtime. The context window, token limits, headers and
reasoning protocol are bound into the agent at assembly, so the open
conversation kept its old window: the gauge and the fold point went on
counting against the number the form had just replaced, until something
unrelated (a model switch) rebuilt it. /context/window already rebuilds
in place; the edit form did not.
Fix: after the save, act only when the conversation runs on the edited
source and a field the agent binds at assembly actually changed (base URL,
models, vision, per-model overrides, window, max output, headers, extra
body, protocol, efforts). A key-only edit needs no rebuild because the key
is read per request, so it answers 204. Otherwise:
- running model still listed: rebuild in place. With work in progress (a
running turn, a pending question or background jobs) the save still
lands and the answer is provider.saved_while_running; any other rebuild
failure is runtime.rebuild_failed.
- the edit unticks the running model: a plain save, 204.
- the running model was already unlisted before the edit: nothing on the
entry can carry the change to that conversation, so the answer is
provider.saved_model_unlisted ("switch models to apply it").
On any of these "saved but not applied" answers the edit form refreshes
the providers list and stays open to show why.
Test:
- TestEditProviderReachesTheConversationRunningOnIt failed on
origin/studio ("window = 0, want the saved 1000000"); passes.
- TestEditProviderMidTurnSaysTheConversationKeepsItsSettings failed on
origin/studio ("mid-turn = 204, want 409"); passes.
- TestEditProviderDroppingTheRunningModelIsStillSaved and
TestEditProviderKeyOnlyMidTurnNeedsNoRebuild failed on an earlier
revision of this change (409 instead of 204); pass.
- TestEditProviderAfterDroppingTheRunningModelSaysItIsUnlisted failed on
the previous head ("editing the window after the drop = 204, want
409"); passes.
- EditConn test: a saved_while_running answer calls onSaved, not onDone.
The serve package, go vet (also GOOS=windows), golangci-lint, make check,
tsc, vitest, census:verify and perf/i18n.mjs pass.
A task, parallel_tasks or fleet call may name a child model without a
provider, e.g. "deepseek-v4-flash". The sub-agent resolver passed that
straight to Config.ResolveModel, which answers a bare name with the first
provider that lists it. With the official DeepSeek entry listed before a
relay that serves the same model, a child of a session running on the relay
was silently sent to the official API instead.
A bare name the parent's provider serves is now qualified with that
provider before resolution, in both the runtime resolver and the identity
the usage record reports. A provider name, a provider/model reference, or
a model only another provider lists resolve as before.
Test: TestSubagentBareModelStaysOnParentProvider fails on origin/studio
(resolved refs = ["first/shared-flash" ...], want "relay/shared-flash")
and passes after the fix; go test ./internal/assembly/boot/
./internal/runtime/delegation/ pass, make check clean.
A reopened Studio conversation showed the host's own instructions to the
model as if the user had typed them: the tool-round / task-budget
finalization request, the retry after a reasoning-only answer, the
executor-handoff retry, and the output-truncation fact.
Root cause: /history and the TUI restore decide "who said this" from
provider.Message.HostAuthored, which is written by the producer. Four
injection sites in the run loop appended role=user messages without it
(only the workflow-phase repair set it), so the transcript rebuilt them
as user bubbles and session previews could count them as user turns.
Fix: set HostAuthored at each site. Provider requests are unchanged:
the projection clears the field before sending.
Test: TestLoopComposedUserMessagesAreHostAuthored drives a real Run into
the task-budget landing, an empty-final retry and a truncated tool call.
Before the fix all three cases fail ("a line the loop composed is
recorded as the user's"); after it they pass. agent, serve, control,
sessionstore and boot packages pass; make check and golangci-lint clean.
Fixes#8486
A code block's copy button already swaps to a check mark after a copy,
but hovering it said "Copy response", and the config-trouble banner's
button for the config file path read "Copy response" as its visible text.
Root cause: CopyButton's idle label was the fixed string for a chat
reply; the caller's `label` only reached aria-label, so title and
visible text ignored it. ConfigTrouble passed no label at all.
Fix: the idle label is the caller's `label` when given, and the config
banner labels its button "Copy path" (en locale entry added).
Test: src/ui/CopyButton.test.tsx fails on origin/studio (code block
title "复制回复" vs "复制这段代码"; path button text "复制回复" vs
"复制路径") and passes after. Full vitest (928), tsc, census:verify
and make check pass.
Choosing the free-text option on an ask card left the caret on the
option button, so the answer could not be typed until the box was
clicked, and Enter in the box did nothing: every typed answer needed
the mouse twice.
Choosing the option now focuses its box, every time it is chosen, and
Enter there does what the primary button would. When Enter moves to the
next question, focus follows into that pane (its open box, else its
first option), because the pane it leaves becomes display:none. The key
goes through useIme, so the Enter that confirms an IME candidate is not
read as an answer. The box carries an aria-label.
Test (PromptCards.interaction):
- the caret lands in the box after choosing the option; a composing
Enter does not answer, a later Enter does (clock stubbed, not slept);
- Other -> a normal option -> Other again puts the caret back in the
box (FAIL before: focus stayed on the button);
- Enter on question 1 moves focus to question 2's first option (FAIL
before: focus stayed in the hidden pane's input).
Before/after screenshots were taken on the perf build, light and dark.
Fixes#7904
An ACP client that sent a picture got an answer from a model that never
saw it. session/prompt flattened its blocks to text and kept only text
blocks and resources with inline text: an embedded resource carrying a
base64 blob, which a client sends because embeddedContext is advertised,
was dropped without a word, and so was any image block. An image-only
prompt was refused as empty.
Image blocks and blob resources are now decoded and stored with the
control package's attachment savers under .reasonix/attachments/ in the
session's workspace, and the prompt carries the "@path" reference that
serve and the CLI already hand a turn. Undecodable data or bytes that do
not sniff as an image fail the prompt with invalid params instead of
vanishing. Steer uses the same path. initialize now advertises
promptCapabilities.image = true.
Test: prompt_attachments_test.go drives session/prompt through the real
Serve loop and a real controller. On origin/studio the image block and
blob resource cases fail with the turn input "what is in this picture?"
(no reference), the image-only case fails with "empty prompt", and the
undecodable case returns no error; all pass after the change, and
go test ./internal/frontend/acp/ passes.
On a Windows host without Git Bash the shell tool resolves to PowerShell,
a supported path. Five tests still assumed bash there:
- TestBackgroundBashWaitAndOutput, TestBashTerminalFallsBackWhenUnhandled,
TestBashTerminalSkippedWhenEnvFilteringEnabled and TestRunForegroundSuccess
ran `printf`, which PowerShell does not have. They test job, terminal and
runner plumbing, not POSIX syntax, so they now run `echo`, which both
interpreters accept with the same output.
- TestDefaultSpawnerUsesGitBashForExplicitShOnWindows needs a real Git Bash;
it now skips when no bash is installed. Discovery itself stays covered by
the injected-host tests in internal/safety/sandbox.
- TestGoldenBaselineNoExtensions records the bash tool's bash description.
A host that resolves PowerShell renders a different, intended description,
so the golden now skips there instead of reporting drift, and is never
regenerated from such a host.
Test: the touched tests pass on macOS (bash host) and the four packages pass
in full; go vet passes with GOOS=windows. The PowerShell-only failure could
not be reproduced here (no Windows host without Git Bash is available); the
reporter's reproduction in #8326 shows `printf` not recognized and the
golden diff on the bash tool description.
Problem: a long high-effort think on Studio ended with "response stopped:
hit the client reasoning safety limit" and no answer, even though the
provider was still inside the output budget it had been sent.
Root cause: the agent cancelled the provider stream once 128 KiB of hidden
reasoning had been buffered (about 32K estimated tokens) and returned
errReasoningByteLimitExceeded. The request already carries a provider
output budget (auto ~64K on DeepSeek high), so the byte guard fired inside
the budget and turned a legitimate think into a failed turn. The 1.x line
dropped the abort in #8779; Studio never received it.
Fix: the byte limit now bounds only what the host retains. Reasoning keeps
streaming live, the stored copy is the rune-safe prefix of the stream's
first ReasoningByteLimit bytes, and the default rises to 8 MiB so no
provider-bound reasoning is cut under current output ceilings. Interrupted
usage estimates count every streamed reasoning byte. The sentinel and the
client_reasoning_limit finish reason had no producer left and are removed.
Test: TestDefaultReasoningLimitLetsLongThinkingFinish and
TestReasoningByteLimitBoundsRetainedReasoningOnly fail on origin/studio
with "reasoning output exceeded client byte limit" and pass after the fix.
go test ./internal/runtime/agent ./internal/assembly/boot
./internal/tools/builtin, the race run of the reasoning tests, go vet,
golangci-lint and make check are clean.
Hooks could see a sub-agent finish (SubagentStop) but not begin, and
SubagentStop fired only when the child answered. A failed, cancelled or
self-refused task ended silently, so an external observer driven by
hooks (activity indicators, notifiers) had no event marking the start
of delegated work and no reliable end.
SubagentStart is a new non-blocking event fired just before a
foreground `task` call executes, with the call's arguments in toolArgs.
SubagentStop now fires from a defer on every exit after that start
(answer, failure, cancel, refusal) with `error` set when there was no
answer, under a context detached from the turn's cancellation so a
cancelled turn does not kill the hook. Both carry the call id as callId
(tool_use_id in the Claude-format payload) so consumers can pair them.
Only a foreground `task` fires them; read_only_task, parallel_tasks,
fleet, skill sub-agents and background tasks fire neither. hook.go,
the reasonix-guide skill and GUIDE (en/zh) state that scope and that
exit 2 cannot block.
Test: TestSubagentStartPairsWithSubagentStop runs answer, failure,
cancel and refusal cases plus a background call. Before (SubagentStop
on success only): fails, cancelled and refuses each fail with
"SubagentStart must be followed by exactly one SubagentStop, saw 0".
After: all pass, with matching call ids, err set on the three non-answer
cases, and a live context in SubagentStop. TestRunnerSubagentStartPayload
checks callId, toolArgs and error reach the hook's stdin.
A global [[plugins]] entry had no way to name the workspace it runs for:
${VAR} expansion read only the process environment and the project
.env. Servers that key on the project path in a header or argument
(IntelliJ's IJ_MCP_SERVER_PROJECT_PATH) therefore needed one entry per
project. Installed plugin packages already got ${CLAUDE_PROJECT_DIR};
user and .mcp.json entries did not.
ExpandedPluginForRoot resolves ${REASONIX_WORKSPACE_ROOT} and
${CLAUDE_PROJECT_DIR} to the workspace, and both places that turn an
entry into a spec call it with the root they already hold:
pluginspec.FromEntry (session boot, capdiag, mcp oauth) and the
controller's mcpIdentitySpec (live add, install, reconnect). The host
owns these values, so they outrank a process or .env variable of the
same name; a hook's child process inherits its parent session's
CLAUDE_PROJECT_DIR. Config path fields (sandbox roots, skill paths,
proxy) keep plain environment expansion. WorkspaceRootValue is the one
canonical form (absolute, cleaned, symlinks as opened), also used for
the plugin-package substitution.
Tests (the first three fail before the fix and pass after):
- TestAddMCPServerExpandsWorkspaceRootInLiveHeaders: live AddMCPServer
against an httptest MCP server. Before: live headers = ("",
"/inherited/from/a/parent/hook").
- TestLoadForRootExpandsWorkspaceRootInPluginEntries: two workspaces,
one global http entry and one .mcp.json entry, with a conflicting
CLAUDE_PROJECT_DIR in process env and .env. Before: header = "".
- TestPluginSpecsForRootExpandWorkspaceRoot covers the boot mapping, and
TestWorkspaceRootVarsStayOutOfConfigPathExpansion keeps sandbox paths
out of scope.
Typing "@proinf" found nothing for ProjectInfoNew.tsx: fileref.Search
only recorded a hit when the query was a contiguous substring of a
directory name, the basename or a path segment, so a file could only be
reached by spelling a run of its name exactly or walking down to it one
directory at a time.
Search now keeps a last tier for names that contain the query's letters
in order (case-insensitive), files by basename and directories by name.
It ranks after every contiguous hit and only fills the slots those
leave, so existing results and their order are unchanged. The kernel's
Complete and the external-folder ref search both go through Search, so
every frontend gets it.
Tests: TestSearchMatchesSubsequenceAfterSubstringHits (fileref) and
TestCompleteRefFindsFileBySubsequence (control.Complete, the boundary the
composer calls) fail on origin/studio (got only [src/proinfo.go]; items
= []) and pass with the change.
Under a fake-ip resolver (Clash / mihomo) every public host answers with a
routable A from 198.18.0.0/15 beside a unique-local AAAA from fd00::/8.
The direct dial path refused the whole host as soon as any resolved address
was on the SSRF blocklist, so web_fetch failed for every site with
"refusing to fetch internal address ... (resolves to fdfe:...)".
Root cause: the guard treated one blocked address as a verdict on the host,
although the dial is pinned to a resolved address rather than the name. A
blocked address in a mixed answer can simply be skipped; the connect still
only ever reaches an address that passed the check. A host whose addresses
are all blocked is refused exactly as before.
The direct path moves into dialVettedAddress, which tries the allowed
addresses in resolver order, and the lookup becomes a package seam so the
test can supply a resolver answer.
Test: TestWebFetchDialsAllowedAddressBesideBlockedOne resolves a name to
[fdfe:dcba:9876::152, 127.0.0.1] and fetches from a loopback server. On the
base it fails with "refusing to fetch internal address api-docs.example
(resolves to fdfe:dcba:9876::152)"; with the fix it passes.
TestWebFetchRefusesHostWithOnlyBlockedAddresses keeps the all-blocked
refusal. go test ./internal/tools/builtin/, go vet, make check and
golangci-lint are clean.
A local model running at ~25 tok/s can spend well over two minutes
prefilling a long context without sending a byte. The openai, anthropic
and responses providers each cut such a call after 120s of silence (the
SSE idle watchdog, and the transport's response-header timeout on the two
that set one; anthropic set none, so its header wait was unbounded), and
the turn failed with "stream stalled — no data for 2m0s" although the
model was still working. The 1.x line already moved these guards to 300s.
The window now lives once, as provider.StreamIdleTimeout (300s), and all
three providers read it for both the idle watchdog and the header wait.
A longer header window multiplies through SendWithRetry, which retries a
response-header timeout with the full MaxRetries budget: 11 x 300s plus
backoff is close to an hour before the user sees an error, and a
prefill that timed out once times out identically on every attempt. A
transport timeout (a net.Error reporting Timeout() while the caller's
context is still live) now gets its own budget of one retry, the way
maxAuthRetries bounds auth failures, so the worst case is about ten
minutes.
Test:
- TestNewWaitsFiveMinutesForASilentModel in openai, anthropic and
responses builds each client through New and reads its idle and
header windows. Before: "stream idle window = 2m0s, want at least 5m"
in all three, and "response header window = 0s" for anthropic.
- TestSendWithRetryGivesAHeaderTimeoutOneRetry drives a real
http.Transport against a server that never sends headers. Before:
"calls = 4, want the timed-out attempt plus exactly one retry" (retry
limit 3). After: two calls and an error that is a net.Error timeout.
Fixes#6990
A Windows machine whose OpenSSH DefaultShell is Git Bash could not be used
as a remote host: `uname -sm` answers "MSYS_NT-10.0-26200 x86_64", which is
neither Linux nor macOS, and the fallback `echo %OS% %PROCESSOR_ARCHITECTURE%`
is cmd syntax that bash (and PowerShell) print back literally, so the machine
was refused as unsupported.
Root cause: detectPlatform asked the Windows question in cmd's syntax, while
every command windowsShell sends afterwards already goes through
`powershell -EncodedCommand`, which any of the three login shells runs the
same way.
Fix: ask for OS and PROCESSOR_ARCHITECTURE through psCommand. The guide no
longer says remote hosts are Linux and macOS only.
Test: TestWindowsIsIdentifiedWhateverTheLoginShell drives detectPlatform
through cmd, PowerShell, Git Bash (MSYS_NT) and MINGW64 login shells. On
origin/studio the Git Bash case fails with
bootstrap: unsupported remote: `echo %OS%` answered "%OS% %PROCESSOR_ARCHITECTURE%"
and all four pass after the change.
The explorer classified entries by os.ReadDir's DirEntry.IsDir, which is
false for any symlink. A link to a folder inside the workspace was drawn
as a file, so it could not be expanded, and clicking it asked for a file
read that fails. Search had the same flaw: WalkDir does not follow links,
so a linked folder whose name matched came back as a file hit, and a link
to a file outside the tree came back as a hit the file endpoint's
os.OpenRoot then refuses.
A link entry is now resolved: one naming a folder inside the tree is
listed as a folder (expanding it already works, listFolder checks the
real path), one naming a file inside the tree as a file, and one that
dangles or leaves the tree is not offered, matching the refusal
listFolder already gives such a folder.
Test: TestALinkIsListedAsWhatItResolvesTo and
TestASearchListsOnlyLinksToFilesInTheTree fail on origin/studio
("directories = [alpha zeta]", "search = [alpha/a.txt far.txt near.txt
txt-folder zeta/z.txt]") and pass with the fix; the serve package
passes in full.
Refs #5914
The planner keeps a session of its own and only ever saw its own plans,
so the next planning turn did not know what the executor had found or
changed, and turns the policy routed straight to the executor never
reached it at all. Users ended up relaying the executor's results to the
planner by hand.
Every executor run now owes the planner its final reply (plus the user's
input when the planner never saw that turn), and the next planning input
carries the owed outcomes in an <executor-since-last-plan> block at the
turn tail, so the planner's cache-stable prefix is untouched. The debt
clears only once a plan comes back; a planning turn that fails and rolls
back keeps it owed. Switching sessions clears it with the planner
transcript.
The debt is bounded where it is held: task and reply are cut to their
render caps on append, only the newest four outcomes are kept, and a
count of the trimmed ones is rendered. A reply is taken only from the
run's own messages; when a compaction rewrites the session mid-run,
those begin at the run's own user message, identified by a stamp later
than every message before the run, and without it the outcome reads
"no reply captured" instead of an earlier turn's reply.
Test: TestPlannerSeesWhatTheExecutorDidSinceItLastPlanned and
TestPlannerKeepsExecutorOutcomeOwedWhenPlanningFails fail on
origin/studio (the second planning input carries no executor reply).
TestExecutorOutcomeNeverReportsAnEarlierReplyAfterCompaction (an
earlier reply reported twice) and TestOwedExecutorOutcomesStayBounded
(7 outcomes held, want 4) fail on the previous revision. All pass after,
with the existing coordinator suite.
complete_step rejected diff/files evidence whose paths were cited
workspace-relative ("frontend/src/core/backend/idb.ts") when the writer
had been given the absolute path: the ledger records a receipt's path as
the tool received it, and complete_step compared cited and recorded
paths for exact equality, in the per-turn ledger and in the cross-turn
session fallback alike. The step could not be signed off even though
the file had been written.
The agent now attaches its workspace root to each tool call's evidence
scope, and complete_step checks every cited path under the forms that
name the same workspace file: the citation itself, a relative citation
joined to the root, and an absolute citation made relative to it. A path
outside the workspace keeps only its own form, relative-vs-relative stays
exact, and case folds only on Windows through NormalizePath. The ledger
queries themselves are unchanged, so completion reports and blocked
conclusions keep exact matching.
Test: TestCompleteStepCreditsCitationsOfTheSameWorkspaceFile and
TestE2ERelativeCitationOfAbsoluteWriteSignsOff fail on origin/studio
("diff paths have no matching successful writer receipt") and pass
after. TestCompleteStepCreditsNoOtherFileForACitation (a same tail
outside the workspace, a base name, a relative nested write, a deeper
file's trailing components, a .bak, a ../ escape, a different case on
Linux) is rejected on origin/studio, credited under suffix matching,
and rejected after.
A workspace below a Box Drive mount on Windows failed every config load
with "resolve project config path ...: The system cannot find the path
specified", whether or not reasonix.toml existed.
Root cause: resolveConfigAccessPath canonicalizes the whole path with
filepath.EvalSymlinks before it confines a project config link to its
directory. Below a cloud-drive reparse point that canonicalization fails
while the files themselves open normally, and the failure was treated as
fatal even when reasonix.toml was a plain file or absent.
Fix: when canonicalization fails and the config entry itself is absent or
a non-link file, use the logical path. Such a file lies in its own
directory whatever its ancestors resolve to, so the confinement check has
nothing to decide. A link still has to resolve, so an unresolvable link is
refused as before.
Test: path_access_test.go stubs canonicalization to fail below a mount
directory. Without the fallback both LoadForRoot cases fail with the
reported "resolve project config path" error; with it they load (and the
project value is applied), and a reasonix.toml link under the same mount
is still refused.
Off macOS the Electron shell sets the application menu to null so no bar
renders inside the window. Electron binds F11 only through a menu role
(togglefullscreen), so with no menu the key did nothing and the window
had no way into full screen on Linux or Windows.
The shell now listens for a bare, non-repeated F11 keyDown on the main
window's contents and toggles setFullScreen. macOS is left alone: it
keeps full screen on the title bar and the window menu.
Test: desktop/electron/test/unit.mjs "F11 toggles full screen where no
application menu binds it" fails on origin/studio (the key is unbound)
and passes with this change; node --test test/unit.mjs is 43/43.
The environment block in the system prompt printed "- Shell: bash". That
value is the interpreter sandbox.ResolveShell picked for the bash tool; the
user's login shell ($SHELL) never feeds it (it is only read to recover
PATH). Unattributed, the line reads as the user's shell, so a fish or zsh
user got advice about ~/.bashrc.
The line now reads "- Shell used by the bash tool: <shell>", and the
rendered [tools.shell] config section says the setting picks the bash
tool's interpreter and is independent of the login shell. The prefix
changes once on upgrade and stays byte-stable within a session.
Test: TestBuildEnvironmentBlockAttributesShellToBashTool builds through
boot with SHELL=/usr/bin/fish and reads the system message sent to the
provider. On origin/studio it fails (block shows "- Shell: bash"); with
the fix it passes, together with the environment and config packages.
Fixes#6823
The config documents ui.show_turn_usage as the switch for the per-request
"TURN … tok · in … · cached …" receipt in the CLI/TUI transcript, and the
1.x TUI reads it. The studio TUI never did: runTUI loaded the config but
passed nothing about it to tui.Options, and every usage row was drawn, so
setting it to false changed nothing.
tui.Options gains HideTurnUsage, set from the loaded config. A hidden usage
row still folds into the transcript (a later frame of the same attempt
restates it in place and TurnOut keeps counting), but it is marked committed
without being printed and is skipped in the live area.
Test: TestHiddenTurnUsageNeverReachesTheScreen drives a turn through the
model and checks the screen while the answer streams and after it settles.
Before the fix, hide=true failed in both states (receipt shown); after it,
both pass, and hide=false still shows the receipt.
Root cause: the workbench read an open file once, keyed on its path only.
The explorer tree beside it is re-read when a turn settles, when the
window is looked at again and when the change set moves, but the file
view never was, so an edit by the agent or another application stayed
invisible until the tab was closed and reopened.
Fix: the file view is re-read on the same occasions as the tree, and the
content is replaced only when the kernel's revision for it moved. A draft
with unsaved edits is never overwritten, including one made while a
reload read is in flight, and a hidden panel reads nothing. Revisions
are opaque, so a read only counts if no save and no later read has been
issued since it started; otherwise a reload issued before a save could
land after it and revert the view to the pre-save content.
Test: WorkbenchPanel.test.tsx adds five cases.
- "shows an open file as it is on disk once a turn settles" and
"... once the window is looked at again" fail on the base (view still
shows "First") and pass after the fix.
- "keeps unsaved edits when the file changes on disk underneath them"
pins that a dirty draft issues no read.
- "keeps an edit made while a reload was reading the file" fails when the
in-flight dirty-draft guard is removed and passes with it.
- "drops a reload that was issued before a save and lands after it"
fails without the read/save ordering (view reverts to "# Second") and
passes with it.
Full frontend-next vitest (915 tests), tsc --noEmit and make check are
clean.
Refs #5693
A fenced code block is drawn with a "│ " rail in its gutter. With the
mouse captured, selectedText read the rows exactly as drawn, so copying
code from an answer pasted a rail at the start of every line. Native
mouse mode already draws the rail as blank cells; the in-app copy now
reads the transcript rendered that way. The rail and its blank form have
the same width, so rows and columns still line up with the selection
drawn on screen, and only rows through the selection's end are rendered.
Test: TestSelectionCopiesCodeWithoutTheRail selects a railed code block
in a settled and a live answer. Before: copied
" │ func a() {\n │ return\n │ }". After: no rail; the tui package,
go vet, golangci-lint and make check pass.
remark-gfm defaults to singleTilde: true, so "500~1000 or 2000~3000"
struck out everything from the first tilde to the second. A lone tilde is
the ordinary way to write a range, especially in Chinese replies. The
transcript renderer now passes singleTilde: false; ~~text~~ still strikes.
Test: Markdown.plugins.test.tsx renders two ranges and one ~~...~~ span.
Before the fix it found 2 <del> elements; after, exactly one, holding
only the doubled-tilde text. Full frontend-next vitest and tsc pass.
SendWithRetry retries transient transport errors, but transientErr refused
anything matching errors.Is(err, context.DeadlineExceeded). net/http's
"timeout awaiting response headers" error implements Is(DeadlineExceeded),
so a slow gateway that hit ResponseHeaderTimeout ended the request on the
first attempt and left an unattended run stopped.
Whether the caller gave up is now asked of the caller's context rather than
read off the error's identity; a transport timeout while the caller is still
waiting is retried with the usual backoff.
Test: TestSendWithRetryRetriesResponseHeaderTimeout drives a real
http.Transport with ResponseHeaderTimeout against an httptest server that
stalls the first request. Before: "p: request failed: ... net/http: timeout
awaiting response headers". After: recovers on the second attempt.
TestSendWithRetryStopsWhenCallerDeadlineExpires pins that the caller's own
deadline is still not retried.
Refs #6354
A model switch rebuilds the controller from a snapshot of its history and
closes the old one. /compact runs asynchronously under the rotation gate,
but RuntimeStatus reported only running/finishing as active, so every
busy guard built on it (serve switchModel, provider/workspace rebinds,
ACP config rebuilds) let the switch through mid-fold: the new controller
carried the pre-fold history while the fold landed on the discarded
controller, which then wrote the compacted transcript over the same file.
RuntimeStatus.Running now includes the rotation gate, which also covers
rewind, summarize and new/clear session, matching the 1.x line where
maintenance already counts as running.
Test: TestSwitchModelRefusesWhileManualCompactIsFolding holds a real
manual compaction open at its summary call and switches the model through
serve. Before: switchModel returned nil and replaced the controller.
After: it refuses with busy.switch_model and keeps the old controller.
The Windows smoke and full legs looked hung: output stopped before
internal/assembly/boot and the step ran into its job timeout without
-timeout ever firing. Nothing was hung. With the result cache on, go test
passes each test binary -test.testlogfile, and before and after the run
it computes the cache key from that log, calling filepath.EvalSymlinks on
every recorded path outside the module. boot's log holds about 1.9M
entries (84 MB); on a Windows runner that costs about five minutes per
pass, and a restored cache that already holds a boot log pays it twice.
Pass -count=1 to every root-module go test that runs on Windows, and hold
ci.yml to it with a test that reads the workflow.
A quoted paragraph was wrapped to the full terminal width and then
shifted right by the "▎ " rail (plus any list indent), so every full
row ran two or more columns past the edge. The terminal soft-wrapped
the overflow, leaving a stray rail on one row and the last characters
of the line on the next — most visible with CJK text, where every row
is filled to the edge.
renderBlockquote now lays the quote's body out at the width left after
its prefix and restores the renderer's width afterwards, so nested
quotes and quotes inside list items narrow once per level.
Test: TestBlockquoteRowsFitTheRenderWidth renders top-level, nested,
list-indented and Latin blockquotes at widths 20/41/80 and asserts no
row exceeds the width. It fails on the base (an 84-column row at width 80, 24 at width 20)
and passes with the fix.
A reader who audits what the agent wrote had no way to keep diffs open
while leaving reads and commands folded. The folding settings answered per
part of the transcript (work group, step) and never per what a step did:
"steps" opened everything or only failures, and the work group folded once
the turn ended, so an edit was always two clicks deep.
Folding gains a "changed" mode for the work group and for steps. A step
opens when it changed a file (it carries a diff or line counts, the same
fact the +N/-M badge already reads); a work group opens when one of its
calls did. A "Changes only" preset sets both. The settings preview gains an
edit step so the mode shows what it does.
Test: src/ui/fold-changes.test.tsx renders a real Transcript with a read-only
turn stretch and one holding bash + edit_file. On the base, "changed" is
not a stored mode and both groups stay folded (expected [false, true],
got [false, false]); with the fix only the edit's group and the edit's
step open. Full vitest (144 files, 912 tests) and tsc pass.
curl, wget, pip and most download tools redraw their progress meter by
returning to column zero with a carriage return. The tool card renders
shell output in a <pre>, and a browser draws a carriage return as a
space, so every frame the command printed landed side by side on one
line. The card showed the first frame (0%) and the rest ran off to the
right: a 64-frame curl download measured 35003px wide in Chromium, so a
running download looked stuck at its start.
Term now resolves each line the way a terminal would leave it: every
frame overwrites the start of the one before, a CRLF ending stays a line
ending, and a trailing return holds the last complete frame while the
next one is still arriving. Copy still takes the raw output.
Test: four cases in ToolCards.state.test.tsx (latest frame shown,
shorter frame keeps the uncovered tail, CRLF, trailing return) fail on
origin/studio and pass with the fix. In the perf build the same curl
card goes from 35003px to 710px wide and shows 100% instead of 0%.
Root cause: the full-screen transcript only bound plain PgUp/PgDn, so the
Shift+PgUp/PgDn a terminal uses for its own scrollback fell through to the
composer and did nothing. Shift+Insert, which Linux terminals that pass the
key through expect to paste, was unbound too (the textarea binds only Ctrl+V).
Ctrl+C quitting (twice, when idle) and Ctrl+Insert copying a selection were
already in place.
Shift+Up/Down stay with the composer, which uses them to select lines.
Test: TestShiftPageKeysScrollTheTranscript and
TestShiftInsertPastesClipboardText fail on origin/studio ("shift+pgup left
the view on the tail", "shift+insert did nothing") and pass with the fix;
go test ./internal/frontend/tui/ passes.
Refs #4912
Anything a task produced had to be found by hand under the workspace
path, because the explorer had no way to open Explorer or Finder at a
file or folder. Nothing like it existed. The only reveal in the app
opens the theme folder.
The explorer header gains a button that shows the workspace root. Every
file and folder row gains a context menu:
- "Reveal in File Explorer" on Windows
- "Reveal in Finder" on macOS
- "Show in file manager" elsewhere
The kernel confines the path and the shell does the showing.
- GET /workspace/locate?path=<workspace-relative> answers the absolute
path of an entry in that runtime's workspace. "" and "." name the
root. It refuses "..", absolute paths and links that resolve outside
the tree with workspace.path_outside_tree, and a missing entry with
workspace.file_missing.
- The route is gated on the local-desktop host grant. AllowEditorOpen
is renamed AllowLocalDesktop because the grant now covers both
routes. A networked serve and a paired device get
workspace.locate_no_window.
- The hub refuses the route for a remote pane before proxying, with the
same code. Only the hub knows the pane is remote, and a far kernel,
compromised or not, answers with paths that mean nothing here.
- The renderer sends only its pane base and the relative path, over the
new shell:reveal IPC. Electron main does the rest:
- it requires the base to be a pane (/rt/<id>);
- it asks the kernel with its own credential;
- it acts only on an absolute path the kernel answered, and on Windows
only on a drive-letter path, never a share or device path
(\\host\share, \\?\, \\.\, \??\);
- it only ever calls shell.showItemInFolder, the root included.
openPath is never used: a directory can be an application bundle,
or a link to one, and opening it would launch it outside the
sandbox.
- StudioHost now forwards the query string, which it used to drop
silently.
- The page hides the action in a browser tab (no bridge) and in a
remote pane.
Tests:
- workspace_locate_test.go:
- entries inside the tree, and "." as the root;
- escapes, including a symlink escape;
- a missing entry;
- no grant, and a paired device;
- the hub refusing a remote pane without reaching the far kernel.
- Electron unit tests drive reveal() through StudioHost against a real
HTTP server. They check that the root is only selected, even when it
is answered as a directory, that forged bases never reach the kernel,
and that relative answers and Windows share or device answers are
refused.
- WorkbenchPanel tests cover the header button, both row menus, the
keyboard path, the remote pane and a coded refusal.
Show a pending state while slash commands and skills load, and keep a dismissed pending request from reopening the menu when it resolves. Covers the delayed and Esc paths with interaction tests. Fixes#9311.
In Settings > Model services the protocol row (.vway) lays out the label,
the segmented control and the hint in one nowrap flex row. The label and
the control are flex: none, and the hint is the only item that can shrink
(flex: 0 1 auto, min-width: 0). The detail column is only ~474px wide even
in a 1400px window: label 47 + control 367 + gaps 20 + padding 24 leave
16px, so the hint was shrunk to 16px and set one word per line, 24 lines
down the pane (computed styles read in Chromium). The only rule that
wrapped the row was a max-width: 760px viewport query, which never fires
while the pane itself is narrow inside a wide window.
A switcher row now always wraps, and the hint takes flex: 1 1 100%, so it
sits on its own line under the switcher at every width - the way the
neighbouring rows put a description under their label rather than beside
their control. The viewport query that did this only on narrow windows is
removed.
Test: perf/overflow.mjs opens Settings > Model services at 1400px and 640px
and measures every switcher hint in the detail pane (width against the
room in its row, rendered line count).
Before (origin/studio): 1400px FAIL - width 16px of 450px, 24 lines;
640px ok. After: 1400px 450/450px, 2 lines; 640px 538/538px, 2 lines.
tsc --noEmit, vitest src/ui/Providers src/ui/AddProvider
src/ui/settings-catalog src/styles (36 passed), perf/contrast.mjs clean,
make check clean.
A running bash step in the activity group showed the same static clock as
the group header; the only sign the turn was alive was the composer's R.
Each step row also left a wide blank between the status mark and the
command.
Root causes:
- Nothing animated a running call's state mark; running differed from
done only by a tint.
- `.activity-body .hl .nm` was `flex: 0 0 96px`: a fixed name column, so
a short name like `bash` left ~80px of empty box before the command.
- `.flow .call[data-k="say"] .hl` (and its `.nm`/`.arg` rules) matched
every descendant `.hl`. An activity group is re-hosted inside the say
card, so a running row (a plain `.hl`, not a disclosure summary) picked
up the answer header's 29px left padding and 10px bottom margin and sat
26px right of the finished rows; args also took `--muted` instead of
the group's `--faint`.
Fix:
- A running call's clock turns (2.4s linear) while its state holds. One
fact moves in one place: the step's own mark while the group is open,
the group header's mark once it is folded. The header also says
"{n} 项运行中" in `--net`. Reduced motion stops the turn and keeps the
tint; hidden panes pause it.
- The name hugs its text up to 96px and never shrinks.
- The say header rules are scoped to the card's own header
(`> .c > .hl`), and plain step heads get the summary's 3px inset.
The motion guard counted any two infinite loops as the whole budget; it
now classifies each loop by what it reports (the run mark, or a running
call's mark at most once per running call) and fails any other loop.
Test: new perf/running.mjs drives a finished and a running bash call via
__feed in dark/light at 1440px and 640px, plus reduced motion. Against
origin/studio it fails 28 checks (no animation on the running mark, no
header signal, 83px between name and command, rows 26px apart); after
the fix all pass. motion, idle, cards, contrast, overflow and surface
guards pass; vitest 908/908; tsc clean; make check clean.
The explorer kept listing folders that had been deleted in Windows
Explorer: 12 entries against the 4 the OS showed.
Root cause: GET /workspace/files reads the disk on every request and keeps
no cache, but the panel only asked when it was opened, when the search
query changed, or when the git change set changed. That change set is
itself fetched only at turn boundaries, and untracked or ignored folders
(and every folder of a workspace that is not a repository) never move it.
So a change made in another application was never followed by a read, and
the tree's freshness rested on the agent being the one who wrote.
Fix: the listing is also read again when the window regains focus or its
page becomes visible (useGlance), and when a turn settles. No fs watcher:
the kernel listing is uncached and cheap, a watcher would need a new
dependency, a handle per expanded folder on Windows, and a new pushed
event type across the wire, all to refresh a panel nobody is looking at.
Test: WorkbenchPanel.test.tsx "drops a folder deleted outside the app once
the window is looked at again" deletes a folder from the backing store
without any port call and fires window focus. Fails on origin/studio (the
t620 row is still present), passes with the fix. A second case covers the
turn-settle read of a file git does not list.
The clean delivery receipt lays out the tick, the label and the evidence
(file count plus passing commands) in one flex row. Only the evidence was
meant to give way (min-width: 0 + ellipsis), but the label kept the default
flex-shrink: 1. Flex shrinking is weighted by basis, so a command many times
wider than the label took almost none of the loss and the label was shrunk to
its min-content width - a single glyph for CJK, which may break between any
two characters. "没有未经验证的部分" rendered one glyph per line at every window
width.
The tick and the label now take flex: none; the evidence is the only item
that shrinks and ellipsizes.
The row also sat off the answer's column: it was indented by the tool-call
symbol column (42px), which top-level transcript items no longer draw, and
ran the full flow width instead of --doc. It now hangs like the answer card
(6px inline hang, max-width --doc), so the tick lines up with the answer
text and the activity group, and the row ends where they end.
Test: perf/cards.mjs feeds a turn_done receipt with a long && chain through
the real App in Chromium and measures the label at 1440/640/420px.
Before: "回执标签不被长命令挤成竖排 — 9 行" FAIL at all three widths.
After: 1 行 at all three, and the command is still clipped in-row.
The same page checks the row against the answer's text column: before,
tick off by 48px and row 60px wider at 1440px; after, 0px/0px at all three.
tsc --noEmit, vitest src/ui/cards src/styles (67 passed), make check clean.
Refs #10851
multi_edit returned on the first step whose old_string was missing, not
unique, or empty, so a batch with three bad steps took three round trips
to surface them all even though nothing was ever written.
The sweep now records a failed step, leaves the buffer as it was, and
checks the remaining steps against it. Any failure still returns before
the write, so the file stays untouched. A lone failure keeps its
existing "edit N: ..." form; several are listed under
"K of N edits failed; <path> left untouched", with the note that steps
after a failed one ran without its replacement, so a later failure may
be a consequence of an earlier one.
Test: TestMultiEditReportsEveryFailedStep (5 edits, 3 bad: not found,
not unique, empty old_string) fails on origin/studio, which reports only
edit 2, and passes with this change; the file is unchanged in both.
go test ./internal/tools/builtin/ passes; make check and golangci-lint
on the package are clean.
Refs #10792
The checkout under review is untrusted input, yet review built its grep
from the merged config and read the review skill with the checkout as a
project root. A reasonix.toml setting [tools.search] engine = "rg" and
rg_path = "tools/rg" made review's grep execute a program the checkout
ships, and a .reasonix/skills/review/SKILL.md without read-only replaced
the built-in review skill, handing an attacker-written prompt bash.
Review now loads the user-global config alone (Roots.LoadUserConfigReadOnly)
for its tool registry: search engine, rg_path and sandbox. Its skill store
has no project root, so project-scope skill directories are never
discovered. Provider and model resolution are unchanged.
On studio only the executor and the controller fired the session's hooks.
Every other agent that calls tools ran with no hook runner, so a PreToolUse
deny on reading a secret did not cover its reads:
- delegated children: TaskTool.subagentOptions (task, read_only_task,
parallel_tasks, fleet, background tasks and model-invoked run_skill via
RunProfileSpec) and roleWiring.skillRunOptions (read_only_skill) set no
Hooks. This ports main-v2's 896faf36d (#10843), which never reached studio;
- the dual-model planner (roleWiring.planner);
- the guardian, reachable through gateApprover -> guardianSess.Review;
- `reasonix review`, which builds its subagent outside boot.
hook.Runner gains ForRole(role): a runner firing the same live hook set in
the same environment, whose session id is the parent's id at fire time
suffixed with ":"+role. A SetSessionID rotation (/new, clear, branch
switch) therefore reaches every child, and a hook keyed on session_id
neither merges the planners of different sessions nor confuses a child
with the executor. The hooks and the repeat-suppression state live in a
shared hookSet, so SaveHooks/Replace reaches every derived runner.
boot passes the runner to roleWiring: planner fires as <session>:planner,
guardian as <session>:guardian (guardian.NewSession takes the hooks), task
and skill children as <session>:subagent:<ref|call id> through
TaskToolOptions.HooksForRole and skillRunOptions.
`reasonix review` loads only the user's hooks: hook.LoadOptions gains
Scopes, and boot.NewUserHookRunner loads hook.UserScopes (global
settings.json and installed plugins). Project hooks from the reviewed
checkout never run, since a branch under review is untrusted input. Each
review run fires under a fresh id.
Review hooks start in the checkout root so they can inspect it, which on
Windows would let cmd.exe resolve a legacy hook's bare `python` or `node`
to an executable the checkout ships, since cmd.exe searches the current
directory first. The review runner's spawner (hook.WithoutCwdExeSearch)
sets NoDefaultCurrentDirectoryInExePath=1 in every hook process, which
cmd.exe honours; the cwd stays the checkout.
Tests (real PreToolUse scripts that log their payload and exit 2):
- TestBuildRunsPreToolUseInsideTaskSubagent (boot.Build; task,
read_only_task, run_skill, read_only_skill): the child's read is blocked
and fires under <parent>:subagent:...
- TestEffectPreToolUseCoversPlannerReads / ...GuardianReads (boot.Build):
blocked, under <parent>:planner / <parent>:guardian
- TestEffectPlannerHookSessionFollowsRotation: NewSession moves the
planner's hook session to the new parent id
- TestReviewCommandRunsOnlyUserHooks: a global deny blocks the review's
read, a project hook in the checkout never runs, two runs fire under
two distinct ids
- TestUserHookRunnerDisablesCwdExeSearch: through the spawn seam, the
review runner's hook process starts in the checkout with
NoDefaultCurrentDirectoryInExePath=1
- TestLoadUserScopesSkipProjectHooks, TestRunnerForRoleDerivesSessionIDAtFireTime
Refs #9255
The 1.x line keeps the CLI's install channels until 2.x is stable, so
the npm and Homebrew job now runs only with the repository variable
STUDIO_PUBLISHES_CLI=true. Studio releases still carry the CLI archives
its remote workspaces install from.
A pull request authored with GITHUB_TOKEN never starts other workflows, so
the weekly acknowledgments PR never reported the checks branch protection
requires and could only land by bypassing it. The step now uses the
dedicated ACKNOWLEDGMENTS_TOKEN secret when it is set, and falls back to
GITHUB_TOKEN otherwise.
The contributor table also listed github-actions[bot]; bot accounts are
now filtered before the top 20 are taken (30 are fetched to keep 20).
Checked by running the script against the live API: the previous version
writes one github-actions row, this one writes none.
Wails stopped being the desktop shell when the Electron shell landed, but
seven places on `studio` still describe it in the present tense. Six of them
were already fixed on `main-v2` by #10018; they only need the same edit
carried over here.
- `CHECKPOINTS`: the desktop rewind control calls `controller.Rewind` over the
desktop host protocol, not the Wails binding.
- `TASK_CONTRACT`: the constraint keeps the desktop host JSON contract intact.
- `RECOVERY`: `doctor` inspects install problems without loading the desktop
shell, and macOS keeps LaunchServices launching the desktop app bundle.
- `DESKTOP_CRASH_DIAGNOSTICS_RUNBOOK`: the budget is pre-shell work, and
report/metric persistence runs after shell startup.
- `SESSION_MEMORY_RETRIEVAL`: the example project file no longer points at
`desktop/frontend/wailsjs/`, which went away with the Wails shell. Studio
commits its generated files under `internal/ext/extension/protocol/`.
- `REASONIX.md`: the frontends behind `control.Controller` are the chat TUI,
HTTP/SSE serve and the Electron desktop.
- `issue-auto-label`: the classifier prompt no longer tells the model the
desktop app is Wails.
Root cause: Electron 44 picks its Wayland Ozone backend by itself in a
Wayland session, and on drivers whose EGL platform init fails there (#10369)
the GPU process exits and the app dies before a window appears; the same
machine works with --ozone-platform=x11. Studio's deb entry runs the
Electron binary directly, so no wrapper builds its argv, and the only
switch main.js sets is disable-backgrounding-occluded-windows. Chromium
selects Ozone before main.js runs, so appendSwitch cannot choose it.
Decision: default to X11 whenever it is available, the same rule as the
1.x line. On Linux, when the session is Wayland (XDG_SESSION_TYPE, else
WAYLAND_DISPLAY) and DISPLAY is set, main.js relaunches once with
--ozone-platform=x11 prepended and exits, before it claims the instance
lock so the relaunch finds nothing held. REASONIX_OZONE_PLATFORM=wayland
keeps native Wayland, x11 forces X11, auto is the default. A pure Wayland
session without DISPLAY and an X11 session are unchanged, and an explicit
--ozone-platform or --ozone-platform-hint argument wins, which is also what
stops the relaunched process from relaunching again. The update handover's
app.relaunch() reuses process.argv and keeps the flag.
Test: two cases in test/unit.mjs. One loads the real main.js with a stub
electron module under a Wayland+DISPLAY environment and asserts it
relaunches with the flag and exits before requestSingleInstanceLock; on
origin/studio it fails with actual [['lock']] where
[['relaunch', ['--ozone-platform=x11', ...]], ['exit', 0]] was expected.
The other walks the session table through relaunchForOzonePlatform. Both
pass with the fix (38/38). A probe on Electron 44.1.0 confirmed a
top-level return after app.relaunch({args}) + app.exit(0) before ready
starts a child that receives the new argv.
Root cause: on DeepSeek thinking mode, reasoningOnlyFinishHonoured
accepts a finish_reason=stop with empty content as the final answer.
When that stop comes right after a tool round, the tool results never
get a visible synthesis and the turn goes idle until the user sends
another message (#9758).
Decision: a narrow structural retry. When this turn ran tools, no
visible assistant text follows the last tool result in the transcript,
and the stop is reasoning-only, the existing empty-final retry runs
once; a second reasoning-only stop is honoured. A reasoning-only answer
to a turn that ran no tools is still honoured, so the extra thinking
round the honour rule prevents does not come back there. The judgement
reads structure only: usedAnyTool, empty content, message position.
Non-DeepSeek providers keep their existing bounded retry.
Tests: TestRunRetriesReasoningOnlyStopAfterToolRoundOnce and
TestRunAcceptsSecondReasoningOnlyStopAfterToolRound drive a scripted
DeepSeek-policy provider through Agent.Run. On the base both fail with
"provider calls = 2, want tool round + reasoning-only stop + one retry";
with the fix they pass. TestRunAcceptsReasoningOnlyFinalWhenModelStopped
(no tools) passes unchanged, as do internal/runtime/agent and its
direct dependents.
read_file told the model to reference an image as @path and, if it
cannot read images, to delegate with read_only_task. Only a reference
in the user's own message attaches a picture, so for an image the user
never attached the delegation reached a child with nothing to look at.
The refusal now says an image attached this turn can go to
read_only_task, and that any other one needs the user to send it.
In 2,217 local sessions, all six image refusals were attachments, which
the delegation does carry; the unattached case has not been seen, so no
new task parameter is added for it.
build-host.js built reasonix-studio-host on Linux, and linux-payload.js
built reasonix-studio-update-helper, with cgo at its default. On the
ubuntu-22.04 runner that links both against glibc 2.35: in the
studio-v2.20.0 .deb both name /lib64/ld-linux-x86-64.so.2 and the host
needs GLIBC_2.32/2.34, so Studio will not start its kernel on glibc 2.31
systems even though the host is already held CGO-free by studio.yml. On
Linux the only cgo in its closure is the stdlib's optional net and os/user
glue, which have pure-Go implementations.
Both builds now pass CGO_ENABLED=0, and the package job reads the ELF
program headers of the .deb's Go binaries (packaging/elf.js) and fails if
one names a program interpreter.
Test: test/unit.mjs adds a case for elf.js; on the base it fails with
"Cannot find module '../packaging/elf.js'", with the fix 36/36 pass.
`node packaging/elf.js` on the studio-v2.20.0 .deb's host and helper
exits 1 ("... is dynamically linked (interpreter
/lib64/ld-linux-x86-64.so.2)"), and exits 0 on both built with
CGO_ENABLED=0 GOOS=linux.
Refs #10372
Root cause: legacy conhost with a CJK TrueType font (the default on
Chinese Windows) sizes East Asian Ambiguous runes by the glyph, so it
draws a font-dependent subset two cells wide: · … “ ” ‘ ’ — – ● → ↑ ↓
◆ ° × and Greek/Cyrillic letters among them. The TUI and its renderer
count all of them as one cell, so every full-width row carrying k of
them is k cells too wide on screen: conhost wraps it, the alt-screen
frame grows past the window and scrolls, and later repaints land on
shifted rows, which is the stacked-frame garbage in the report.
Decision: measure instead of guess. When stdout is a console, a
never-activated screen buffer of that console (same font) measures
each non-ASCII rune the layout counts as one cell, once, via
WriteConsoleW and a cursor read-back. A rune the console draws wider is
swapped, after layout, for a one-cell stand-in both sides agree on:
Unicode's halfwidth variant when it has one (→ becomes U+FFEB), else
the OS US-ASCII best-fit (· becomes ., “ becomes "), else the OS
default character. Each candidate is itself measured before it is
used. The swap is rune for rune at equal counted width, so applying it
to the finished frame changes no row's layout; escape sequences and
OSC payloads pass through untouched. A pseudoconsole (Windows Terminal,
VS Code, SSH) measures these runes as one cell, so nothing is replaced
there; other platforms get a nil fit and are unchanged.
The same measurement also covers what the inline mode prints above the
frame (answers and the banner), since a wrapped print adds rows the
renderer does not know about. The banner is printed from a command
goroutine, so the per-rune cache is guarded by a mutex.
Test: TestFrameFitsConhostMeasuredWidths renders the real TUI View at
120 columns after a streamed answer, with the width table measured on
a Chinese Windows 11 conhost, and asserts no row draws wider than the
terminal. With the substitution disabled it fails:
row 3 draws 121 cells on conhost, terminal has 120
With the fix it passes (also under -race). In a real conhost window
the unfixed binary shows the status row twice with "au" / "to" split
across rows; the fixed binary keeps the 30-row frame intact.
Refs #10540
The rendered config template writes bash = "enforce" even when nobody
chose it, so on a Linux host without bubblewrap the settings read back
as enforce and every later save was refused as sandbox.unavailable,
including one that only added a writable directory. Only switching the
jail on is refused now; a file already holding enforce saves its other
fields, and bash stays refused at run time as before.
Reproduced on a bwrap-less Linux: the new test fails there without this
change and passes with it. It skips where a sandbox exists and on
Windows, which forces bash off.
Root cause: the transcript was written only on the 30s autosave tick or
at turn end. A process killed between admitting the user message and the
next save reopened with the in-flight marker but without the prompt, so
the turn vanished from both the history and the model's context.
Decision: the same bounded change as the 1.x line's option A (1). The
agent gains an AdmissionSaver seam called from LandAuthoredUserMessage,
the one place a turn's user message lands, and the controller saves the
transcript there: one extra save per turn, skipped without a session
path, and a failed save only logs. The 1.x partial-output checkpoint
does not apply here: studio has no event-log session store, and the
cache-stable prompt prefix is untouched.
Test: TestKilledTurnKeepsItsPrompt (internal/session/control) runs one
turn, starts a second, streams part of a reply and ends the child
process with os.Exit (no TurnDone, no final save), then reloads the
session and runs recovery. On origin/studio it fails with "prompt of the
killed turn lost after restart"; with the fix it passes.
The test saves the sandbox settings twice. On a Linux runner without
bubblewrap the second save asks for a sandbox the host cannot run and
is refused, which has nothing to do with the switch under test.
When native mouse is on (REASONIX_DISABLE_MOUSE, or the /mouse toggle), the
terminal owns the mouse: the in-app scrollbar can no longer be dragged, so the
transcript drops its right-hand column and reclaims that width for content, and
fenced code drops its "│" gutter for clean copy. Capture-on is unchanged.
When --continue finds no saved session, it reports the miss and starts a fresh
session instead of exiting 1. Both the run path and the TUI resume path fall
through, a --continue miss is no longer reported as "continue" in telemetry,
and the flag help and docs say so.
The ask tool blocks the run on the user exactly like an approval prompt,
but only approval prompts fired the Notification hook, so an external
channel wired to it heard about every pending approval while a blocking
question looked like the agent still working. In YOLO mode ask is the
only prompt that waits on the user, and it was the one that stayed silent.
Fire the hook once the AskRequest is emitted, mirroring the approval call
site: message "answer needed: <first prompt>" (en/zh/zh-TW),
notificationType "question_prompt".
Rebuild of #9048 on studio.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Looked at on Windows Terminal against 1.x with the same scripted turn:
- A streaming answer is printed a block at a time, and each block lost the
blank line before it, so headings, lists, code and tables ran together.
A later stretch now starts with that line.
- Tabs were drawn zero cells wide in the full-screen view, so code lost its
indentation. Rows expand them before wrapping, as 1.x does.
- A list resumed after a code block restarted at 1; it counts from the
number it was written with.
- oneLine cut by runes, so a line with CJK text ran past the row and wrapped
to column 0. It cuts by cells.
- The approval panel and the end-of-turn mark drew ⏸ and ⚠, which Windows
Terminal renders as two-cell emoji over one-cell slots. The panel is headed
by its title in the accent colour, and its key hint is translated.
- The end-of-turn card is 1.x's: what went unproven, in the reader's
language, instead of "incomplete · 2 gap(s)".
- The footer's compaction figure reads "距压缩 81%" (headroom left), not
"压缩 81%".
write_file replaces the whole file, so a model writing from what it read
earlier silently discards anything changed since: an edit the user made
in their editor while the turn ran, a formatter, another process. The
run now keeps what the agent last saw of each file, through read_file or
its own writes, and write_file refuses when the file holds something
else, telling the model to read it again. edit_file and multi_edit match
their old text against the current file and were already safe.
In 2,217 local sessions, the case never shows in the logs, because an
outside edit is not recorded there, so this is a safety net rather than
a measured gain. It costs nothing until a file has actually changed,
and is on by default. [tools].protect_changed_files and a switch in the
Studio sandbox settings turn it off.
An explicit --model whose provider has no key failed with
`provider "deepseek-flash" requires DEEPSEEK_API_KEY`. Provider keys
resolve only from the loaded config's credentials file
(storedCredentialValue on Roots.UserCredentialsPath), so the message
sent users to export the variable in their shell or system environment,
which Reasonix never reads. It also labelled the model ref as a
provider. Reported through `reasonix acp` from the VS Code extension in
#10458.
The error now names the model, the variable, the credentials file of
the config it was resolved against, and `reasonix setup`, and says
shell environment variables are not read.
Test: TestResolveModelForCLIMissingKeyNamesCredentialFile sets the key
only in the process environment. On the base it fails with
error "provider \"deepseek-flash\" requires REASONIX_CLI_TEST_SHELL_ONLY_KEY"
does not mention ".../.reasonix/.env"
and passes with the fix; go test ./internal/frontend/cli/ passes.
GitHub acts on "Fixes #N" only for pull requests merged into the default
branch, which is studio, so fixes merged into main-v2 left their issues
open. On a merge into main-v2 this reads the description's closing
keywords, notes the fix on each open issue and closes it.
Adds [skills].suppress_warnings (default false), which quiets the non-fatal skill warnings printed during startup discovery. doctor diagnostics are unchanged. Implements #6483.
The terminal UI ignored REASONIX_DISABLE_MOUSE, which the guide still
documents. It now reads it as 1.x does: 1 starts with the mouse handed
to the terminal, 0 captures it, and unset leaves capture off over SSH,
where the native selection reaches the user's clipboard.
Co-authored-by: BuGlessRB <[email protected]>
A tag is a mutable pointer: whoever controls the action's repository can
move it to new code and every workflow here runs it on the next event,
with this repository's token and on its self-hosted runners. A commit SHA
cannot be moved.
Each reference keeps its tag as a trailing comment, the form Dependabot's
github-actions ecosystem reads and updates. This lets the repository-level
"require full-length SHA" policy be enabled without failing studio runs.
With no recovery_model or guardian_model configured, the Goal evaluator
runs on the main model. A DeepSeek thinking model can stream its whole
answer as reasoning_content and finish with stop and an empty content
block. boundedllm.Call collected only ChunkText, so the evaluator got ""
and every goal paused with "empty goal evaluator response".
boundedllm.Config gains ReasoningAnswer. When a caller opts in and the
provider reports finish_reason=stop with no content, Call returns the
reasoning stream instead. A truncated stream still yields nothing, and
reasoning past MaxOutputBytes is refused only when it would become the
answer, so reasoning before real content is never charged. The goal
evaluator opts in because parseVerdict extracts the JSON object and fails
closed on anything else; free-text callers (advisor, prompt refine) keep
the content-only behaviour.
Test: TestEvaluateReadsVerdictFromReasoningOnlyStop fails on the base
with "empty goal evaluator response" and passes with the fix;
TestEvaluateIgnoresReasoningOfTruncatedStream and TestCallReasoningAnswer
cover the stop guard, opt-in and output budget.
Refs #9678
resolveSessionQuery reported a query that matched several sessions as a
plain sentence, so neither caller could recover which sessions matched:
`reasonix run --resume <q>` exited 1 with only a match count, and the
terminal UI refused to start the same way.
The ambiguity is now a typed ambiguousSessionQueryError carrying the
matched sessions. The headless start still exits 1 but lists each
candidate (last activity, the id --resume accepts, its title) followed by
a new AmbiguousResumeHint. The terminal UI, which already requires a TTY,
opens its session picker limited to those matches (tui.Options.PickAmong).
The narrowing belongs to that first picker alone: it is dropped whether
the first session fetch succeeds or fails, so a later /resume lists
everything.
The picker resumes the chosen session in place, so an ambiguous query
with --copy is refused up front with the same candidate listing rather
than opening a picker that would silently ignore --copy.
Tests: TestRunAmbiguousResumeListsCandidates drives runAgent with an
ambiguous --resume and fails on the base with only
`session query "session" is ambiguous (2 matches)` on stderr;
TestTUIAmbiguousResumeWithCopyIsRefused fails when the picker path is
taken with --copy set; TestPickerNarrowingEndsWithAFailedFirstFetch fails
when the narrowing is cleared only after a successful fetch;
TestResolveSessionQueryAmbiguityCarriesMatches and
TestPickerStartsOnTheGivenSessions cover the typed error and the
narrowed picker.
recall() kept no draft slot: up on a one-line composer overwrote the
text with the previous prompt, and down past the newest entry called
composer.Reset(). With any history present, a single down on a draft
that had never left for the history wiped it outright.
The draft is now set aside when a walk begins and restored when the
walk returns past the newest entry; down at the live position is left
to the textarea instead of resetting it.
Tests in internal/frontend/tui/recall_test.go: TestRecallReturnsTheDraftItLeft
and TestDownOnADraftKeepsIt fail on the base (the composer ends empty)
and pass with the fix.
Refs #10425
A CLI process that died from a panic on a background goroutine or a
fatal runtime error (out of memory, concurrent map writes) left no
evidence. runWithCrashCapture only recovers panics on the main
goroutine and nothing called debug.SetCrashOutput, so that output went
only to the console's stderr, which is gone once the terminal closes.
The CLI now mirrors runtime crash output into a per-PID file under the
Reasonix home. The next start turns any dump left by a dead process
into a pending crash report that keeps the runtime classification and
the sanitized goroutine stacks and redacts the panic value, and removes
the empty files of processes that exited without one. A panic already
reported through recover detaches the file first so it is not queued
twice.
Test: TestGoroutinePanicIsReportedOnNextStart re-runs the test binary
as a child that panics on a background goroutine, then asserts the next
start lists exactly one report with the panicking goroutine's stack and
no panic value. On the base it lists none.
Dispatch-only, so nothing a pull request writes runs on that machine.
The version is a prerelease one patch above the newest release, so the
build neither offers itself that release nor hides the next one.
A comment on a pull request needs pull-requests: write. A refusal that
is not a rate limit is final, so it fails the entry at once instead of
being retried for ten minutes.
A 1.x command line keeps working under 2.x: workspace-write is Auto,
danger-full-access is Yolo, and read-only, which 2.x has no mode for,
falls back to Ask. MIGRATING says where yolo's meaning differs.
Co-authored-by: BuGlessRB <[email protected]>
In 1.x a bare reasonix, or one given only session options, was the chat;
in 2.x it printed usage, so -c, -r and every muscle-memory command line
stopped at a help screen. In a terminal it now starts the terminal UI;
without one it still prints usage, since no one is there to chat with.
The terminal UI takes the rest of 1.x's session options: --effort,
--permission-mode (plan starts in plan mode, acceptEdits allows the write
tools), --yolo and --dangerously-skip-permissions, --add-dir,
--allowed-tools, --copy, --max-steps and the retired --profile. --yolo and
--dangerously-skip-permissions were listed as session options but nothing
read them. The usage text names the interactive form again.
The migration guide says 1.x 1.38.8 and later conversations now open in
2.x, where they are imported, how an import follows 1.x, and that the
machine session list shows them once imported. The roadmap marks W1b done,
which meets gate G2, and points W2 at its pull request.
1.x 1.38.8 and later keep every conversation in <project>/sessions-v4, a
directory per session holding a manifest and an events.frames log of
checksummed batches of zstd-compressed JSON, with large payloads and images
in a content pool beside it. 2.x did not list them, so a person moving from
npm 1.x found their recent history gone.
internal/state/sessionv4 reads that store and nothing else: it validates
each batch's framing and checksum, treats a batch without its end record as
a write in progress, resolves pool references by digest, and folds the
message events into the conversation 1.x shows, with origin "host" read as
HostAuthored and pooled images carried as data URLs. It takes no lock and
writes no byte under the root.
Session lists now include each v4 conversation that has no import yet, at
sessions/v4-<id>.jsonl, using 1.x's own listing cache when it still matches
the log. Opening that path imports the conversation there first, recording
its source; opening it again after 1.x continued it refreshes the copy only
while 2.x has not added to it. The name carries a prefix because 1.x takes
sessions-v4/<name> as the mirror of sessions/<name>.jsonl. Verified end to
end against stores written by 1.x 1.38.10 and main-v2 HEAD, on macOS and
Windows.
A reply batch needs one small job, and on GitHub-hosted runners it queued
behind every branch's CI matrix. The win-gpu runner takes only jobs that
name its label, so replies start at once and CI keeps its runners.
A batch of triage replies from a maintainer's own account runs into
GitHub's content-creation limit, which answers "submitted too quickly"
and stays closed for a while. This manual workflow takes a JSON list of
replies, posts them as github-actions[bot] under the repository's quota
at a steady pace, retries a refused comment, skips a reply already there
and closes the issues marked for it.
The migration guide said 1.x writes schema 2 from 1.38.2 on. It does so
only through 1.38.7; 1.38.8 and later keep conversations in sessions-v4,
which 2.x does not list. The guide now says where each 1.x version keeps a
conversation and which of them 2.x opens, drops the REASONIX_SESSION_LOG
step that 2.x reading schema 2 made unnecessary, and states that 2.x never
writes a 1.x session's files.
The roadmap records the direction the version announcement left open: the
gates that end 2.x pre-release in the same release that moves npm and
Homebrew, the planned weekly release train and update channels, the 1.x
feature and format freeze with maintenance ending 3 months after general
availability or at a backstop date, and splits the session work into the
done schema 2 half and the open sessions-v4 half.
1.x 1.38.2 through 1.38.7 save sessions in a schema 2 event log, an
append-only DAG of messages under named heads, and 2.x refused every one of
them with "uses schema 2; this build supports up to 1". 2.x now replays
that log read-only and materializes the head 1.x would open: parent chain,
patches, redactions and system override applied, and 1.x's origin "host"
read as HostAuthored so injected context stays out of the transcript and
the preview.
2.x never writes the log or anything beside it. A save that finds the
transcript unchanged stops with ErrSessionLogUnchanged, so opening a 1.x
conversation touches no file. Before a turn starts, and at any save that
has more than 1.x holds, the controller moves the conversation to a new
2.x session with the same title and says so; 1.x keeps the original byte
for byte. Verified against sessions written by a real 1.38.7 build.
Host-authored messages no longer count as a turn or become the preview,
and the event-log probe moves to its own file.
docs/MIGRATING.md was the 0.x to 1.0 guide and told a reader on the 2.x
default branch that main-v2 was the active line. It now covers moving from
1.x to 2.x: what the two lines share under one Reasonix home, which sessions
open where now that 1.x 1.38.2 writes a schema 2 log 2.x cannot read, the
REASONIX_SESSION_LOG=v1 switch that keeps a machine running both usable,
the commands that moved, and the steps to run 2.x beside 1.x.
docs/ROADMAP.md is the roadmap the version announcement (#10748) promised:
how 2.x ships, the terminal takeover that gates the release that moves npm
and Homebrew to 2.x, the remaining workstreams, and the decisions still
open. Both are owned by @esengine, and README links to them. The guide's
old prose debt leaves the repolint baseline.
1.x and 2.x share one session directory, and 1.x writes <id>.turns.jsonl
beside each transcript. 2.x classified it by its .jsonl ending and listed
it as a conversation of its own, so a machine that ran both showed a ghost
session for every 1.x conversation.
An Anthropic `error` event (overloaded_error and the like) that arrives
before anything was emitted left the provider as a plain
StreamPayloadError, so the Agent never replayed the attempt, while the
OpenAI provider already promotes the same pre-output payload error to
StreamInterrupt(upstream_error) (#10719). Apply that rule here: the read
loop's sink records whether a chunk reached the consumer, and only an
error with nothing emitted becomes an interruption. After output a
replay would show it twice, so it stays a payload error; the payload
identity survives the wrap for errors.As.
sendChunk moves into the sink so anthropic.go does not grow past its
size budget.
A disk catalog runs in WAL mode with no journal_size_limit, so after a
burst of writes the -wal file keeps its high-water size for as long as
the database is open (#10714). The limit is a per-connection pragma and
the pool opens up to MaxOpenConns connections, so it rides the DSN the
way busy_timeout and foreign_keys do rather than a single Exec that
would reach only one of them. 4 MiB leaves ordinary checkpoints alone.
Relays that re-serialize tool schemas emit `required: null` for an
object schema that omits "required", and the upstream validator rejects
the whole request with "null is not of type 'array'" (#10614).
context_budget is one such schema on this branch, and any MCP or plugin
tool may be another, so the fix sits in canonicalization rather than in
each tool: a root object schema gets an empty array when it has none,
including after an invalid non-array value is dropped.
This changes the tool block of the cache-stable prefix once (golden
ToolsHash/PrefixHash regenerated); the budgets rise by the bytes the
array costs: provider-visible 3700 -> 3708 tokens, built-in 6767 -> 6787.
Ctrl+V (Alt+V on Windows, whose terminals keep Ctrl+V for their own text
paste) reads the clipboard of the machine the terminal runs on. An image
goes to the kernel through /attachments and stands in the composer as
[image #N], sent as the @-reference it was stored under; without one the
clipboard's text comes in the way a terminal paste would, which is also
how a console without bracketed paste gets a paste folded.
internal/platform/clipimage reads the image through what each platform
ships: osascript, Windows PowerShell, wl-paste or xclip. A tool that cannot
say what the clipboard holds counts as offering no image rather than being
told apart by the words of its error, since either way the paste falls back
to text.
The inline renderer places a print by scrolling it in above a frame it
takes to sit at the bottom of the screen, and places each print from where
its last redraw left the frame. A restored conversation arrived as dozens
of prints with no redraw between them, on a screen the frame did not yet
fill, and landed interleaved with lines lost. A commit now goes out as one
print, split into pieces that fit above the frame with a redraw between
them, and a replay first fills the screen so the frame starts at the bottom.
The cancelled-turn, compaction, shell-busy, stream-reload and declined-
question lines now come from the i18n catalog.
Full screen, a shell call's output shows its ten-line preview with a
"more lines (Ctrl+B)" row, as in 1.x: Ctrl+B opens the newest one up to
200 lines and shuts it again, and a click on that row does the same. A
settled block keeps the row it draws, so opening it redraws only that
block. A drag held against the viewport's top or bottom row keeps
scrolling the selection until it leaves the edge or the transcript ends.
A bare -r opens the saved-session picker on the first frame, and /resume
opens it mid-chat, as in 1.x: typing filters, the open session is marked
and skipped by default, and choosing one binds the runtime to it through
/resume and reads it back. /resume and /mouse are offered in the slash
menu beside the kernel's commands. /sessions dates each entry, and moves
to its own file.
The TUI's event sink now carries the configured system notifications, as
the 1.x chat screen's did.
The transcript is drawn through its own viewport, as 1.x drew it: a
scrollbar in the last column, the wheel, PgUp/PgDn and Ctrl+Home/End,
dragging the thumb, and drag-to-select that copies on release. Settled rows
keep how to draw them, so a resize rewraps them. /mouse hands the mouse
back to the terminal for its own selection, and --inline writes the
conversation into the terminal's scrollback instead.
Users coming from 1.x meet the screen they know: the banner and tip, an
accent-framed composer with the ❯ prompt, the mode tag on its colored
ground, the footer's model/effort group and its cache, context, fold,
balance and cost row, a "本轮" usage line under each request, the ▎
thought marker, the ⎿ tool summaries, the To-dos panel, and approvals and
questions as selectable panels in place of the composer. Labels come from
the shared i18n catalog, so the screen speaks the configured language.
Shift+Tab steps ask, auto and plan; Ctrl+Y toggles YOLO.
The terminal UI reads as a product rather than a log: a welcome card names
the model and workspace, the composer sits between rules with a placeholder,
a running turn shows what it is doing and for how long, the status bar
carries a mode badge and a context gauge, approvals and questions are boxed
with their keys standing out, and the user's own lines are a band.
The theme is now read from config before the program starts; it was left at
the built-in default.
A message frame that arrives after the call which closed its answer now
settles that answer instead of appending a second copy, which printed every
answer before a call twice.
The page listed every model as a card to click for the primary model,
then drew the per-task roles as a second set of dropdown cards below it,
so choosing what runs where meant reading two layouts that said the same
kind of thing. The 1.x desktop app put this in one table, and #10761 asks
for its layout back.
Each use is now a row: what it is for, a select of the models that can do
it grouped by service, and the service that model goes through. The
default model's row also lists what that model declares: image input,
adjustable reasoning, context size. Roles that follow the default say so, and
decision says it has no source rather than offering chat models. The two
settings rows it replaces become one, 按用途选择模型; reasoning effort
and context upkeep stay below it.
The card list and the role picker are gone with their styles. The
services page now works out its default selection while rendering, so
it no longer flashes an empty detail before the selection lands.
Settings kept every model setting on one long page: the source list with
an editor that unfolded inside it, the primary-model list below that, and
roles and context after. Adding or changing a service meant finding the
right row, opening it, and scrolling past the rest. The 1.x desktop app
split this into 模型服务 and 模型偏好 with a list-and-detail layout, and
users asked for that back (#10761).
模型服务 is now its own section. Services are listed on the left, with a
search once there are six or more and 添加模型服务 at the foot; the
selected service's fields are open on the right without a second click,
and adding a service takes the right side while the list stays in
place. The page opens on the service in use, or on the one the composer
sent the user to declare effort levels for. At narrow widths the list
stacks above the detail.
The remaining section is renamed 模型偏好 and keeps the primary model,
reasoning effort, per-task models and context upkeep. The composer's
manage-models entry, its effort-declare link and the palette entry now
open 模型服务.
The composer's permission menu and Settings each kept their own table of
the four approval modes, and they drifted: the menu called ask 逐项确认
and auto 自动继续, Settings 询问 and 自动, the shelf 自动批准, and the two
lists ran in different orders. Users read the menu's 逐项确认 as a mode
Settings did not have.
approvals.ts is now the one table. Menu, Settings and shelf all say
不询问 / 询问 / 自动批准 / 全部放行, ordered from strictest to most
permissive, with the same descriptions.
In a narrow conversation pane the menu opened rightward from its trigger
and ran off the screen. There it now spans the toolbar row instead.
- Questions: an open ask is answered one question at a time. A digit
answers a single choice or toggles a multi choice, typed text joins the
picks as an answer no option offered, Esc declines with nothing
selected. The card left in the scrollback says what was answered.
- Completion: `/` at the start of a line and an `@` token open the
kernel's menu as they are typed, Tab asks anywhere. Offsets cross
/complete in UTF-16 both ways, so a line with CJK before the token
splices where the kernel meant; a directory keeps the menu open a level
down.
- The task list is re-read from /todos when the kernel says it moved and
drawn while it has work left; a finished list goes away.
Found running against a real model: a thought-only step and whitespace-only
answers printed an empty speaker header; option and menu rows lost their
indent to the row-shortening helper; the receipt read the verdict "done"
as unfinished.
A `!` command ran and was shown, and the model never saw it: the next turn
had no idea what the user had just looked at. RunShell now follows the
command with a turn whose input is the command, its exit code, any launch
error and its output, so the model responds to it the way it would to a
line typed to it.
The output is bounded at 24 KiB, cut from the middle with the cut said, so
a large listing neither fills the context nor reaches the model looking
complete. A command the user stopped is not followed by a turn, and neither
is one run where no model is attached. The ACP `!` prompt now ends after
that answer.
Expanding a folder in the explorer walked the whole workspace and kept
the entries whose parent matched, so one folder the process could not
read anywhere in the tree failed every expansion with a 500, and a large
tree made every click slow; the root listing, which skips into nothing,
kept working, which is why the list drew and its folders never opened.
The explorer drew that error in the file view's slot, which the docked
file list hides, so the click looked like it did nothing.
A folder listing now reads that folder alone, and its real path is held
inside the workspace so a link cannot list what is outside it. A search
still walks the tree and passes over a folder it cannot read. A missing
folder answers 404 workspace.file_missing, a linked-out one 400.
The explorer now shows its own failures in the file list. Reloading the
tree, which happens when the changed files change after a turn, reads
the folders that were open again, where it used to fold them all shut.
Checked on Windows against a workspace with a folder denied by ACL: the
folders beside it open, the denied one reports in the list, and an open
folder stays open through a reload.
The second layer of the terminal UI: the program a person operates, on
top of the client, stream and transcript.
- `reasonix tui [--model] [--preset] [--dir] [-c] [-r QUERY] [prompt]`
assembles the kernel the way `reasonix serve` does, adopts it into a hub
and drives it through Hub.InProcessClient: no port is opened. The kernel's
logging goes to ~/.reasonix/logs/tui.log while the UI owns the screen.
- Rendering keeps the terminal's scrollback: every settled row goes above
the program in the order it happened, and a streaming answer's finished
Markdown blocks go as soon as they are final (nothing inside an open
fence). What is still changing stays in a live region capped at half the
screen, each row cut short of the terminal width so none wraps into a row
the renderer does not know it drew.
- Input: Enter sends, or queues while a turn runs; Ctrl+S steers; Ctrl+J
(or Shift+Enter where the terminal reports it) is a newline; Esc
interrupts; `!` on an empty line is shell mode; Shift+Tab cycles the
approval mode; Ctrl+C twice or Ctrl+D on an empty line quits. Large pastes
fold into a token and go to the model whole. Approvals take only the
answers the host says it honours; plan approvals map to start, revise or
leave.
- The transcript seats a turn on the message it began on, the way Studio
does: a queued follow-up moves to where its turn started, steered input
waits for its steer event, and another client's turn is drawn once from
the kernel's text. Restore rebuilds from /history for -c/-r and after a
stream gap.
cli.go's argv normalisation moves into normalizeCommand so the dispatch
switch keeps one case per command within its complexity budget, and `tui`
joins the shell-completion registry.
The theme, colour profile, Markdown/math renderer, tool cards, diff view,
assistant block and clipboard writes move out of internal/frontend/cli into
internal/frontend/termrender, so a terminal frontend other than cli can draw
the same bytes without importing cli. cli now calls termrender for every
style, width, box and Markdown helper; view_helpers.go stays in cli.
termrender exports the surface a frontend draws with: Bold/Dim/Green/Red/
Yellow/Accent/Reverse, VisibleWidth/PadRight/Boxed, ConfigureTheme,
ConfigureThemeFromConfig(ForTTYOutput), ActiveTheme/ThemeName and the
ThemeStyle/ThemeFg/ThemeLipColor/ApplyTextareaTheme helpers over an exported
Palette/Color, RenderMarkdown and MarkdownRenderer, AssistantBlock, ToolCard/
ToolDot/ToolHead/ToolArg/ToolDisplayName, DiffBlock/DiffStat, CopyToClipboard
with ClipboardCopyMsg, ANSIConsoleReady and SetColorProfile.
Transcript helpers nothing calls (edgeScrollDir, selSpan, scrollbarThumb)
are dropped with their tests, and the clipboard message loses the seq and
status-hint fields no caller set. The metadata-command test now asserts that
version/help never reach the TTY theme setup, through a cli-side seam, since
the terminal probe it used to swap is termrender's.
The repolint baseline diff is the moved files' prior essay debt carried to
their new paths (mathnode.go, md.go, width_test.go; transcript.go's is paid
off), plus orphan budget for the eight exports whose consumer, the new terminal
UI, is not in the tree yet (ToolCard, DiffBlock, AssistantBlock,
RenderMarkdown, CopyToClipboard, ApplyTextareaTheme, ThemeName) or which only
a cli test drives (SetColorProfile). Wiring the UI reclaims that budget.
normalizeNullRedirects treated a backtick as an escape inside any quote,
so in echo 'a `' >nul the backtick swallowed the closing single quote,
the string never ended, and the real >nul after it was left alone; under
bash that writes a file named nul. Single-quoted text is literal in both
bash and PowerShell, and the backtick is PowerShell's escape only inside
double quotes, which is where the backslash case already applied.
The new cases also cover the escaped-quote branches, which had no test:
the sandbox package fell to 77.6% against its 78.1% coverage floor on
the lint job, three statements short.
fc3a44dbc moved jobs from internal/runtime to internal/tools, and the
pull-request race step still listed ./internal/runtime/jobs/..., so every
pull request's race job failed with setup failed on a directory that no
longer exists. Pushes run the full ./... sweep and never saw it. Every
other path the workflows and the Makefile name still exists.
* fix(pricing): bill Chinese public holidays as DeepSeek off-peak
Port of the main-v2 holiday fix (#10756) to the studio pricing package,
which moved from internal/billing to internal/contract/pricing and now
carries the peak schedule in PeakWindow. The holiday table rides the
same struct field pattern as WeekendOffPeak: PeakWindow.HolidayOffPeak
lists Beijing-local dates off the State Council 2026 notice, and
IsPeak flattens them like weekends. Make-up workdays (调休) stay
off-peak: they are calendar weekends, which is how DeepSeek rules them.
* chore(pricing): keep the holiday comments within the repo's comment rules
English only and within the essay budget; no behaviour change.
---------
Co-authored-by: nanami-0713 <[email protected]>
Co-authored-by: yhh <[email protected]>
The first layer of the new terminal UI, which drives a session through the
same HTTP/SSE contract Studio uses and imports nothing from the controller:
- Client: typed calls for the routes a chat needs; a refusal carries the
kernel's code (APIError), never only its sentence.
- Subscribe: /events with Studio's ordering — numbered frames delivered once
and in order, a jump filled from /events/replay before the frame that
revealed it, what the replay no longer holds reported as a gap, a
backwards count read as a restarted stream, a reconnect resumed with
Last-Event-ID.
- Transcript: the fold of Studio's session reducer — the settled message
repairs the streamed answer, one card per call with sub-agent calls under
their task, prompts settled here or by the kernel's receipt, pending input
moved to where the turn read it, and turn_done saying which of four ways
the turn ended.
An end-to-end test drives a real kernel behind an in-process hub through a
turn that streams, waits on an approval answered through the client, runs a
command and ends settled.
The editor is a frontend in the kernel's process, like the terminal UI
the in-process serve client exists for. A prompt that starts with `!` now
runs through RunShell instead of going to the model: it streams back as a
tool call and ends the prompt when the command finishes; cancelling the
prompt cancels the command.
Hub.InProcessClient reaches the hub's routes with no listener: a frontend
in the kernel's own process opens no port, so there is nothing on the
machine or the network to authenticate against. Responses stream through a
pipe as the handler flushes, so /events works through it.
A `!` line on /submit is the user's own shell command, which runs
unconfined. It stays refused off a socket (shell.unavailable_over_http);
through the in-process transport it runs. The transport marks the request
context itself, and no request read from a socket passes through it, so the
grant rests on which way the request came in rather than on anything it
carries.
Every ended job drew the same green pip and printed the kernel's raw status
word. Only done is green; failed is red, killed and interrupted are neutral,
and each is labelled in the reader's language.
The background-jobs deck listed jobs with no way to stop one: the controller
had CancelJob, but no port carried it and serve had no route. BackgroundJobs
joins SessionAPI, POST /jobs/{id}/cancel drives it and refuses a job that is no
longer running as job.not_running, and each running row gets a stop button.
On touch the deck could not be closed: it opened on :hover and :focus-within,
which a tap leaves set, so the chip's own toggle had no effect. Hover opening
is now limited to hover-capable pointers, and a press outside or Escape closes
it; the context card gets the same treatment.
The meter rail did not fit a phone: the chip ran past the edge, and tapping it
scrolled the overflow-hidden .app sideways, dragging the composer with it.
Narrow panes drop the sparkline, wallet, speed and (narrowest) cost readings,
the two popovers position against the rail instead of their chips, and .app
clips rather than hides so focus can no longer scroll it.
perf/composer.mjs counts only visible peers as overlapping the model button.
bypassed() matched only exact entries and a leading "*". The bypass list
Clash, v2rayN and xray write by default is `<local>;localhost;127.*;10.*;
...;192.168.*`, so every trailing-wildcard entry missed. It also lacked
WinINET's implicit rule that loopback goes direct unless `<-loopback>` is
listed.
In the default auto mode, on Windows with such a system proxy, requests to
local and LAN model endpoints went through the proxy: Ollama or LM Studio
on 127.0.0.1, vLLM on 192.168.x. That added a hop, failed outright when the
proxy routed to a remote exit, and made a cancelled stream keep the local
model generating. Cancel closed only the client-to-proxy hop, and the proxy
held its upstream connection open.
"*" is now a wildcard anywhere in an entry. Only "*" is special, and
brackets are trimmed from IPv6 entries. localhost, 127/8 and ::1 bypass
unless `<-loopback>` is present. TestBypassed gains the trailing-wildcard,
near-miss, mid-pattern and loopback cases; it fails on 8 of them without
the fix. The same change lands on main-v2.
The CLI had no install channel on the 2.x line: release-studio.yml builds the
CLI archives for Studio's remote installs, and npm's `reasonix` and the
Homebrew tap were published only by the retired 1.x release machinery. The
2.x line now takes both over, and 1.x no longer publishes the CLI.
A cli-channels job runs after the release is published:
- npm: the existing npm/build.mjs builds the per-platform packages and the
launcher and publishes them through publish.mjs's staged dist-tag flow. A
2.x version outranks every 1.x one, so `latest` moves to it; a candidate
goes to `next`.
- Homebrew: scripts/render-brew-cask.sh writes the cask from the digests in
the release's own SHA256SUMS — a missing digest fails the render rather
than shipping an empty one — and the job pushes it to
esengine/homebrew-reasonix. Candidates leave the tap alone, since brew has
no prerelease channel.
The Studio release carries the CLI archive too, listed first. Double-clicked
from Explorer, bare argv printed the usage and exited, and the console window
Windows opened for it closed with it, which read as a crash. When this
process is the only one attached to its console, it now names Studio's
installer and waits for Enter; from a shell nothing changes.
The usage examples dropped bare `reasonix`, `--continue` and `--resume`, which
only print the usage on this line.
LAYOUT.md: three list items split to stay under the prose width.
Every workspace holding a warm runtime drew a raised box, so four rows read as
four selections and people asked how to close them; the kernel already retires
idle panes at capacity. Only the workspace of the active session keeps its
emphasis, and a session held by a pane keeps its pip.
The project row's × removed the project from the list but sat next to + where
it read as "close". It is now a ··· menu (workspace.menu) whose one item leads
to the existing confirm.
The coverage job installs no bubblewrap, so an enforced bash sandbox refused
the background job and the test read no job at all. It measures how a job's
end is attributed, not where it runs.
Product:
- Tool cards wrap their head in details.tool-disclosure, so the hit highlight
and the failed-call peek never matched them; both selectors now reach it.
- Light --faint fell below AA on every raised ground and overrode the tiered
tokens; darkened by lightness only. Segments and the new-task shortcut sit on
--overlay and read --muted. Hard-coded crumb separator, delta and failed
state colours now use tokens; the approval tool tag uses --warn-ink, the
running step reads a darker --net, and the failure pill mixes its ink
towards --text so it clears AA in both schemes.
- The local workspace row's remove control is the same Cross icon the remote
rows already draw, not a text glyph.
Guards: retargeted to the current markup (model picker trigger, tool
disclosure head, context card MCP rows, wallpaper section, queue and plan
controls), dropped checks for the removed task board and focus mode, and the
wallpaper reach is measured with the dim overlay cleared. All 22 exit 0 and
selfcheck shows each can still go red.
Run — the synchronous turn `reasonix run` drives — never took the turn gate
the guarded paths check. A turn admitted through the gate, such as the
inbox delivering a background job's end, could therefore start on the same
executor while Run was mid-turn, and the two wrote the task state together:
the race TestEffectRestartNamesWhyABackgroundJobEnded tripped on CI.
Run now admits through runSynchronousTurn, as RunTurn does, and waits out a
turn already in flight rather than failing: after a resume the host may
dispatch a job's interruption before the caller's first Run. Its turn
completion is recorded once, by the admission, instead of twice. Cancel()
now reaches a headless turn as it does any other.
The restart test's scripted model started a new job on any turn it did not
recognise, which the interruption delivery now visibly is; it only
acknowledges such turns.
Run against studio's own stylesheet, the browser guards reached parts of the
window they had never measured.
- A collapsed column is inert, not only narrow. The rail was inert only in
focus mode and the workbench never, so Tab walked into controls nobody
could see and scrolled a column of zero width to show them. Both are inert
while collapsed, and the workbench stops painting once its collapse ends.
- Focus mode is gone. Its only way in was removed with the side column in
the studio redesign; the state, the Escape branch, the action id and the
layout notes that described it are removed with it.
- The queue's withdraw control lost its enlarged hit area when it moved from
the transcript into the queue panel: 19px tall. It gets the outward
::after back, 29px.
- Switching to the run analysis gave the transcript and the docked workbench
the same view-transition name, so the browser aborted the transition and
the rejection went uncaught. The docked workbench no longer takes the
name; it keeps it when it is the tab being switched to. A transition the
browser skips is not an error.
- The studio composer's own chrome is taller than the one the queue's
shared ceiling was set against, so 64 queued lines left the transcript at
36-39% of the pane. Studio lowers the ceiling (28vh, 19vh when short) and
the transcript stays above 40%.
The egress grant test sat between TestEverySubjectSensitiveToolActuallyAsksSomething
and its comment, which read as one six-line block. Windows has no /tmp and no
sandbox that reaches the proxy on a socket.
On Linux the list only warned: bubblewrap either kept the command's network
namespace (no network at all) or dropped it (all of it), and a separate
namespace cannot reach a proxy on the host's loopback.
The command now keeps its namespace, which has no route out. The egress
proxy also listens on a Unix socket under the user's cache, mounted
read-only into the sandbox, and the host binary runs inside the namespace
as the egress bridge: it listens on the namespace's 127.0.0.1:<proxy port>,
carries each connection to the socket, runs the command, and returns its
exit status as a shell would. HTTP_PROXY and friends need no change. The
bridge is an entry of whatever binary imports the sandbox package, chosen
by an environment variable it clears before the command starts, so no
helper has to be shipped or found.
The host's own loopback is out of reach from the namespace, so a local
proxy cannot be used to go around the list. A route with no socket keeps
the namespace shut rather than falling back to open.
The bridge's forwarding and exit status are tested on any Unix; the
namespace boundary and the end-to-end refusal and approval run where
bubblewrap is usable (Linux CI).
A host the egress list does not name was refused outright. Where the
frontend can ask, the proxy now holds the connection and asks through a
network_egress approval whose subject is the host: allow once (for that
command), allow for the session (that host only), or decline. A declined
host reaches the model as declined-by-user rather than blocked-by-allowlist.
- network_egress is declared subject-sensitive in permission, so a person
answers whatever the approval mode, an unattended session refuses, and a
session grant names the host it covers. Before that declaration a grant
for one host answered for every host after it.
- The controller's sandbox approver also answers ApproveEgress; bash finds
it on the tool context the escape approver already rides, so nothing
below the controller grew a new channel. Headless runs have none and keep
refusing.
- Each command asks once per host, one question at a time, and a token's
asker ends with the command. Denied hosts are never asked.
The guard asserted that the border glow runs while a turn runs; studio's
design removed that glow, and its running signal is the run mark's R being
traced (studio-r-run). The three directions stay: still at rest, moving
while running, still again after.
It also flagged the mark's straight stroke as drawn on nothing, because an
SVG shape's box leaves out its stroke and a straight line has no area. An
SVG shape is now judged by its drawing's box.
In the light theme the new-session button and the session filter segments
were separated from the sidebar by fill alone, a 1.8 step in OKLab
lightness, and the button had its border removed: neither read as a layer.
Both now mix 3% of the text colour into their fill, in light only.
Each session row reserved 34px of its title for the menu button and drew
the button at zero opacity until hover, so every title was cut short for a
control nobody could see. It now rests at 35% and comes up on hover, focus
and selection as before.
In a conversation narrower than 460px the ask card's actions stack, and they
stacked in DOM order: "reply without choosing" above the primary answer.
The approval card already leads with its main action there, and the cards
guard holds both; the primary button now takes the first row.
The refine button is disabled until there is a draft, yet its icon still
showed a pointer and it lifted on hover, reading as something to press.
A disabled mode button keeps its tooltip but takes the default cursor and
does not lift.
Network in the bash sandbox was one bit: open to everything, or shut. With
[sandbox] allowed_domains set, bash's external traffic goes through a
host-side proxy (internal/safety/egress) that admits only the listed hosts;
denied_domains outrank them.
- The proxy serves CONNECT and absolute-URI HTTP on loopback, decides from
the requested name, refuses names that resolve only to loopback,
link-local, metadata or this host's own addresses, and chains through the
upstream HTTP or SOCKS5 proxy the environment names.
- macOS: the Seatbelt profile shuts every destination but loopback, Unix
sockets and the proxy port, and closes the loopback ports of the proxies
the environment and the system proxy settings name. Loopback stays open
so tests and dev servers keep working. Bind, inbound and outbound are
separate grants, because (local ip "localhost:*") on network* matches the
local end of every outbound connection and admits all of them.
- Each confined launch carries a token as proxy userinfo; what the proxy
refused under it is appended to the bash result by the host, so a policy
refusal reaches the model as one instead of a bare connection error.
- The list only narrows open network: it applies where network is on and
the sandbox confines; a repo may set one only where the user has not, and
its denials only add to the user's.
- Linux and Windows warn that the list is not enforced there.
Known gaps, stated where they live: a host proxy on a loopback port nobody
declared stays reachable, name lookups still reach the system resolver,
the decision reads the requested name (domain fronting is not caught), and
MCP servers are not routed through the proxy.
internal/safety/egress is declared sensitive, with its coverage floor.
The window's error bar sat in the main column under the panes: every failed
request pushed the composer up by the bar's height, as a full-width strip at
the far end of the screen from most of what fails.
It now floats. The pane in front carries it on a zero-height anchor pinned to
the top edge of its composer card, at the right: it never moves the
conversation, rises with the card as the prompt grows, and stays clear of
the send button. With no pane on screen it takes the main area's corner. Its
fill is mixed into the surface, since it now sits over content.
perf/errbar.mjs holds the geometry at two widths: the bar appears and takes
clicks, sits above the card, leaves send clickable, and does not move the
composer. It reaches the bar the way a real failure does, through a hub
method the bench can now refuse. Against the old in-flow bar it fails on the
composer moving 45px and on the bar sitting below the card.
main.tsx has loaded studio.css since the studio interface landed, and the
perf harness never followed: every browser guard since has measured a page
without the studio layout, with the composer at the top of the window and
the sidebar unstyled. Run against the real layout, fifteen guards still
report failures; four of them (cards, idle, press, surface) were passing
only because the layout was missing, and contrast and pick stop failing.
host_authorities is user-global: loadForRoot holds the user's value and puts
it back after the project reasonix.toml merges. The held value was the slice
header, and decoding the project file writes into the backing array the
user's decode left behind, so the held copy read back the repo's list. A
cloned repo declaring host_authorities = ["docker"] got the container daemon
socket inside the bash sandbox — with an explicit user grant and with the
default one alike.
The held value is now a copy.
RewrittenTestCriteria read Go test files only, so a Python run that moved
its own expectation reached the completion summary, the best_of_n judge and
the integrity bench with a clean record.
pytest modules are now read by pytest's default collection contract
(test_*.py / *_test.py, module-level test* functions, test* methods of
Test* classes). Bodies come from Python's own line structure — the
indentation stack, bracket joining, whole strings — and compare as token
signatures, so reformatting, comments, docstrings and formatter trailing
commas do not read as rewrites while a changed expectation or parametrize
case does. Source that does not lex claims nothing.
Detection only: holding a criterion is still Go-only, now enforced at
captureRewrittenCriteria too, because no backend re-runs a captured Python
test and holding one would owe the turn a baseline run nothing can settle.
Opening the card refreshed the share status and, in the same commit, minted
a pairing code on the status it already held. When phone access had been
turned off elsewhere since, the mint reached the kernel first and was
refused as share.closed, and the window's error bar told a person who had
only opened the card to "turn phone access on first".
Opening now waits for the read and mints only when the door is open and no
live code is held. A failure inside the card is said inside the card, under
its header, and clears when the card closes, rather than landing in the
window's error bar at the far end of the screen.
Each candidate kernel already emitted a CompletionSummary at turn end —
verdict, checks passed/failed/suppressed, review, gaps, and existing tests
it rewrote or removed — but the candidate sink forwarded usage only, so the
judge compared attempts on their final message and diff alone.
candidateSink now keeps the last summary per attempt; the judge sees it as
a host record the attempt cannot write, and the parent's report carries it
per attempt. A failed check counts against an attempt, and one that
rewrote tests the task did not ask to change is suspect however green.
Discovery searched /Applications as a literal, so the tests that stand for a
machine with no editor could not build one: on a Mac with VS Code installed
TestDiscoverRefusesWithAnIdentityWhenNothingIsInstalled found it,
TestInstalledPathsAreSearchedBeforePath found it before the placed copy, and
serve's TestEditorOpenSeparatesMissingFromFailedToStart launched it against
a controller with no workspace and got a 500. CI runners have no editors, so
all three were green there and red on a developer's machine.
Discovery now reads the machine through a host value: the OS, the
environment and the system application folder. Discover passes the real
one; the editor tests pass an empty folder. The serve test no longer tries
to empty the machine at all: an editor the user configured that does not
exist is the missing class everywhere, and it reaches the same refusal.
The sidebar's version rows had no rendering test: the expander, the label
and opening the version's own path are now exercised through the real
Workspaces component.
The lease-alignment race posted to /fork, removed with explicit forking, so
half of it only collected 404s. /new rotates the active path through another
handler, which is what the race is for.
Editing an earlier message, regenerating a reply and rewinding the
conversation all truncate the transcript, and only the latest one could be
undone. What was said before the cut was gone.
A conversation rewind now saves what it is about to cut as a version of the
session: a whole session file, marked Superseded with the session as its
parent, left out of every session list so it never reads as a second
conversation. The Studio sidebar hangs versions under their conversation in
the same expander as recovery copies, labelled apart, and each opens as a
whole conversation. A version someone carries on becomes a conversation of
its own: the first save that adds a turn clears the mark and keeps the
parent. Undoing a rewind drops the version that now duplicates the restored
conversation, judged by content so it holds after a restart. Removing a
conversation removes its versions. Keeping a version is a record, not a
precondition: a rewind that cannot keep one still happens.
NewSessionPath moves to session_path.go to keep save.go inside its budget.
Closing the manager cancelled every running job the same way kill_shell
does, so a job read after a restart came back as killed. Nobody killed it:
the process running it ended, which only the host knows, and a bare "killed"
left the model to guess between that and a stop someone asked for.
A job cancelled because its manager is closing now ends Interrupted, the
status an abandoned record already repairs to, and one stopped by Kill stays
Killed. bash_output and wait render the cause after an interrupted status.
The tool descriptions are unchanged, so the cached prefix does not move.
The boot-level restart test starts a background job, restarts, and reads
it: a restart cannot keep the job alive, but the model is told why it ended.
Status and its cause move to status.go.
The store kept pending results in memory and removed every worktree when the
session closed. A restart between delegating an isolated task and applying
it lost the work, and the refusal that followed said no result was pending,
a claim the host could not know was true.
The worktree is now the result and the store only indexes it. A finished
run writes an entry mark beside its worktree naming the id, the workspace
and the snapshot; what it changed is derived from the worktree on every
read, so no stored tree can outlive the objects it names. A lookup the
memory misses is recovered from disk, closing a session no longer removes
anything, and a result ends only when applied or discarded. Results taken
from another workspace are never offered, since applying one would write
into that workspace from this one. Unsettled results older than fourteen
days are swept at boot, and only directories carrying the mark are touched.
The boot-level restart test delegates in one turn and applies in the next,
with and without a restart between them, and both arms now land the file.
A goal resumed after a restart re-demanded inspection, verification and
sign-off for a change that had all three before the process ended: their
receipts lived in the ledger, which does not cross the boundary. It was
fail-closed but not restart-equivalent, and every restart cost a re-run.
The delivery checkpoint now carries Proven: what the turn's last readiness
verdict had proven for the pending change, with a content fingerprint of
every path the scope changed. On resume, with no new write in this process,
the proof discharges what it covers, but only while every path still holds
the content it was earned on. A path edited or deleted while no process was
watching voids all of it, which is more than an uninterrupted run can see.
A change with a part the host cannot name carries no proof at all.
The verdict is recorded where the turn asks to stop, so the checkpoint reads
the same derivation the gate used rather than a second one. The Delivery
branch of the readiness check moves to appendDeliveryGaps to keep the
function inside its complexity budget. The restart harness no longer pins
any stricter step: both arms now owe exactly the review.
The repository now describes the two lines the version roadmap announced
(discussions/10748): 2.x on studio, 1.x on main-v2 in maintenance.
- README (en, zh-CN): a Versions section and a Studio 2.x release badge.
Install leads with Reasonix Studio 2.x from the studio-v* pre-releases,
with the 1.x CLI and desktop app beside it as the stable line. The
zh-CN build-from-source section gains the Studio build it lacked.
- Issue forms offer 2.x / 1.x / 0.x, and the labeler maps them to v3 /
v2 / v1, with the pasted version still overriding the dropdown. The
forms link the roadmap. The PR template and CONTRIBUTING say which
branch takes which changes.
Issue forms, schedules and Dependabot are read from the default branch
only, so these take effect when studio becomes it:
- CodeQL scans pushes and PRs on both lines, and the weekly scan checks
out each line and files results under its own ref, so 1.x keeps its
security scanning.
- v1-maintenance-schedule starts main-v2's nightly app-memory and
diagnostic-overhead monitors, which measure the 1.x desktop app, on
main-v2.
- Dependabot drops /desktop/frontend and /site, which do not exist on
studio, and covers /desktop/frontend-next and /desktop/electron. It
also names main-v2 as a target for patch updates only.
layer-order ranked model, tools, safety, ext, state and platform as one peer
pool that could import freely inside itself, so state -> tools or
model -> platform passed the gate and nothing held the directory graph
acyclic. The pool is split into the order the tree already follows
(safety/state, model, platform, ext/tools), and a package now imports only
its own directory or a strictly lower rank. The tree needed no change.
The structured review a high-risk change owes was derived from mutation
receipts in the evidence ledger, which has no persisted form. A goal
restarted between its turns resumed with an empty ledger, derived nothing,
and completed without the review. The restart-equivalence tests showed it
through the real boot and the controller's own resume.
The delivery checkpoint now carries OwedReview: the review kinds a change in
its scope still owes and the paths a review has to cover. Each turn's
checkpoint joins what the live ledger derives with what was carried in and is
still unsettled, so a restarted ledger deriving nothing is never read as a
discharge. The gate owes a carried review until a review of that kind covering
those paths lands; one kind does not settle the other. The live derivation is
unchanged and shares one helper with the checkpoint, so an uninterrupted run
is held exactly as before.
The restart harness now fails any step where a restart owes less than an
uninterrupted run. What a restart still re-demands — inspection, verification
and sign-off, whose receipts do not cross the boundary either — is fail-closed
and pinned as known, and the boot-level test asserts both arms end blocked.
The production form of the restart-equivalence harness: two real boots, the
session resumed from its file the way --continue does, and goal turns
submitted the way a window submits them, so they carry the goal's delivery
scope. The scripted model acts on milestones rather than turn counts, and
every reply spends budget, so a goal that cannot finish stops on its own
token budget as a real one does.
A high-risk change (a path the project declares sensitive) is made, checked
and signed off, with no review. Uninterrupted, the goal stays blocked and the
host keeps demanding the review. Restarted between its two phases, the
resumed goal is never asked for one and completes. Each arm run in its own
process gives the same result, so no package state carries between them.
The review obligation is derived from mutation receipts in the evidence
ledger, which has no persisted form: the goal sidecar carries only the
DeliveryCheckpoint. The case is pinned as a known divergence so the fix turns
it red.
Past IndexMaxChars the listing was cut mid-rune: with 91 skills only 35
lines survived whole, the other 56 were invisible to the model, and the cut
could leave half an identifier to call. The listing now degrades to names
only, cut whole-line with a count of what it left out, and points at
use_capability search for descriptions. A catalog under the cap renders the
same bytes as before.
No per-turn retrieval over the user's wording: ranking by prose would hide
skills inside a gate. The model asks through the existing capability search,
whose keywords now include the triggers a skill's author declared.
Stopping the process at a turn boundary and resuming must leave the host
deciding exactly what it would have decided had it kept running. The harness
plays a scenario twice, once in one agent and once through a restart after a
chosen step, and compares the readiness verdict of every step. The restarted
arm is built as a resume builds it: a fresh agent with an empty ledger, the
transcript, and the DeliveryCheckpoint after a JSON round trip, which is all
the goal sidecar carries; the controller's own restore of that checkpoint is
established by goal_resume_project_check_test.
A signed-off ordinary change agrees across a restart. A high-risk change does
not: the uninterrupted arm owes structured_review at every later step, while
the restarted arm owes re-verification and sign-off instead, and once those
are redone it finalizes with no review at all. The review obligation is
derived from mutation receipts in the ledger, and the ledger does not cross
the boundary. The case is pinned as a known divergence, so the fix turns it
red and takes the mark off.
With [agent] worktree_isolation on, task takes isolation "worktree". The
sub-agent then runs as an unattended kernel of its own, rooted at a fresh
worktree of the workspace as it is now, and nothing it writes reaches the
workspace. Its result lists the changed paths under an iso_ id, and the
parent settles them with apply_isolated or discard_isolated.
apply_isolated declares every path it writes, so the host reserves,
checkpoints and records them like any other write, and it applies path by
path: a path the workspace changed meanwhile refuses the whole apply by code
and keeps the result. A workspace git cannot snapshot is refused with
isolation.not_git; isolation is never faked with the shared workspace.
The child runs under the session's own approval posture, read when it starts.
It has no one to ask, so a session that asks gets a child that refuses what
needs approval, and nothing it does exceeds what the session would do
unattended. Arguments a separate kernel cannot honour (profile, tools,
write_paths, continuation, background) are refused rather than dropped. The
child offers neither isolation nor best_of_n, and the settlement tools are
hidden from sub-agents. Closing the session removes every worktree it holds.
best_of_n's attempt runner is shared as runUnattended, and task's name,
description and schema move to task_schema.go.
The host observes a write through Previewer, which describes one file. A
writer that changes several paths named nowhere in its arguments was left an
opaque writer: a coverage gap on the checkpoint, no preimages, and a receipt
with no paths, so neither rewind nor the evidence ledger could say what it did.
tool.WritePathDeclarer lets such a writer name every path before it runs. The
host reserves exactly those paths against background writers, captures each
one's preimage and after-fingerprint, and records them on the receipt. A code
rewind then restores a modified path and removes a created one.
Apply refuses unless the whole workspace still equals the snapshot, which
holds for best_of_n, where the parent waits, and never for a candidate that
ran beside a parent that kept editing. ApplyPaths judges each changed path
alone: the workspace's version is hashed through the same filters a snapshot
stages with, and compared against the snapshot's blob and the candidate's.
A path still at the snapshot is written, one already at the candidate's
version is left alone, and anything else is a conflict. One conflict writes
nothing, and the ConflictError names every path.
ChangePaths refuses a change outside the folder the snapshot was taken of,
and DiffStat gives per-path line counts for reporting a candidate.
tools/list, resources/list and prompts/list took the first page and ignored
nextCursor, so a server that paginates lost every tool past its first page
without any error. The three now read every page through one helper, bounded
at 64 pages; a cursor handed out twice is reported as a server loop rather
than served as a complete catalog.
The readiness gate read only the checks the current process declared. A Goal
restored into a process whose declaration had changed carried its captured
baseline in the delivery checkpoint, but nothing enforced it, so running the
replacement alone was enough to finalize. The Goal resume path was shown
reachable by goal_resume_project_check_test.
The gate now also owes every baseline check no current declaration names,
inside the delivery scope that captured it, anchored on the same write the
gate already uses. The trust-domain rule settles the authority question: the
workspace cannot supersede a captured criterion.
The full switch to ledger obligations is not taken: a resumed process starts
from an empty ledger, where the obligations owe nothing at all, so the switch
would open the resume path this closes. A restored checkpoint from another
scope does not bind an unscoped turn.
The 2.20.0 release spent 226s packaging Windows and 640s mirroring to R2.
Packaging compressed the same 245 MB tree twice, the 7-Zip archive and
then the NSIS installer. They now run at once; the zip reads its own copy of
win-unpacked because NSIS writes elevate.exe into the tree it packs, and a
zip read beside that would contain it or not by timing. A local cross-build
gives the same 128-file zip as the sequential step.
Defender real-time scanning is switched off for the Windows build, which
writes that tree several times over. continue-on-error keeps a runner image
that refuses the switch from failing the release.
The R2 mirror sent 18,755 delta chunks of about 10 KB with the AWS CLI's
default of 10 requests in flight, roughly 31 a second. Raising it to 64 leaves
the published objects unchanged.
The controller keeps the session in its finishing state while TurnDone fans
out, and Running() counts finishing, so the rig's done signal always arrives
before the session is free. A slow runner submitted the second line inside
that window and got busy.session_running, which the race leg reported as a
failure of the attribution it was testing.
Every MCP tool sat behind use_capability, so calling one cost a search and
an inspect before the call, and nothing let a user say "this server is used
every turn". A server now declares `load = "always"` (or `alwaysLoad: true`
in .mcp.json, a package manifest, or an installed mcpServers document), and
the user overrides it per server in [tools.mcp_load].
An always-loaded server's tools join the provider schema when the runtime is
assembled, and only when its schema is already known and the server is
authorized: a server discovered mid-session waits for the next assembly
whatever the discovery race, so one config and one cache give one schema,
and an unauthorized server stays behind use_capability where its approval is
asked for. The server is also connected in the background at assembly, so
the first direct call does not pay the handshake the loading saved.
Studio shows the mode as a tag beside the server and offers
deferred/always above its tool list. Switching writes the user config and
rebuilds the runtime in place, the same as the other settings boot reads,
because a new session reuses the runtime and would never see it.
The retired `tier` field was already stripped on load, which left the
eager/background partition, the slow-server demotion and the startup-latency
samples feeding it with nothing to act on; they are removed.
Any tool the classifier did not know was a proven mutation, MCP tools
included. So every non-read-only MCP call left a stale_verification
debt, even one that acted only on a remote system. The model then went
looking for a check to settle it: in a live run it tried to launch the
MCP server itself to "verify" a deploy.
A tool carrying MCP identity that does not name the paths it writes now
reports EffectsUnstated, read off its type through tool.MCPMetadata, the
same identity provenance reads. ToolCallMutationClassWith makes such a
call unknown rather than proven, which puts it on the path bash's
unclassifiable commands take: the workspace is scanned before and after.
Unchanged settles it as no mutation. A changed file is a proven mutation
with the observed paths, and owes its check as any change does.
TestEffectAnMCPCallOwesACheckOnlyWhenTheWorkspaceChanged drives both
through boot.Build: a call that writes nothing here owes nothing, and
one that writes deploy.log into the workspace owes the check. Without
the reclassification the first case owes stale_verification again.
Studio opens a pane with POST /runtimes, whose handler passed
r.Context() into boot.BuildRuntime. That context became the lifetime of
every lazily started MCP server (LazyToolset's sessionCtx) and the
controller's PluginCtx. net/http cancels it when the handler returns, so
in any pane after the first, a server whose schema was already cached
failed its first call with "MCP startup launch failed after 9ms ...
context canceled". The first pane was unaffected because serve builds
it on context.Background.
build now detaches once at its boundary with context.WithoutCancel,
keeping the context's values. Teardown still runs through the host's
own cancel causes.
TestEffectAnMCPServerStartsAfterTheBuildingRequestEnded builds twice:
once to cache the schema, then with a request context cancelled when
Build returns. Without the fix the call answers "context canceled".
MCP elicitation, form mode. It is declared in the legacy initialize
capabilities and in the 2026-07-28 _meta, and answered on all three
paths:
- legacy stdio: the request arrives unattached to any call and goes to
the most recent call in flight that has a person behind it;
- legacy Streamable HTTP: the elicitor comes from the call's context;
- modern MRTR: it is answered among the input requests.
The host renders requestedSchema: string, number, integer and boolean
fields, enum and titled oneOf, and multi-select arrays. Answers are
checked for required fields, range, length, email/uri/date formats, and
integers parsed exactly. A form that fails goes back with the reason,
prefilled with what was given, up to three times. Schema defaults
prefill the first form.
The form rides the ask prompt (tool.Elicitor on the tool context,
implemented by control.Controller) with an AskOrigin naming the server.
Refusing it answers the server with decline and leaves the turn
running, where an empty answer to the agent's own question still ends
it. The decision receipt records the field names and
accepted/declined, never the values. Studio draws it as a whole form
under the server's name, with a warning not to enter secrets. ACP has
only the permission prompt to draw it in, where a field titled like an
action reads as the agent asking leave, so ACP declines it.
Bounds against a hostile server:
- one open form per stdio connection; a second request is declined
through the bounded reply queue;
- a form ends with its call;
- at most 32 fields and 64 choices, with caps on text length;
- duplicate names or labels are refused;
- nobody to ask means decline.
URL mode is not declared.
Also: this window's own answer now overrides a decision receipt that
overtook it, which sealed the card as "handled in another window".
A call the host cannot classify pays a full workspace walk before it runs
and again after. On this repository (23.6k files) one walk took ~240ms
sequentially and takes ~50ms with sixteen directories read at once. A
20k-file Unity project goes from ~120ms to ~20ms.
The answer is unchanged. Links are not entered, VCS stores below the root
are skipped, an unreadable entry or a stop leaves the scan incomplete, and
more than limit files put it over the limit.
TestParallelScanAnswersAsTheSequentialWalk keeps the old WalkDir verbatim
and holds the two equal across limits on a tree with nested VCS stores and
a link out of the tree. Letting the walk enter a VCS store fails it.
StartTracked creates each child suspended, assigns it to a job object, and
then resumes it. Finding the one thread to resume took a system-wide
TH32CS_SNAPTHREAD snapshot. On a desktop with 8.7k threads that costs 54ms
per launch, about half of what a bash `pwd` costs end to end through
boot.Build (120ms before, 60ms after).
NtGetNextThread walks only the child's threads. Both checks still hold:
exactly one thread, and a previous suspend count of at most one. When
ntdll lacks the call, or the child's handle cannot be opened, the snapshot
answers as before.
App.tsx had reached 802 lines against the 800-line ceiling, and the lint
job failed on it. The fold-away hook is self-contained, so it moves to
its own module unchanged, with its comment in English. App.tsx is back
to 784.
From the security review of the MCP 2026-07-28 client:
- -32020, -32021 and -32022 sit in JSON-RPC's implementation-defined
range, so a legacy server may answer the pre-handshake probe with one
for its own reasons. Such a server failed to start. Only a -32022
carrying a non-empty list of revisions now marks an answer as modern;
every other reply gets initialize, which is what those servers had
before.
- One input_required round may ask for at most 16 inputs and echo at
most 1 MiB of requestState, so a server cannot make each retry
larger. Over that, the call fails with errMCPInputOverBounds.
- A modern connection no longer re-runs initialize when a session
expires. A modern server has no session to expire, and initialize
belongs to the other era.
confineRead resolved every walked file with filepath.EvalSymlinks, which on
Windows costs a FindFirstFile per path component. A glob over a 50k-file
Cocos assets tree spent 94% of its 22.9s there; it now takes 0.49s. Native
grep over a Unity Assets tree goes from 6.2s to 4.5s, the rest being file
reads.
WalkDir descends only into plain directories, so a plain file or directory
below the root resolves to the root's real path joined with its relative
path. A symlink, junction or other special entry still pays confineRead in
full. TestWalkConfineAgreesWithConfineRead holds the two answers equal over
a tree with a forbidden directory, sensitive names, a junction into the
forbidden directory, one out of the tree, and a file symlink to a forbidden
file; with the special-entry check removed it fails on that symlink.
Glob, native grep (and its ignorer) and code_index use it.
TestRedactLongConcurrentTranscriptAvoidsRegexpBacktracking ran 24
workers x 20 iterations over a 2,000-line transcript. Under the race
detector that sits at the ten-minute test limit on CI: one run passed at
581s, two timed out. Under -race it now runs 4 x 2, which still exposes
a data race in concurrent Redact; the ordinary run keeps the full load,
which is what checks backtracking. Locally the race run takes 5s.
The census found four proven-writing inputs outside the action vocabulary,
which held the Studio workflow red. The window's Escape registers through
listenAction as browser.open, session.stop or chrome.focus, whichever it
performs in the state it is registered in. The gutter's keyboard toggle
and grip carry chrome.rail on the rail edge and browser.open on the dock
edge, where opening the column opens a browser view. The theme file picker
is theme.import, the same intent as the button that opens it. chrome.focus
joins the registry.
A handler saves its tape entry in a defer, after the client has already read
the last byte of the response. srv.Close cut that off, so a replay started
right after stop could find no entry for the request just recorded; on Linux
and macOS TestTapeReplayNamesTheFirstRequestThatDiffers lost that race every
time. Stop now shuts down gracefully, bounded at ten seconds.
go mod tidy in desktop/ drops an indirect gopkg.in/yaml.v3 and 32 stale
go.sum lines nothing in the module imports any more; the desktop CI job
runs the same tidy and failed on the drift.
liveSession, waitLog, lineRef and their state are used only by
live_darwin_test.go and live_windows_test.go, so on Linux golangci-lint
reported all five as unused and failed the lint job. The file now
carries the same platforms as its callers.
"C:/Windows/x.png" is absolute only on Windows. On Linux and macOS it is
a relative name that filepath.IsLocal accepts, so the route answered
404 for a missing file, which is right, and the test expected 400. The
case now uses /etc/x.png everywhere and adds the drive-letter path on
Windows alone.
A server is asked with server/discover which era it speaks before anything
else; a modern one is never sent initialize, and every request carries its
protocol version, client info and capabilities in _meta. Over Streamable
HTTP the body is mirrored into MCP-Protocol-Version, Mcp-Method, Mcp-Name
and the Mcp-Param-* headers a tool's x-mcp-header annotations declare
(base64 sentinel for values a header cannot carry); a tool whose
annotations break the rules is left out. input_required results are
answered for roots/list and retried with the server's requestState;
elicitation and sampling surface as ErrMCPInputRequired. HTTP requests
are no longer chased by notifications/cancelled on a modern connection.
A modern server sharing no revision is refused with
ErrUnsupportedProtocolVersion; one still serving a legacy revision gets
the handshake. The SSE transport is legacy-only and skips the probe.
OAuth: the authorization response's iss is checked against the metadata
issuer (RFC 9207), required when the server advertises it, and dynamic
registration declares application_type native.
Steering text into a running turn had the same gap a new message did:
only the screen that sent it drew it, because the steer event was read
only to settle that screen's own pending row, and the device it came
from was lost.
A steer queued from the inbox now carries the item's Via into the
agent's steer entry (SteerItemFrom), onto the user message it lands as,
and onto the steer event, which also says when the host wrote the
guidance itself. A screen with no pending row of its own draws the
guidance once per item, never the host's; the sender's own row takes
the device, and /history returns it on steer rows.
A line queued on a phone while a turn was running lost its device: the
queued item runs long after the request that queued it, and only the
direct submit path carried one. InboxRequest and the persisted
PromptEnvelope now carry Via, an edit keeps the item's original one,
and the queued run binds it to the turn through the same turnTags the
direct path uses, so the turn is announced and landed as the phone's.
An answer to the model's question given on a device goes through
AnswerQuestionFrom, on the same Provenance port as submit and approve,
and names the device on the ask's receipt and nowhere else. A screen
that did not answer read 已在其他窗口处理 and nothing more; it now reads
由 设备 N 回答：<what the receipt recorded>, or 在电脑上回答 on a
phone, and keeps the old line where neither is known.
Steering text into a running turn is not attributed yet: it lands
inside that turn rather than opening one, and has no announcement to
carry a device on.
A line sent from a paired phone never reached the window: each client
minted its own user row, and turn_started carried only the message's
index, so the window showed an answer with no question above it, and
the phone showed the window's answers the same way. turn_started now
carries the line itself, read the way /history reads it, and a client
with no row of its own for that index draws one from it, once.
Who sent it is recorded where the message lands. A paired device's
request carries its pairing id and the number the window lists it
under; serve passes that to SubmitHTTPFrom, the submission carries it
through the turn's context beside its output format (turnTags, never a
controller slot), and the host's turn boundary stamps it on the user
message as provider.Via, which the projection strips before any
provider request. /history returns it, so a reload still says it.
Approvals made on a device go through ApproveFrom and name the device
on the decision receipt, and only there: the device changes who the
receipt names, never what the answer allows. Both calls sit on a
Provenance port that only SessionAPI carries, since an editor has no
paired devices to speak for; the window's own input still goes through
SubmitHTTPFormat and Approve.
On screen a line from another device reads 来自 设备 N, and on a phone
the window's lines read 来自 电脑; a screen's own lines carry nothing.
An approval settled elsewhere adds 由 设备 N 处理, or 在电脑上处理 on a
phone. The device bar tells the rest of the page which device it is.
It also stops re-asking /device on the window, which it did every ten
seconds after learning the window was not a device.
DecisionReceipt and Via move to provider/decision.go, keeping
provider.go under its size ceiling.
A finished reply showed as one run-on paragraph with its "##" and code
fences in plain sight, although its stored text and message frame kept
all 43 newlines. Rendering that text directly works, and so does
replaying it as a stream. What produced the screen is SayCard's error
boundary: once the markdown subtree threw, it stayed failed for good,
and its fallback was a div without pre-wrap, so every newline read as
a space.
The run that hit it was a dev build under constant HMR from two
sessions. The likeliest trigger is the lazily loaded renderer failing
to load once: React.lazy keeps that rejection for the life of the page.
That trigger is not proven.
Boundary now takes a retryKey. When it changes (the next chunk of a
streamed answer, or the finished one) the children get another try,
and componentDidCatch logs what threw, so the next occurrence names its
cause. LazyMarkdown swaps in a fresh lazy component when the import
fails, so a retry loads again. SayCard keys its boundary on the text,
and its fallback keeps whitespace, so even a real failure reads as
paragraphs.
When a release publishes a delta for this platform, the Windows install
now tries it before downloading the full installer. The client fetches
the index and checks its SHA-256 against the manifest and its minisign
signature against the release key, and refuses one for another version
or platform. It then plans against the install, fetches only the missing
chunks (8 at a time, each checked against its name, cached so an
interrupted attempt resumes), and assembles the new tree in the update
cache, checking every file. Until that point nothing in the install has
been touched, so any failure is logged and the full package does the
job as before.
The swap follows the macOS pattern: the host copies itself out of the
install and starts the copy with a plan file (--reasonix-tree-handoff),
detached, before the application ends. The helper waits for the shell's
and the host's processes to exit and hashes every staged file again. It
then moves each file in and keeps what it replaces in a backup
directory, retrying through the seconds a scanner still holds a file.
On any failure it puts every moved file back, so the install is the new
release or the old one, never a mixture. It updates DisplayVersion on
the uninstall entry whose InstallLocation is this install and relaunches
the application. Files the release does not list, such as the NSIS
uninstaller, are left in place.
ApplicationAt now states the shell's PID off macOS as well: the swap has
to wait for it, and before this nothing outside macOS read the field.
Run for real on Windows, replaying v2.18.1 -> v2.19.0 with a live stand-in
process: the helper waited for that process to exit, and all 120 release
files then matched v2.19.0 byte for byte, with the uninstaller kept.
The release now builds a chunked update from the signed Windows portable
zip, the same bytes the installer lays down. The output is a
zstd-packed Index (731 KB for v2.19.0, down from 1.6 MB) signed with
the release's minisign key, and the chunks it names. The delta stays out
of dist, which is what gets counted and published as the release's
artifacts.
The mirror step syncs chunks into one shared store,
studio/chunks/<sha256>.zst. Chunks are named by content and immutable,
so --size-only skips every chunk an earlier release already uploaded.
They go up before the tag's delta index, and both before the catalog,
so no client ever sees an index whose chunks are not there yet.
latest.json gains deltas: per platform, the index as an Asset (URL,
signature, size, SHA-256) on the mirror, plus the chunk store's base
URL. Older clients decode manifests leniently and ignore it. A release
without mirror credentials offers no delta, since nothing would be
uploaded for it.
studio-delta build now writes <delta-dir>/<platform>/index.json.zst, with
the chunks in <delta-dir>/chunks. simulate reads that layout, and on
v2.18.1 -> v2.19.0 still fetches 21.9 MB and verifies the staged tree.
A paired phone's page was the window's own, with nothing saying the
sessions on it live on another computer, and nothing on the window said
a phone was on it now rather than at some point.
On a device, a bar above the chrome reads 正在控制 <hostname>, names the
device by the number the window lists it under, and turns grey with
与 … 的连接已中断 when the machine stops answering. Its 断开 takes a
second press and unpairs the device from its own side through
POST /device/leave; the page reloads to the unpaired notice. GET /device
answers a paired device with its id, ordinal and the machine's name,
and the window or a networked serve's browser with 404
device.not_a_device, which is how the page knows not to draw the bar.
On the window, a device is online while it holds an event stream open,
which the gate counts by the stream's Accept header rather than by a
recent request, so a shut page reads as gone within one read. The
button carries the online count in place of its dot, a line under it
says 设备 N 已连接 or 已断开 when that changes, and the lists read 在线
or 最近 <time>. Sharing is watched whenever it is on, not only while
the card is open, so those stay current unasked.
Unpairing a device now cuts every stream it holds open. The credential
was checked when a stream opened and never again, so a phone the
window had disconnected went on receiving the conversation until it
reloaded; each stream now runs under a context Revoke and RevokeAll
cancel.
Every Studio update downloads the whole installer (115 MB on Windows),
even when a release changes a few megabytes. Measured on the real
v2.18.1 -> v2.19.0 Windows builds: the Electron binary is identical but
for its version resource, the kernel changes, and the frontend changes
by about half a megabyte.
internal/platform/delta describes a release as a signed-to-be Index: every
file's path, size and SHA-256, and the content-defined chunks it is made
of (normalized gear CDC, 4/16/64 KiB). Chunks are stored zstd-compressed
under the SHA-256 of their plain bytes, so any chunk two releases share
is stored and fetched once. An update cuts the running install with the
same chunker; content-defined boundaries move with an insertion instead
of shifting every chunk after it. It fetches only the missing chunks,
checking each against its name, and writes the new tree to a staging
directory, checking every file against the Index. Validate refuses
paths that leave the tree, backslashes and drive letters, two paths
that are one file on Windows, and chunks that do not add up to their
file.
cmd/studio-delta builds an Index and chunk store from a release zip, and
replays an update from an unpacked older release. On the real pair it
fetches 21.9 MB instead of 115 MB, reuses 344 of 387 MB, and verifies
the staged tree, in about five seconds.
Nothing publishes or consumes this yet. Wiring it into the release
workflow and the updater comes next.
Adds github.com/klauspost/compress for zstd.
The card reused the settings block, which explains itself at length, so
a popover under a 28px button ran to more than 560px with three
paragraphs in it. It now has its own arrangement in the language of the
chrome's context card: title and one-line subtitle with the switch in
the header, the code as the only large thing with its expiry and two
actions under it (copy link, new code), the network as one row, the
connected devices as compact rows, and the plain-HTTP caution as a
single line at the foot. Sections are divided by hairlines, sizes come
from the type scale. The settings block keeps the long form.
A device is named by its pairing order, 设备 1, 设备 2, with the user
agent kept as the row's title; read as a name it was a hundred
characters that all began with Mozilla/5.0. Disconnecting from the card
takes a second press on the same button, which reads 确认断开 for three
seconds, in place of the inline dialog the settings block uses.
The docked workbench sat flush against the window, split from the
conversation by one hairline. It now floats in its column: 8px of space
around it, a 12px border radius, a border and a soft shadow. The page it
shows sits inset inside the card with 8px corners, both the iframe in
the browser build and the native view's slot in the desktop build.
CSS cannot clip a native WebContentsView, so browserviews.js rounds the
page itself with setBorderRadius(8), the same radius .bview has.
A device is listed under its user agent, which runs to a hundred
characters. The name already ellipsed, but the two grids around the row
sized their implicit column to the widest content, so the column grew to
the full string, the card scrolled sideways, and the warning below
stretched with it. Both grids now bound their column to the card.
Under the address sits 「复制配对链接」, which puts the full link the QR
code draws, fragment and one-time code included, on the clipboard. The
bare address shown above it pairs nothing, which read as a broken
share when typed into another browser on the same machine. The link is
the same credential as the code, so it is copied on request and never
shown as text; it pairs once and lapses with the code.
The clipboard path is CopyButton's, exported as copyText, so the
fallback for hosts without navigator.clipboard is written once.
A fenced block was a bare box: a faint language tag in the corner, a copy
button only on hover, no line numbers, and a long file pushed the rest
of the reply off the screen.
It now has a header bar with the language, the line count, and Download
(saved under the language's suffix, .txt when there is none) and Copy
buttons. A gutter numbers every line, built from spans rather than a
list so that markdown's own list spacing cannot shift it against the
code. A settled block over 18 lines opens folded to 12, with a fade and
a "Show all N lines" toggle. The tail of a reply still arriving never
folds: Block gets a live flag, separate from tail, because a settled
message has a last block too.
The picker was disabled whenever the door was open, with nothing on
screen saying so, so it simply did not respond. Choosing another
network while sharing now moves the listener there and mints a code
for the new address; a line under the picker says that the phones
already paired will need to scan again, since the old address stops
answering.
Minting a code also set it apart from the status that knew about it:
the status from the open call arrived first, without an offer, and the
effect that drops a spent code dropped the fresh one. The code and a
status read after it are now set in the same tick.
The chrome's backdrop-filter makes it a stacking context, so the card's
z-index 60 only ranked it inside the bar, and the panes after the bar
took the hits the card paints over. A press on the switch landed on the
conversation pane, useDismiss read it as a press away, and the card
closed before the switch ever saw the click. The bar is lifted while a
card is open.
Found by clicking the card with a real pointer in Chrome against the
Studio host; the earlier check drove the switch through element.click(),
which skips hit-testing and so could not see this.
How long a reply thought was measured only by the window watching it,
so a reopened session, a reload or a second window showed "思考 53 字"
with no time at all.
The agent now measures it in the stream loop: from the first reasoning
text to the first answer output (text or a tool call), or to the last
reasoning text if no answer followed; a response with no reasoning has
none. The measure rides the settled message frame and is stored on the
assistant message (ThoughtMs, local UI metadata like WorkDurationMs), and
serve's history carries it. Studio prefers the kernel's figure over its
own clock, which stays only as a fallback for turns recorded before this.
While a reply is still thinking, the fold shows a running clock
("思考中 3.4 秒") instead of a bare ellipsis, and once the answer starts
it shows the final time rather than staying on "思考中".
To stay within budget, the frame emit and the per-chunk clock move out of
streamWithFrozen into thought_clock.go, and the temperature helpers move
from provider.go into temperature.go.
The chrome gets a QR icon beside the theme toggle. Pressing it opens a
card under it holding the same switch, network choice, pairing code and
paired phones as Settings > Remote > Phone access; with the door
already open, opening the card mints a fresh code at once, once per
opening, so a spent code is not replaced behind the phone that used it.
While the door is open the icon carries a dot and its title counts the
connected phones.
The button is drawn only where the kernel has a window to share:
/share answers 404 to a browser tab and to a paired phone, so neither
gets it.
The settings block and the card draw from one hook, useShare, and one
body, ShareBody; the card re-reads the state each time it opens, since
the settings block may have changed it meanwhile.
The title bar's drag rule claimed every non-control descendant of the
chrome, which would have made the card's text and code a window handle
in the shell; a [role="dialog"] now opts out whole.
Checked against the Studio host: the card opens under the icon, the
switch opens the LAN listener and shows the code, the icon takes its
dot, and the code decodes with jsQR to the listener's pairing link.
2b504d43f rendered data-action="ask.step" without declaring it, which
fails actions.test. It only moves between panes of one card, so it is a
view action proved by the interaction.
reasonix serve and reasonix web draw the share link as a QR code in the
terminal when stdout is one: dark modules on an explicit light
background, so it scans on a dark or a light terminal. In token mode
the code carries the token in the link's fragment, the way the printed
share link already does; in password mode it carries the login page.
--public-url names what a phone opens when that is not the bound
address, such as a TLS proxy's origin, and the share line uses it too.
Without it a wildcard bind is replaced by this machine's first private
address, and a loopback bind draws no code, since a phone cannot reach
it.
A token link rides only a link that is encrypted or stays off the
internet: https, or plain http to a loopback, private or tailnet
address. A public address over plain http gets no code and a line
saying to put TLS in front and pass --public-url https://. The
off-internet rule is serve.OffInternet, the same one the LAN share
applies. A supervised serve, which keeps its token out of the log,
draws nothing.
The password-flag handling moves out of runServeWithOptions into
applyServePassword, keeping that function inside its size budget.
With more than one question, the only footer action was Confirm, disabled
until every question had an answer, so after the first pick the next
question could only be reached through its tab.
A single-choice pick now moves to the next open question after a short
pause, so the mark is seen first. While another question is still open,
the primary button is Next (i/n); it is enabled once this question is
answered. Previous steps back. Confirm appears only on the last open
question. Multi-choice and free-text answers never advance by
themselves.
Under the scene fold the rail is a drawer over the conversation rather
than a column beside it: its grid track is zero, a veil dims what it
covers and closes it on a tap, and picking a session or opening the
settings puts it away. Opening it squeezed the conversation to a 90px
strip before.
The docked workbench takes the pane's whole width there, with the
conversation and composer set aside until the 「对话」 tab brings them
back; a 560px dock beside a 390px conversation left neither usable.
Both edge grips go under the fold, since the chrome's rail button and
the 「工作台」 tab are their entrances and the grips floated over the
approval card.
The settings sheet fills the screen; the studio layer's inset had
overridden the full-screen rule app.css already carried for narrow
windows.
The transcript no longer scrolls sideways: the wallpaper's reading
plate bled 64px past a column that had no room for it. Heights use dvh,
so a phone's browser bar no longer covers the composer. A coarse
pointer gets a composer of at least 16px, below which iOS zooms the
page on focus. Without hover, controls that only appeared on hover stay
visible. The icon-only branch pill drops its change count, which
overflowed onto the approval-mode button.
Approving best_of_n lets its attempts make their own tool calls without
asking again, but the card showed only the tool name. A tool can now
declare this with tool.ApprovalScoper. The controller stamps the scope
on every approval request at its single emit point, looking the tool up
in its registry, and the wire form carries the call's arguments only
alongside a scope, since they are what it covers.
Studio renders unattended_attempts in the reader's language: how many
attempts start, that their calls are handled as Auto review (deny rules
still apply, and a dontAsk session stays dontAsk), and the task they will
work on. A scope the window does not know still says that one exists.
The approval wire mapping moves to eventwire/approval.go, which keeps
wire.go and ToWire inside their budgets. The only change in the
sensitive approval_orchestration.go is the one line that fills Scope,
which is display metadata; no decision reads it.
Settings > Remote > Phone access opens a second listener on a private
address the person picks (Ethernet/Wi-Fi first, Tailscale next, tunnels
and virtual switches last, read from the interface's flags and hardware
address). The window shows a QR code carrying a one-time pairing code
in the URL fragment; the page trades it at POST /pair for an HttpOnly,
SameSite=Strict device cookie. A code pairs once and lapses after five
minutes; closing the share or quitting Studio unpairs every device, and
each device can be disconnected on its own.
A paired device holds what a networked serve client holds, and no more.
The window's grants (provider edits, account sign-in, workspace switch,
editor open, provider setup) are now read per request, so they stay shut
for device reach even though the device reaches the same handler. The
window's own routes (folder picker, SSH remotes, tray, notifications,
browser host, updates, asks, and the share controls themselves) answer
a device with 404 device.host_only, which the page already reads as a
kernel with no window.
The device gate refuses a Host other than the listener's own address
(rebinding), a state change from a foreign Origin, and every kernel
route without a known credential; the page's own files stay public so
an unpaired phone can load the page it pairs from.
The listener is plain HTTP, and the panel says so: fine on a home
network, not on a public one. Pairings live in memory only.
[agent] code_mode offers run_script. The model writes a Starlark
script. Inside it, call(name, **args) runs a tool and returns its output,
try_call returns ok/output/error, json encodes and decodes, and print
writes the result. Several dependent steps then cost one round trip, and
only what the script prints enters the conversation.
Every call inside a script goes through tool.Invoker, which the agent
binds to each tool call. The agent's invoker runs executeOne for it, so
a nested call passes the same parsing, policy, permission, hooks,
evidence and mutation observation as one the model made. It gets its own
tool card under the caller's id (s1.1, s1.2, ...), and its result
reaches only the script. A nested call's external origin labels the
script's result when the script declares none.
The interpreter reaches nothing else: no files, network or clock. Limits:
20M steps, 64 tool calls, 64 KiB of printed output and a 32 KiB script;
the interpreter is cancelled with the turn. run_script cannot run inside
a script, directly or through a proxy.
Adds go.starlark.net as a dependency.
The base rule makes the row full width, and the Studio skin adds 18px of
margin on each side, so the session tree was 36px wider than the rail. That
put a horizontal scrollbar under the tree, and opening a row's menu scrolled
it sideways.
The CLI keyed its session dir to the raw working directory, while boot
resolves the workspace to the nearest git root. Started from a
subdirectory, `reasonix serve` and chat wrote the transcript under the
subdirectory's project while the pane and the sidebar listed the
repository's, so the conversation never appeared where it was being held.
The session dir now comes from the same resolution boot uses, for the
build and for --resume/--continue lookups: the git root without --dir, and
the --dir directory itself with it. Resolution moves to session_dir.go.
Sessions already written under a subdirectory's project stay where they
are; they are not moved.
[agent] best_of_n offers a tool that runs one task 2-4 times in
parallel, each attempt an unattended kernel in its own detached git
worktree, then has a judge pick one attempt and writes only that one back.
The worktrees start from the workspace as it is: the snapshot is a
dangling commit written through a private copy of the index, so
uncommitted edits and untracked files are included, ignored files are
not, and the user's index and refs are untouched. The winner lands with
git restore --worktree plus deletions, unstaged, and only if the
workspace still holds the snapshot; otherwise ErrWorkspaceMoved keeps
the winner's worktree and reports where it is. Every other worktree is
removed.
Approving the one best_of_n call is what authorizes its attempts: they
run in auto mode, where deny and ask rules still hold, or in dontAsk
when the session is. An attempt's kernel never offers best_of_n, so
attempts cannot fan out again. Attempt transcripts live in a temp dir.
Their usage reaches the session as best-of, and the judge's as
best-of-judge. The judge is advisor_model when set, else the session's
model.
An attempt that stops at its own readiness gate (FinalReadinessError)
still has its diff judged, with the host's reason attached; any other
error takes it out. With one finished attempt no judge is paid; a judge
that names no finished attempt applies nothing.
Three reports, one cause and two gaps.
- Choosing another conversation hid the one that was running. openPane
took any pane without a session path to be the blank one and rebound it.
A new conversation's path is minted at the first submit, so a pane
running its first turn still looked blank to a pane list read before it.
A pane that is working, or has reported a path, is no longer blank.
- 「进行中 1」listed nothing. The tree's rows came only from transcripts
on disk, and a first turn in flight has not written one yet. The host
tree now also lists the conversations its panes hold that the listing
lacks, so the running one can be found and returned to. A session past
the per-folder cap is covered the same way. Such a row reads 新会话
rather than its file name, and its tab takes the numbered fallback.
- With one pane open there was no way to close a conversation: closing
lived only on the tab strip, which appears from two panes up. The row
menu now offers 关闭会话 for a conversation a pane holds, and refuses it
while a turn runs, like archiving does.
agent.advisor_model offers the working model an advise tool. A call
hands the conversation so far and one question to the advising model,
which answers in text with no tools; the answer is the tool result. The
cheap model keeps the loop and pays for the strong one only when it
decides a moment is worth it.
The agent binds its conversation to each tool call through
tool.TranscriptReader, a copy of the canonical transcript. The advisor
renders it as text, since tool calls cannot be replayed into a request
that declares none: the first user message is always kept, the rest
from the newest back within 120 KiB, local-only messages never. Usage
bills the new advisor source at the advising model's rate.
The tool is registered only when advisor_model is set and resolves, so
whether the schema carries it is prefix configuration decided at boot;
there is no fallback, since advice from the same model is none.
UseCapabilityTool, the MCP capability runtime, on-demand connects,
capability listing and search, and the argument-contract reading they
share move from internal/runtime/agent to internal/runtime/usecap. They
were already their own types rather than agent methods, and they need
nothing from the agent. usecap depends on the agent not at all; the
agent imports it.
- The two MCP checks both sides make are now tool.HasMCPDestructiveHint
and tool.IsMCPServerAuthorized. They live in contract/tool/mcp_server.go
beside the interfaces they read.
- The agent's call-contract gate and the proxy's hints share
usecap.ReadArgumentContract, with its Hint and Broken.
- FilterCapabilityListResult, FilterCapabilitySearchResult,
ParseMCPServerCapabilityID and WithContractHint are exported for the
child registry and the dispatch path.
The integration tests that drive a real agent through the proxy stay in
agent. The runtime's own tests move to usecap. Tests that check the
proxy's judgements against agent or delegation types run as usecap_test
through export_test.go. No test was added or removed.
Baseline: usecapability.go carries its debt unchanged under the new path,
and delegation/task.go and control/controller.go each gain one import
line (-allow-widen).
agent.screen_external_content asks the triage model, once per external
tool result, whether the text addresses the agent and tries to change
what it does. The verdict is advisory: a flagged result keeps its text
and gains a host notice under its provenance label, and the user gets a
suspected_injection notice naming the tool and origin. A screen that
fails or times out flags nothing.
Screens in one batch run in parallel on the triage model and bill
injection-screen. askClass's request loop becomes askTriage so both
questions share it. The prefix does not depend on the switch.
UserDecisionPolicy and LanguagePolicy move to policies.go beside the
other prompt policies, keeping config.go inside its budget.
Projection, compaction and token estimation were 121 methods on *Agent,
free to touch any of its state. They now form one subsystem inside the
agent package:
- windowState holds what the window owns for a conversation: the
installed projection, the compaction in flight, the pressure latches.
It used to sit as eight loose fields on sessionRuntime.
sessionRuntime.reset hands a new conversation to windowState.reset, and
the lifetime guard in sessionstate_test.go now holds both structs to
their reset and carry-over lists.
- The window's methods live on *contextWindow, which carries only its
state, the session, the configuration, the services and a windowHost.
- windowHost is everything the window asks of the loop: eight callbacks
(the todo and host-context tails, tool facts, the provider projection,
preparing a sampling request, the extension compaction intercepts,
failure annotation) and Session. It was derived from the compiler, not
written by hand, so it is the whole dependency.
- The loop reaches the window through a.window(). The agent's public
context API (ContextBudget, CacheState, LoadProjectionSidecar and the
rest) is unchanged and forwards to it.
The new repolint rule window-state holds the boundary. Only methods on
the window's own types may read sess.win, and the owners are declared in
tools/repolint/windowstate.go. REASONIX.md names the boundary.
Behaviour is unchanged. No test was added or removed. Tests reach the
window's internals through a.window() like the loop does.
A web page, a browser tab, the desktop or an MCP server can write text
that reaches the model as a tool result, and nothing told it apart from
the workspace's own output. The host now knows the origin by type: a tool
declares it through tool.ProvenanceDeclarer (web_fetch, browser_*,
computer_*), and any tool carrying MCP identity is labelled with its
server. The label is read after the call ran, so a page the call navigated
to is the one named, and is added only to the provider-bound message; the
trajectory and frontends keep the raw result.
ExternalContentPolicy in the prefix says what the label means. This moves
the cached prefix once (golden regenerated).
The client went ahead when an authorization server's metadata omitted
code_challenge_methods_supported. The spec makes refusing a MUST: without it
the client cannot tell whether the server verifies the challenge it is sent.
It now refuses with ErrOAuthPKCEUnadvertised before any browser opens, and
the error names the escape hatch.
Some real authorization servers leave the field out, so a server entry can
set oauth_allow_missing_pkce_metadata = true. It is honoured only from a
config the user keeps in their own home (user config, legacy user config,
~/.claude.json): a project's config, its .mcp.json and an installed package
are written by someone else, and none of them may relax the check for
whoever opens or installs them. MCPConfigSource.UserAuthorized() also covers
project sources, so it could not be the test. PKCE S256 is still sent when
the check is relaxed.
The renderer writes the flag back, or the next config save would drop it.
The per-server overrides moved from render.go to render_plugin.go to keep
render.go within its complexity and size budget.
Security review (internal/ext/plugin is sensitive): the default is stricter
than before; the only relaxation is per server, from user-owned sources,
pinned by a test per source; the authorization URL still carries an S256
challenge, pinned by the test. plugin, pluginspec, config and boot tests
pass on a clean worktree; golangci-lint reports 0 issues; the coverage gate
does not flag internal/ext/plugin.
The transcript was one bordered, shadowed card holding every turn, so the
frame grouped nothing; turns are now separated by their own rule. The text
column lines up with the composer below it, and the scrollbar sits at the
pane edge with its gutter reserved on both sides so the column stays centred.
Under a wallpaper the column still needs a surface to be read against. It is
a veil behind the text that fades out at the sides and the bottom rather than
a card with edges.
Which language a turn answers and reasons in now lives in
internal/runtime/langpref: the context preferences a host sets, the
transient blocks that tell the model, and inference from the user's own
text. It depended on nothing in agent, and control and delegation read
it directly rather than through the agent. The block-detection helper
the workspace block shares is exported as HasLeadingInjectedBlock.
This is the one cohesive, already-exported helper left in agent. The
rest of what depends on nothing there is private to the loop, and
exporting it to give it a package would only widen the surface.
Baseline: langpref.go carries its essay debt unchanged under the new
path, and agent.go and delegation/task.go each gain one import line
(-allow-widen).
The task tool, read-only tasks, fleets, parallel tasks, the sub-agent
store and records, profiles and the child's capability grant move from
internal/runtime/agent to internal/runtime/delegation. They are clients
of the agent: they build child agents and run them. The executor loop
now names none of them.
What the loop itself does for a child stays in agent. child_run.go holds
running an agent as a child and composing its answer and host receipts.
child_registry.go holds shaping the child's tool surface. Delegation uses
a small exported surface for these: AppendHostReceipts, AttachReviewReport,
CompleteSubtaskContract, ExpandToolPatterns, MaxToolOutputBytes,
NormalizeToolSchemas, SubagentImageNote, VisionRefFor, WithCallContext
and the host-receipt labels.
Tests followed the code. The ones that check the agent's own judgements
against the real delegation tools (batch skipping, the plan-mode barrier,
contract hints, delegation profiles across the proxy) run as agent_test
in the agent directory through export_test.go. The user-turn retention
test is split so each package pins its half. Test helpers used on both
sides are copied, since neither test binary may import the other. One
test more than before, from that split; none dropped.
Baseline: the moved files carry their debt unchanged under the new path,
and task.go gains the one import line the move costs (-allow-widen).
explore answers questions about the code; the parent often only needs to know
which files and lines to read. locate is a read-only built-in subagent for
that: it issues all its searches (grep patterns, globs, code_index) in one
message so they run concurrently, confirms candidates in a second round, and
returns only "path:start-end — reason" lines, or "no match" with the patterns
tried. Its tool is capped at four rounds.
The cap is a per-call value, not a profile field (profile_boundary_test
forbids that): SubagentRunOptions.MaxSteps, set by the locate tool and taken
as the tighter of it and the default budget. It is also host-owned: a child
whose cap came from its entry point runs under WithRunStepLimit, so the grace
round it gets at the limit ends with its answer. Without that, the first real
run paused at the cap and handed the parent an error instead of the list,
because a subagent's budget was treated as the user's own limit. explore and
the other subagents keep their default budget and behaviour.
No model is pinned: a built-in naming deepseek-flash would fail for every
user on another provider. subagent_models.locate selects a cheaper model.
locate is added wherever the built-in subagent tools are listed: the
recursion exclusions (so the depth cap holds), the capability gate, named
profiles, evidence meta tools, hook mapping to Claude's Agent tool and doctor.
The Claude Agent tables moved from hook.go to hook_claude_agent.go to keep
hook.go within its size budget.
Measured once each on this repository with the default model, two questions:
locate vs explore, 20.3s vs 23.2s and 27.2s vs 27.9s wall, 18% and 16% fewer
prompt tokens, 8% and 1% lower cost. The gain is modest at n=1 on the same
model; what it changes is the answer's shape and a hard round cap.
task.go carried three concerns. Two of them are the agent's own and now
live in core files:
- child_registry.go: shaping a child's tool surface. This covers the
registry filters, foreground-only bash and the restricted
use_capability proxy.
- child_run.go: running an agent as a child. This covers
RunSubAgentWithSession, NewPlannerAgent, the read-only runners,
EvidenceSummary and the review-report nudges.
task.go keeps the TaskTool. delegationProfile moves into execute_one.go
and decorateExecutionReceipt into tool_receipts.go, beside their only
callers. reviewGrantFor goes to the TaskTool that alone uses it. The
agent hands its mutation observer to a spawning tool through an
interface instead of asserting *TaskTool.
After this, nothing in the executor loop names a delegation type, which
is what lets delegation leave the package next.
Baseline: child_registry.go and child_run.go carry the essay debt that
left task.go, and task.go's budget drops by the same amount
(-allow-widen); totals are unchanged.
The client advertised 2024-11-05, four revisions back, and never read the
revision the server answered with, so it could not tell which protocol a
session ran on. It now offers 2025-11-25 and accepts any revision it
implements (2025-11-25, 2025-06-18, 2025-03-26, 2024-11-05); a server that
chooses another is refused with ErrUnsupportedProtocolVersion, as the spec
has the client disconnect rather than guess.
Streamable HTTP now states the negotiated revision in MCP-Protocol-Version
on every request after initialize, and not on initialize itself. This has to
land with the version bump: a 2025-06-18+ server that gets no header assumes
2025-03-26 while the client believes it agreed on a newer one. The reconnect
wrapper forwards the value to the live connection; a replacement negotiates
its own during its handshake.
Also brought to the spec's MUSTs and SHOULDs:
- A 404 to a request that carried a session id is an expired session,
whatever the body says. The old check also required JSON-RPC -32001 and
the words "session not found" in the server's message, a judgement read
from an external server's prose; a 404 with no session held stays an
ordinary status (a wrong address, not an expiry).
- close() ends the server's session with a best-effort DELETE.
- A call the host abandons over Streamable HTTP sends notifications/cancelled,
as stdio and SSE already did.
- Tool results keep every content type: resource_link, embedded resources
(text inline, binary named) and audio reach the model as text markers
instead of being dropped, and a result with only structuredContent is
given as its compact JSON rather than as an empty answer.
parseToolResult moved to toolresult.go; plugin.go is 38 lines shorter.
Declared client capabilities are unchanged (roots only), which is what keeps
every newer feature opt-in. Elicitation, sampling, tasks and the stateless
2026-07-28 revision are left for later.
Security review (internal/ext/plugin is sensitive): the header value comes
only from the client's own list of revisions; DELETE goes to the configured
URL with the configured headers and session id; the new content types carry
the same server-supplied, untrusted text as before, under the existing body
limit. plugin, boot and builtin tests pass on a clean worktree; boot's fakes
still answer 2024-11-05 and connect. The coverage gate does not flag
internal/ext/plugin; golangci-lint reports 0 issues for it.
Write path sets, write grants and the sub-agent scheduler move from agent
to internal/runtime/writeclaim. They depend on nothing else in agent,
and both the executor loop and sub-agent delegation use them, so they
are a primitive beneath both rather than part of either.
The executor's path-effect check shares the claims' containment rule,
exported as PathWithin. Tests that waited on the scheduler's queue
through its mutex now ask SubagentScheduler.Queued. The tests that
exercise an agent binding tool calls against claims and grants stay in
agent.
Baseline: scheduler.go and write_claims.go carry their essay and orphan
debt unchanged under the new path, and agent/task.go gains the one
import line the move costs (-allow-widen).
Coordinator, which wraps an executor agent with a planner, moves to
internal/runtime/coordinator. Nothing in the agent's own loop referenced
it; it was a client living inside the package it drives, reaching into
the executor's fields.
It now drives the executor through exported agent methods, collected in
agent/coordination.go: ModelRef, ProviderName, ToolSchemas,
MarkExecutorHandoff, WithTurnPreferences and MaxStepsPauseOf. Helpers it
shared with the loop are exported by rename: UserImages,
NormalizePlannerDecision, WithRunStepLimit, IsToolLoopPause,
TrackPublishedHostStream, PlanningPhase, PlanContract, SummaryTagOpen
and SummaryTagClose. Runner and PlannerPlanApprover stay in agent, since
control consumes them as the agent's contract.
Coordinator tests moved with it, and so did the agent tests that were
really coordinator tests. The one test of an agent message moved back.
The planner-sink audit check is its own test now. Test helpers used on
both sides are copied, since neither test binary may import the other.
Baseline: coordinator.go and coordinator_test.go carry their essay and
orphan debt unchanged under the new path (-allow-widen); totals are
unchanged.
On --hair the rule sat at about 1.1:1 against the light transcript card and
read as texture. It is the transcript's one structural divider, so it takes
--border, the step the cards inside a turn are drawn with. The space above it
is wider than below, so it groups with the turn it opens rather than floating
between two.
Trajectories keep derived events, never what was sent to or received from
the provider, so no run could be played back and nothing caught a kernel
change that altered what the model is asked. The cache-first prefix is meant
to stay byte-stable, and only a live run and its bill showed when it moved.
-tape-record DIR records every exchange at the meter, one tape per task and
trial. -tape-replay DIR answers each run from its tape instead of the
provider, and the report's Replay line names the first request whose body
differs from the recorded one: a message by index and role, the tool list,
or a field. The diverging request is kept beside the recorded one.
Two sources of noise reach the model and had to be held still for a replay
to match: the random workdir path, which is in the workspace block, and the
seeded files' times, which appear in any listing the agent takes. Taped runs
use a fixed workdir per task and trial and pin those times, including the
tape root's, since it is ".." in the listing.
Verified with a real run of bugfix-slug-trailing: recorded in 15.3s for
about USD 0.0014, replayed in 6.0s with no provider traffic, all 6 requests
matched, same tokens and cache hits. The control arm holds: replaying with
-ablate all is reported as "diverged at request 1, tools".
The transcript was cut into fixed 48-card blocks and a hairline was drawn
between blocks, so the only divider in a long session landed wherever the
48th card happened to be, often in the middle of a turn. Worse, transcriptRows
runs per block, so a turn cut in two left its trailing work with no sentence
to sit under.
Blocks now gather whole turns until they reach 48 cards and close at the next
turn, and each turn opens with a rule of its own. Steered and queued lines do
not open a turn. The cutting moves to blocks.ts to keep Transcript.tsx under
its size ceiling.
-attempts retries until a pass, so it measures whether the agent can solve a
task at all (Pass@<=N). Nothing measured whether it solves it every time,
which is what a user relying on it meets. -trials N runs every task N times,
keeps every outcome, and adds a Reliability line: pass^N (tasks that passed
every trial), pass@N (any trial), mean pass@1 over all trials, and the flaky
tasks by name. A trial the token budget skips is not counted as a failure,
and the line says how many tasks ran every trial. -trials and -attempts
count repeats differently and are refused together. A run without -trials
reports exactly as before.
Verified with a real run: bugfix-slug-trailing, two trials, both passed,
reported as pass^2 100% (1/1), for about USD 0.001.
The guardian decides whether the user authorised a risky action, and its
evidence carried the agent's own prose and every tool result. Both are where
injected text arrives: a fetched page, a file or an MCP server can write "the
user pre-approved this", and the agent can be talked into repeating it. The
policy already called the transcript untrusted; the reviewer still read the
claim.
The transcript now holds user turns and every tool call with its arguments,
and nothing else. This also fixes calls issued beside prose: an assistant
message with text and tool calls kept only the text, so the reviewer missed
calls the agent had actually made. The policy says what is withheld and that
authorization is read from the user's messages alone.
The new test fails on the previous extraction ("tool output or agent prose
reached the guardian") and passes on this one. guardian, control, builtin and
boot tests pass on a clean worktree.
build now reads as load, wireTools, controller, freeze. The state one
stage settles for the next lives on a builder rather than in 150 locals
of one function, and each stage fits the function-size and complexity
limits.
Sidecar ownership keeps one owner: builder.pendingMgr holds the
preflighted manager until freeze hands it to the runtime set, and the
deferred retire closes it on any earlier failure, as before.
boot.go now carries no complexity or function-size debt; its file-size
budget drops from 898 to 167.
The tokens-per-second, cache, context and cost row sat in its own bordered,
blurred, shadowed box below the composer, a second card under the first.
It is now a plain row of text in the same place.
A Markdown file read in the workbench linked to its neighbours and showed
images stored beside it, but both were left as written: a relative link
opened the kernel's own address in a new window and a relative image never
loaded.
References now resolve against the document's folder, and a leading slash
against the workspace root. A link to a workspace file opens it in the
workbench, rendered if it is Markdown; an anchor alone does nothing rather
than reloading the window; links with a scheme keep the routing every other
link has. A reply in the transcript is unchanged.
Images load from GET /workspace/image, confined to the workspace through
os.OpenRoot, typed by extension rather than sniffed, capped at 10 MiB, and
served under "Content-Security-Policy: default-src 'none'; sandbox" with
nosniff, so an SVG opened at that address cannot run script on the kernel's
origin. Errors reuse the workspace codes the frontend already words.
Verified in Chrome against a real kernel: a README link opened docs/DESIGN.md
rendered, its img/logo.png loaded through the new route, and its
../README.md link came back.
build was one 1138-line function that knew every subsystem. Each phase
now lives in its own file and build calls them in order:
- config_migrations.go: the pre-load migrations and their notices
- extension_stage.go: sidecar preflight, the UI hub's controller handoff,
sidecar provider merging, and which assembly failures are fatal
- model_selection.go: the executor model and preset
- tool_environment.go: write/read roots, the bash sandbox spec, search
- mcp_registration.go: host-session and configured MCP servers, LSP
- tool_wiring.go: hooks, session tools, skill and slash tools, the
use_capability surface
- delegation.go: the task tool and skill sub-agent options
- roles.go: planner, guardian, recovery reviewer, semantic router
Behaviour is unchanged. build drops from 1138 to 440 lines; boot.go's
complexity budget from 125 to 9. Comments that narrated how the
assembly got here are replaced by the constraint that holds.
A .md, .markdown or .mdx file in the workbench now has Read, Edit and Diff
modes and opens in Read: a document is read far more often than edited, and
its source was the only view. Reading renders the editor's draft with the
transcript's own Markdown component, so tables, highlighted code, math and
emoji look as they do in a reply, and an unsaved edit shows before it is
saved. Other files keep File and Diff.
The workbench test opens README.md, so it now asserts the rendered view and
the draft reaching it, then switches to Edit before typing.
Every settings route is a runtime's, and the sheet rendered only when a pane
had a port, so with every pane closed the wallet, account and settings
buttons set the request and drew nothing. Opening a conversation then
satisfied the condition and the sheet appeared late, unasked.
Asking for settings with no pane now opens a session in the current folder,
as the empty state's own "new session" button does, and the sheet follows
it. With no folder at all there is nowhere to open one, and the error bar
says so instead of the click doing nothing. The request waits for the first
read of the pane list, so a click during startup does not open a second
session beside one that already exists.
A self-signed or company-issued certificate made a page fail with no way
through, while the external browser offered one. The failure now carries
the certificate - issued to, issued by, expiry, fingerprint - and the panel
offers "Proceed anyway (this run only)".
What is trusted is one host and one certificate fingerprint, kept in the
window's main process memory: a restart forgets it, and the same host
presenting another certificate is refused again. Trusting is reachable only
from the window's own page over IPC, so neither the kernel nor the agent
driving the browser can trust a certificate; a certificate error is never
passed by default, since the agent browses through the same views.
Verified in a hidden window against a local HTTPS server: the first visit
fails with ERR_CERT_AUTHORITY_INVALID and the certificate's details, trusting
loads the page, trusting with no refused certificate is declined, and the
same host serving another certificate is refused again.
configPackages arrived with the config inversion untested inside pluginpkg,
which took the package below its coverage floor. The test drives an
installed v2 package through it: an enabled package's command and prompt
roots and MCP servers reach configuration, and a disabled one contributes
nothing.
POST /browser/open waited for the main frame's load event before answering,
so a page whose subresource never finishes - an intranet front end that
references a CDN or analytics host the network cannot reach - held the
request for the whole 30s navigation timeout. The page was on screen within
milliseconds, but the panel did not switch to it, and a clicked link then
fell back to the external browser as if the open had failed.
Session.Visit returns once the navigation commits, bounded by the same
timeout; Controller.BrowserOpen, which only the person's POST /browser/open
reaches, uses it. The agent's browser_open tool still calls Open and still
waits for load, because it reads what loaded. Visit runs the same checkURL
as Open, so nothing becomes reachable that was not.
Measured through the real host, relay and views in a hidden window, against
a page whose script never answers: 30202 ms -> 113 ms. A new blank tab stays
at about 100-170 ms, whether or not another page is still loading.
- guardian moves from safety to runtime: it runs an agent to review a
turn, so it is a turn-engine client, not a subsystem.
- jobs moves from runtime to tools: it imports nothing above the
subsystem layer, and builtin's bash and background-job tools own it.
- recovery.Metrics becomes hostaudit.RecoveryMetrics. The telemetry sink
reads a counter record and no longer imports the recovery gate, which
depends on the agent.
- RedactMessage and RedactMessages move from base/secrets to
contract/provider, built on secrets.Redact, so base imports nothing
from contract.
layer-order reaches 0: every kernel import now points at its own layer or
below. Baseline carried with -allow-widen for one line: recovery/gate.go
gains the hostaudit import.
Three moves close the edges from the contract layer into runtime/evidence:
- The audit records the host emits beside a run (ReadinessAudit,
OutcomeSample, DelegationAudit) move to contract/hostaudit, so event and
trajectory carry them without the ledger that computes them.
ClassifyEvidenceOrigin, which reads delegation text, stays in evidence as
a function over the record.
- taskcontract and plancontract move from contract to runtime: only the
agent and completion consume them, and both are built from evidence
receipts rather than declaring data anything lower reads.
- evidence moves from runtime to safety. It imports nothing above the
subsystem layer, and builtin tools and the trajectory recorder, both
subsystems, depend on it.
layer-order drops from 18 to 5.
The title bar's browser button opened an iframe even in a shell that draws
views, so any site sending X-Frame-Options or frame-ancestors, which many
intranet front ends do, could not load there however the address was typed.
In a shell that draws views it now opens a view, as the workbench's + did.
Typed addresses:
- Only "scheme://" names a scheme, so "intranet:8080" and "localhost:3000"
are a host and a port rather than a refused scheme.
- A host that cannot be public (a loopback, private, link-local or shared
address, localhost, or a name with no dot) is loaded over http directly;
any other bare host tries https and falls back to http.
- A refused address says so under the address bar instead of doing nothing.
Failures: a typed load is judged by loadURL's own answer, since a refused
port never starts a navigation and so raises no did-fail-load; other loads
report through did-fail-load. The panel puts the view away and shows the
Chromium error with a plain reason, a retry, and an external-browser button.
Logins: a page or proxy asking for Basic, NTLM or similar authentication
gets a prompt in Studio instead of Electron's default cancel. What is typed
goes to the window's main process only; the kernel and the model never see
it.
Verified in a hidden Electron window against a local server: a page sending
X-Frame-Options loads, a closed port reports ERR_CONNECTION_REFUSED, port 1
reports ERR_UNSAFE_PORT, a Basic-auth page prompts and loads after the
answer, and a dotted host falls back from https to http.
Session persistence moves from internal/runtime/agent to
internal/state/sessionstore: the Session type, its checkpoint and event
log, listing sidecars, branches, leases, recovery copies, migration, and
the compaction and subagent records saved beside a transcript. The agent
keeps the loop and imports the store; history, historycatalog, migration,
guardian, instanceid and sessiontool now reach the store instead of the
agent, which drops layer-order from 26 to 18.
Tests that exercise only store internals moved with it; the rest stay in
agent and qualify the moved names. DigestSessionMessages and
CompactionStateSchemaV1 are exported for the agent tests that build
legacy fixtures.
Baseline: carried with -allow-widen. The moved files bring their essay,
file-size, complexity and orphan debt unchanged under new paths, and
boot.go, acp/service.go, serve/serve.go, agent/task.go and
control/controller.go each gain the one import line the split costs.
The title-bar toggle drew one fixed half-disc and read the stored setting
rather than the scheme on screen. Under "follow the system" with a dark
system, the first click wrote "dark" and nothing changed. It now reads the
resolved scheme: a sun while light, a moon while dark, and one click always
flips what is shown.
The wordmark's tracking goes from -.065em to -.025em, and the gap between
"reasonix" and "STUDIO" from 1px to 4px.
The card inherited scrollbar-width and scrollbar-color, and while either is
set Chromium ignores every ::-webkit-scrollbar rule. So Electron drew the
Windows scrollbar: its arrow buttons sat on the card's rounded corners and
its track ran through them, and the rules meant to hide the buttons and inset
the track never applied.
The card now sets both standard properties back to auto and is drawn by the
webkit pair: no buttons, the track inset by the 20px corner radius, a 4px
thumb inset 4px from the border, faint at rest, stronger while the pointer is
over the card and when the thumb is held.
Probing an address and listing a provider's models sat in contract/config as
methods on ProviderEntry, so describing a provider and calling one over the
network were the same package, and configuration imported model/openai to do
it. They move to model/catalog: ProbeEndpoint and its reasons, the model-list
URL candidates, and FetchModels / FetchModelsVia / FetchModelListingVia, now
functions taking the entry. A probe sets its one-off key through
WithAPIKeyForProbe instead of the private field.
Configuration now imports nothing above contract. The responses-mode fold test
goes back to config, whose migration it tests; the wizard's model-listing
helpers leave cli.go and setup_manager.go for files of their own.
layer-order debt: 29 -> 26.
Configuration asked model/openai whether a base URL was DeepSeek, Zhipu,
MiniMax and the rest, reaching up a layer for pure host arithmetic that every
protocol package shares. The predicates and DeepSeek's declared image-reading
models move to contract/provider beside IsMiMoEndpoint, named IsXEndpoint;
openai keeps its own names as one-line forwards for its wire code, and loses
IsTokenRhythm, which only its test still called.
layer-order debt: 32 -> 29.
model/billing held two things: what a call costs (fixed-point money, the
official rate tables, quotes and the ledger) and asking a provider for its
wallet balance over HTTP. Configuration, the event stream and its wire form
needed only the first, and reached up a layer to get it.
The data and arithmetic move to contract/pricing; model/billing keeps the
wallet query (balance, cache, the response shapes) and reads pricing like
everyone else. Names and behaviour are unchanged; callers say pricing.X for
what moved. MigrateLegacyUsage's orphan finding travels with its file
(-allow-widen for the carried entry).
layer-order debt: 40 -> 32.
Making a theme meant knowing that packs are read from <state>/themes/<id>,
which nothing in the window said. The theme section now has two controls:
- Import theme… takes a .zip, or a pack folder's theme.json and images
selected together. The page sends bytes, never a path, so it works from a
browser tab and against a kernel on another machine. The kernel keeps only
the manifest and the two images a pack may carry, validates the manifest
with the reader every pack goes through, and swaps the directory in whole,
so a failed import leaves the previous version of a pack intact. A pack
that is not one refuses as theme.not_a_pack; a disk that would not take it
as theme.install_failed. After an import, "Use now" activates it, since a
pack with a picture lands in the folded list.
- Open themes folder creates the directory if needed and shows it in the
system file manager.
Ids are the manifest's, then the folder or archive name; the dot entries and
the plugin: namespace are refused, and List skips dot-named staging dirs.
contract/config imported eight packages from the layer above it. This takes
five of them out, each by moving the piece to where it belongs rather than
hiding the import:
- The installed plugin packages merge into configuration through data config
declares (InstalledPackage, PackageMCPServer); pluginpkg converts a parsed
package into it and names itself the source at init. How a package merges
with what the person wrote, conflicts included, stays in config; how a
package is parsed never enters it. That also breaks the loop that kept
command dirs typed by the command package: config names CommandDir and
command.Root is an alias of it.
- A permission rule's syntax is the form config stores it in, so Rule and its
parser move to contract/permrule; permission keeps both names.
- mcpdiag has no dependencies and moves to contract. The directory move itself
landed in 03e0cb894, swept in from a shared index; this completes it.
- The workspace path fingerprint is a pure function of a path and moves to
base/workspaceid, with the same result.
- The system-one migration writes the hosted address it was written for.
computer_act and computer_read now have one description on every platform,
naming the difference (Meta+s or control+s; paste needs the front on macOS, on
Windows typing brings it forward), so the generated tool contract, the schema
budget and the cached prefix no longer depend on the host OS.
layer-order debt: 47 -> 40.
Project and conversation titles were both 11px, but a project name is
usually Latin lowercase and a conversation title usually Chinese, whose
glyphs fill the em box; at one size the child read larger than its parent.
The project name is now 12px, between the machine's 13px and the
conversation's 11px, with the conversation title's tracking.
The card was painted on .flow, which scrolls with its content, so its bottom
edge ran under the composer and was cut flat there. It was also centred in
the scroller's width less its scrollbar while the composer was centred in the
full width, which set the two 5px apart.
The scroller is now the card: fixed between the tab strip and the composer,
the scrollbar inside its rounded edge, and the same width formula as the
composer so their edges line up.
internal/ was 141 packages side by side, so nothing but a reader's memory
said which were foundations and which assembled the rest. Each now sits in a
layer directory, and the directory is the declaration:
base L0 foundation with no domain in it
contract L1 types and interfaces the layers above agree on
model, tools, safety, ext, state, platform
L2 subsystems, peers of one another
runtime L3 the turn engine
session L4 the controller
assembly L5 the composition root
frontend L6 cli, serve, acp and the host adapters
Only paths change: package names, code and behaviour do not. Imports,
repolint and coverage baselines, sensitive paths, CI package lists and docs
follow the new paths; release notes keep the paths they were written with,
and sample paths inside tests and fixtures keep theirs.
repolint gains layer-order: a package may import its own layer and those
below it, read from where it lives. The 47 imports that point upward today
are recorded as that rule's opening debt (-allow-widen, a new rule's first
baseline) and can only go down. Most of it is config, which still reaches
into eight subsystems and is the next thing to take apart; the rest is
event, history and a few tools reaching into runtime for types that belong
in contract.
Only the project holding the focused pane dropped the node's 12px inset, so
the project a fresh window opens into sat one step left of its siblings until
focus moved. Remote projects already sit at the uninset position; local ones
now match.
The shell cleared look.wallpaper before applying the user's appearance, left
over from when packs were kept off the shell; packs came back and the
wallpaper stayed stripped, so an upload saved and never showed.
The glyph was centred on a guessed origin 8 units right of its bounding box;
it now sits on the box's centre.
The tray had one 16px bitmap, which a scaled display enlarges. It now ships
@1.25x/@1.5x/@2x/@3x variants that nativeImage picks by scale, rendered
without the tile's margin so the slot is filled. The .ico gains 20 and 40.
A runtime could only replace a tool by name, and that slot was never routed
to it, so a plugin that wanted to add one had to ship an MCP server. A
runtime now declares tools in its manifest, under runtime.tools with the
tools capability: a name, a description and an object input schema, known
before the process starts and shown in the install plan and the package
list. At initialize the runtime names the declared tools it serves; one the
manifest does not describe fails the handshake as capability_not_declared.
The model sees each as ext__<plugin>__<tool> and reaches it through the
capability catalog the way it reaches MCP tools, so installing or reloading
a plugin never moves the cached prompt prefix, and every call passes the
permission check under that name. A call is the new host request
extension/tool/call, bounded at five minutes; isError carries a failure the
tool reports about its own work, apart from a call that could not run.
A runtime that failed to start contributes no tools.
The Go SDK serves them from Options.Tools and names them in the handshake.
An effect test drives a call through the real assembly to a fake runtime and
back to the model, and fails with the registration removed.
Both were parsed by pluginpkg and went nowhere, while the docs said they
worked. A package's prompts are now discovered with its commands and invoked
the same way, /<plugin>:<name>, which is what the manifest documented. Its
themes are Studio theme packs: an entry names a pack's theme.json, and the
theme library lists it as plugin:<plugin>:<directory>, read in place from the
plugin root with its own images, never copied into the user's library, and
gone when the plugin is disabled. The retired desktop's .reasonix-theme
archives are not a format Studio reads, and the docs now say so.
The plugin docs are brought in line with the code: the Studio installer takes
a repository address or a folder (a .zip installs through the CLI), the routes
Studio drives replace a list of Wails methods that no longer exist, and the
protocol documents the panel and view surface kinds it already carries.
A spark button beside attach (Ctrl+Shift+E) asks the kernel to rewrite what
is in the box. The rewrite is offered in a card above the draft — adopt, try
again, or discard — and the draft is only replaced when it is adopted; a card
over a draft that has changed since says adopting will overwrite it.
The rewrite is Controller.RefinePrompt, so every frontend can drive it, served
at POST /prompt/refine. It is one bounded no-tool call on the entry the
session resolved, with reasoning off, reading the draft, the workspace name
and the last four turns so a reference like "that bug" can resolve. It keeps
the draft's language, paths, code and scope, and adds nothing the person did
not ask for. Usage is billed as its own source, prompt-refine. Each reason no
rewrite is made carries its own code: empty, too_long, no_model, timeout,
no_answer, failed.
Assembling the goal evaluator moves out of boot.go beside the refiner, and
the history accessors out of controller.go, so neither file grows.
The key action named only the keys a handful of shortcuts needed, so a
control+b, an F5 or a digit had nowhere to go but a refusal. Both helpers now
press every letter, digit, F1 to F12, insert and the punctuation keys, with
the same modifiers as before; the refusals of keys the shell answers stay.
A C++ helper speaks the macOS helper's protocol unchanged, so the kernel,
permissions and tools drive both alike. It reads applications through UI
Automation, captures a window with PrintWindow and encodes it with WIC,
injects input with SendInput, and draws the agent's cursor as a click-through
layered window, with Escape stopping a run while that cursor shows.
An application is named by its package family name when it is packaged and
by its lowercase exe name otherwise; the helper also reports the exe, and a
refusal under either name holds. Console windows report whichever program
owns the console, so no name can refuse them: the helper excludes them by
window class. A process with more privilege than Studio is refused as
computer.elevated rather than failing as a broken application.
Windows delivers keys only to the foreground, so typing, keys and paste bring
the application forward first, and the approval card says so
(computer_front). Pointer and point clicks check the window under the point
again at the instant of input, a hold ends when the application leaves the
front, and a drag always releases its button.
build:host builds the helper with MSVC found through vswhere; CI fails
without it, a dev build only loses the feature. Live tests drive a pure-Go
Win32 probe through the real helper.
When a turn had to wait for another session writing the same workspace,
the notice said "another session is writing this workspace" and carried,
as its detail, the English sentence "workspace write lease is busy;
read-only work remains concurrent". With several windows open the
person had nothing to go on: which conversation to look at, or whether
there was one at all, was left to guess.
A session now names itself when it takes the lease, from the title the
sidebar shows or, before one exists, its first message; only the cached
title is read, so naming a holder never costs a model call. A waiter in
the same process reads the name off the in-process lock, and one in
another process reads a 0600 note left beside the lock file and removed
on release. The notice's detail is that name, as data rather than
prose. Paths, pids and tokens stay out of it, as the lease's State
already promised.
The controller's lease surface moves to its own file and the session
title helpers join the rest of the title code, which pays for the new
lines and lowers both files' budgets.
A remote serve resolves every model call through the provider broker on
the machine that started it, reached over an -R forward. The serve read
that broker's address and token once, at launch, so the reuse check
refused any connect that published the broker elsewhere, and the
bootstrap then stopped the running kernel and started another. Every
other process that connected to the same host did that: a second Studio
window, a restarted one, another computer on the same account. The
conversation open in the first window lost its kernel mid-turn and read
"the kernel on this host is not answering". A reconnect that could not
get its old remote port back left the kernel dialling a port that no
longer existed.
The serve now takes --provider-broker-file, one 0600 file holding the
broker's address and token, and reads it on every request, validating
the address as loopback each time. The broker client asks an Endpoint per
request, so providers resolved before a move follow it. A kernel launched
this way records broker_file; reuse rewrites the file under the serve
lock instead of replacing the kernel, and a link that comes back on a
different port re-points every kernel on it, one reconnect at a time.
Kernels launched the old way are still replaced as before, and the flag
probe upgrades a binary that lacks the new flag.
Address and token share one file written by a single rename, so no read
pairs one connect's token with another's port, where a squatter on a
released port would receive both. The remote state directory is made
0700 and an atomic write narrows its temporary file before writing, not
after. The broker client no longer follows redirects.
The most recent connect's broker serves every conversation on that
kernel. That is no more than the SSH account could already do, since it
used to relaunch the kernel onto the new broker anyway; a window naming
which machine it resolves through is left for later.
Removing a session, a folder, a remote machine or its folder, or the
model source a conversation is on was refused whenever a pane merely had
it open: has_open_pane, has_open_panes, model_in_use. The person asked
for the delete; an idle pane showing the thing is not a reason to say
no, and a window full of such refusals reads as one that will not let
go of anything.
The hub now splits "held by a pane" into running and idle. A pane
mid-turn still holds the delete, answered as session.running,
workspace.running or remote.running with the count, and nothing is
closed while it waits. Idle panes, local or remote, are closed and the
delete goes through. A remote pane's state is asked of its own runtime
over the link; one whose link cannot answer is running nothing this
window can see.
The model source an idle conversation is on can be removed: the
conversation moves to what remains, and when nothing remains the
default is cleared, which lands the window back on connecting a model,
the same screen a first launch shows. Only active work refuses it, as
provider.running. Removing a source that is already gone is the state
asked for and answers 204 rather than a sentence. The provider list now
offers delete on the source in use too.
The sidebar closed a pane before deleting whatever it held without
asking whether that pane was running, so a delete could stop a turn. It
now closes only idle panes itself and leaves a running one for the
kernel to refuse, and the confirmation says so.
A user's recording showed the empty window with no folder, its one
button "open a new session", and every press answered in English: "no
workspace to open in — add a folder first". The kernel raised that as a
bare error, so it reached a Chinese window as the kernel's own sentence
and the window could not tell it from any other failure. It is now the
coded refusal workspace.none, and the empty state no longer offers a
session there is no folder for: with no folder its button adds one,
through the same picker the sidebar uses.
Reaching that state in this build meant closing the last pane, and a
reload then showed nothing at all. The page root was answered by the
first pane, so with none it was a 503; the boot probe asked a pane's
/status, which failed the same way and in a shipped build ends in "cannot
reach the kernel"; and the app held its whole tree behind provider
setup and the welcome flag, both read through a pane's port that no
longer existed. The hub now serves the page itself when no pane is open,
to a request past its auth gate only, since "/" is public in token mode;
the probe asks the hub's own /runtimes; and with no pane the app stops
waiting on setup and the welcome, which the next pane reads again.
The Studio workflow's census gate has failed on every studio commit
since the link router landed: three inputs proven to write the host
named no action, so the product's own vocabulary could not account for
them. The folder picker in the extension dialog, the compaction
threshold presets and the window-wide link router now carry
extensions.pick-folder, compaction.threshold and external.open, the
last registered through listenAction as the registry already describes
a transcript link.
A remote machine's sessions were listed under it but could only be
opened: the local rows carry a menu with delete, the remote ones had
nothing, so a conversation left on a server stayed there unless someone
went over and removed the file by hand.
Each remote session row now has a delete button, quiet until hovered
but never hidden, and the same confirmation the local rows use. The hub
forwards the removal to that machine's kernel over the link its list is
read through, taking one for the call when no pane holds it, and reads
the list again after. A pane holding the conversation is closed first,
since the far kernel will not erase a transcript that is still held.
When the far kernel refuses, it is the one that knows why: a pane open
over there, another process writing. Its refusal used to arrive only as
remote.kernel_refused with the raw body as detail. The far reason now
travels as structured parameters, and this route re-raises it under the
far kernel's own code and status, which the window already knows how to
say.
The usage panel reported a month of DeepSeek traffic at roughly a
hundred times what it cost: on this machine USD 192.92 for records that
sum to USD 1.94, and a user's report put CNY 1,702 on spend they knew to
be well under 200. Tokens were right; only money was multiplied.
ReconcileFile rebuilt a file's records and the rollups of its days, but
left usage_cost in place while re-adding every row's cost to it. Each
pass over a file added its whole cost again, and files are reconciled on
every hash mismatch and directory scan, so the factor grew with how
often a day had been rescanned. The same pass deleted a day's rollups
wholesale, so a second file filed under that day lost its tokens.
Records now carry the cost they were quoted at, and a reconcile derives
the affected days' rollups and costs again from every record that
remains, whichever file wrote it. The live append path still adds one
new row at a time. The schema moves to v4, which retires the inflated
projection and rebuilds it from the stats files on the next open.
agent.go carried the whole mid-turn guidance surface (Steer, SteerItem,
SteerHostNotice, the consume, close and flush paths, the unapplied-steer
notice) while the inbox type and its other Agent methods sat in
steer_inbox.go. They move there, and the orphaned comment describing
steerEntry goes back onto the type.
The move is what pays for giving renderRoot its own line in the Agent
literal: squeezing two fields onto one line kept agent.go under its
file-size budget by hiding a line rather than removing one. agent.go is
93 lines shorter, Steer's doc fits the comment limit instead of carrying
its excess across, and the baseline records the lower budgets.
On Windows the bash tool prefers Git Bash, whose MSYS programs take NUL
as an ordinary path. The Windows habit of discarding into it, as in
ssh -o UserKnownHostsFile=NUL, leaves a regular file named NUL in the
working directory instead: nearly undeletable from Windows tools, since
every path API resolves the name to the device, and sitting where the
next commit picks it up. One landed in this repository's root holding a
remote host's key.
The host can see it happen and the model cannot, so a foreground command
under Git Bash now checks the working directory before and after, and a
NUL file the command created is named in its result with the cause and
the remedy. The check reads the directory listing, the one view that
sees the file rather than the device. A steer in the tool description
was the other option; it moves the cache-stable prefix for every
Windows session and exceeds the schema budget to warn about a mistake
most sessions never make.
A relay forwards someone else's model, so its effort ladder cannot be
probed, and the composer showed "not declared". Its only row said to
declare levels under the source's requests and capabilities, which holds
a thinking on/off switch and nothing else; the real control was a
protocol select behind a fold labelled as an unremarkable line of text,
and a custom vocabulary had no control at all, only supported_efforts
in the config file.
That row now opens the running source's editor with the reasoning fields
unfolded and focused. The editor takes the levels the endpoint accepts
and the one auto resolves to; the kernel stores them as the effort layer
reads them and refuses a default outside them as
provider.default_effort_not_listed. Under Kimi K3 and "none", which
carry no custom vocabulary, the fields keep their values but stand down.
The fold is a titled card that names what it holds and shows the
protocol and level count while closed.
The composer read the model list once at mount, so a ladder declared in
settings stayed "not declared" until a reload. Provider edits now reach
the window's settings pulse, and the model and effort menus re-read the
list when they open, which also catches a config edited outside Studio.
A remembered approval reached the window only as the kernel's English
sentence, so a window in another language could not say it and could
not show the rule it saved. The three outcomes (saved, already covered,
failed to save) now carry notice codes. Their detail is the rule's
subject as a person reads it, drawn as code under the notice.
The version panel treated a Studio run from source as a failure to read
versions and offered a retry that could never succeed. The
studio.no_install refusal is now read by its code and the panel says
this is a development build.
The shell list showed Git for Windows twice, once for bin/bash.exe and
once for the usr/bin/bash.exe it launches. It now offers one row per
install and keeps a pinned path as the selected one.
The workspace list of a remote machine could be read only through a
pane already open on it. Without one the kernel refused with
remote.not_connected, so after a restart the sessions a person came back
for stayed hidden until they opened something there. The hub now takes
a link for the read and gives it back: the far kernel outlives the link
and its session book is on its own disk. Listing publishes no pane.
Each machine row has a read/refresh button. The window remembers which
machines it has read and reads them again on start. The machine-book
hook's key separator was a literal NUL byte, which made git treat the
file as binary; it is now a space.
Network settings belong to a machine, not a pane. Settings now edits
the network of a local pane, because model requests leave through this
machine's broker. When only a remote pane is open it says whose network
is shown.
The boot screen timed itself off its own CSS animations and left as
soon as they finished, often before the app had anything to show. A
bundle that failed to load could leave a blank screen.
The screen is now a scripted intro on a night sky: a meteor, the R
struck together from shards, the wordmark unfolding. It marks each
startup step that has actually happened (bundle, kernel, app) and holds
the wordmark until the app reports it has settled, with a cap for a
shell that never does. It then settles onto the app's own page colour.
If the intro never runs, the wordmark still appears.
The application icon is redrawn to match. It has a single SVG source
and a script that renders every .png, .ico and .icns from it.
The kernel listens on a new loopback port each launch and localStorage
is keyed by origin, so every launch opened on a page that remembered
nothing. The Electron shell now keeps the page's own rx- preferences in
a file under userData and restores them before any page script reads
them. Only the Studio window may read or write that file; the agent's
browser pages cannot.
The Studio stylesheet carried about 150 scheme-scoped hex literals. They
outranked a theme pack, so floating panels, code blocks, sunken grounds
and syntax colours stayed on the default palette whatever pack was
chosen. The pack vocabulary now names float, floatHi, codeBg, sunkBg and
four syntax colours. Every shipped pack sets them, held to AA contrast,
with syntax held on the code ground. A pack that predates these tokens
derives them from the surfaces it does set. A test holds the kernel's
vocabulary and the frontend's CSS mapping to the same set of names. The
stylesheet reads the variables, bringing the carried literals down to
24.
Unreferenced rules (the old run header, trajectory timeline, graph
lanes, side peek and receipt rows) are gone. So are the stylesheet
comments, which move to LAYOUT.md where they state a constraint. The
gutter rules stay: their class is built as gutter-${edge}, which no
literal search finds, and without them the pane dividers lost their
handles.
Guardian, memory, extension, compaction, ask and approval cards now
share one framed host style. The tag says who is speaking rather than
an event name. A guard's verdict is translated and a critical risk is
named. A failed delegate reads as interrupted, not delivered. The
delegate chip shows only while one is running, since a chip left after
the work stops reads as work still going.
A workspace file opened as a highlighted Markdown fence, and editing it
meant switching to a bare textarea. The file now opens directly in a
CodeMirror editor that loads with the first file opened and pulls each
grammar only when needed. The editor is painted from the theme's own
syntax and ground variables, and has its own find (Ctrl+F), go-to-line
(Ctrl+G) and save (Ctrl+S). The window's shortcuts leave alone a key the
editor has already handled. Picking a file from the docked list now
shows the file instead of leaving the list over it.
The browser column did not follow the agent. A page the agent opened
stayed behind the blank start page, and the column opened only if the
person asked for it. The column now opens when the agent opens a page in
the pane being watched, and the start page gives way to the agent's page
and to any new tab. A strip wider than the column scrolls the shown tab
into view, and the column folds only when its last tab closes. A tab the
person opens from the window now sits beside the agent's without taking
over the tab the agent's calls land on. The footer note about sites that
refuse framing, which no longer applies, is gone.
Every foldable part of a conversation had its opening behaviour decided
in its own component: thinking always closed, an activity group forced
open while a call ran, a step open only on failure, long output clipped.
None of it could be changed, and the forced opens overrode a block the
reader had just closed.
Appearance now carries a Transcript folding group with a preset and one
row per part (thinking, activity, step details, long output and the
compaction brief), with a live preview. "Live" keeps an activity group
open for the whole running turn rather than only while a call runs. A
block the reader opened or closed keeps that choice when the preference
moves.
Find stopped reaching rows that were virtualised or not yet mounted,
and a hit inside a folded group was painted where nobody could see it.
Each transcript row now carries its item id. Find lands on the hit by
block, opens every fold around it, clears the find bar, and repaints as
rows mount. A row nested inside another is painted once, under its
nearest row.
Failure diagnosis ran over the whole fold region before the compaction
card went up. A hand-typed /compact over a history with failed commands
therefore sat silent through one model call per failure. Failures that
were about to be folded away also paid for a diagnosis they would never
use.
The card is now emitted first. Diagnosis runs afterwards, and only on
the failures the policy retains, since a folded failure never reads its
selection.
A turn that wrote an HTML page or an SVG could finish on the strength of
a check that proved the file parses, which says nothing about whether it
looks like what was asked for. Nothing in the ledger could tell a page
that had been seen from one that had only been written.
A screenshot now records which workspace file it showed, read off the
URL the browser reports rather than off the model's arguments. Each page
or image written since its last screenshot is owed as an unseen_render
obligation, and final readiness holds the turn until it is looked at or
the look is declared impossible. The obligation exists only where a look
can be taken: boot supplies a render root only when the session has a
browser and the model reads images. Where the turn wrote nothing but
pages and the project declares no checks, a look stands as the check.
A browser_act the host classified as passing also counts as a
verification on the completion card, so the card no longer calls such a
change unverified. The new gap is carried through the readiness audit
and the trajectory.
The route binds the runtime as {id}, and the refusal read {rt}, which no
route declares. Every request to a runtime that had gone away was refused as
"no runtime named ''", and the window said 找不到名为「」的 runtime — a
refusal naming nothing, with no way to tell which pane had lost its runtime.
When the person closed the browser window, the next step heard
browser.no_tab: "no page is open; open one first". That is an instruction to
reopen, and the model took it — reopening the window the person had just shut,
asking for approval each time. The session knows the page went without the
agent closing it: the browser destroyed its target, or the browser itself
exited. That cause now reaches the model as browser.tab_closed, telling it to
ask before opening the page again.
CloseTab removes its tab before closing the target, so the destruction it
causes is not read as someone else's.
A model that calls tools before saying anything still streams a message,
usually with a blank thought. The transcript filed the following work under
that message and then drew nothing for it, so every call before the first
sentence vanished: of six calls in a real run, two were shown, and the one
missing was the failing test the diagnosis rested on. Work now files under a
sentence that is drawn, and a message with no words yet still draws its
speaker when work hangs under it. A blank thought no longer reads as
"thinking 0.0s, 1 character".
The completion menu reset its dismissal in an effect keyed on the answer,
which runs after the commit that opened the menu. A blur landing between the
two was undone and the menu came back. The dismissal now names the answer it
dismissed.
The browser gate read a file URL's path and ignored its host, so
file://elsewhere/C:/<workspace>/x passed as a workspace file while Chrome on
Windows opens it as a UNC share on another machine. A host other than
localhost or a drive letter now names no local file, and a bare drive (C:),
which resolves against the working directory rather than the drive root, is
refused.
Escape during a computer-use run compared the stop time against the run's
start. Windows advances time.Now by timer tick, so a stop inside the tick the
run started in compared equal and the run carried on. The stop is now counted.
The rest is CI debt:
- golden prompts and TOOL_CONTRACT.md regenerated after the browser_act
description change
- desktop go.sum tidied after the terminal removal
- the three OAuth concurrency tests the terminal removal deleted are restored
against ReconcileHTTPMCPOAuthAfterRemoval, the production writer that still
bumps the generation; their loss put internal/plugin under its floor
- the broken-config test reads the resolved user config path instead of
assuming ~/.reasonix, which is not where Windows keeps it
- frontend tests run without vi.mock or fake timers: the launch probation
waits in real time, a missing settings chunk is a real failed import, and
format switches language through boot()
Reasonix ships Studio; the `reasonix` binary exists because Studio installs it
on remote machines and the e2e bot drives it. Nobody sits at a terminal on
either, so the chat TUI was 36k lines cross-compiled to six targets and shipped
to machines that would never run it.
The binary stays, and the two things that need it keep working, because both are
measured rather than assumed. internal/remote/bootstrap launches
`reasonix serve --addr --auth --token-file --port-file --pid-file`, having first
parsed `serve --help` to check those flags exist; e2e-bot.yml drives
`reasonix run --metrics`. Both are untouched.
What went:
- the interactive entry, so bare argv is a usage error rather than an invitation
- 233 methods on the TUI model, stripped in place so a file that also held a
command kept the command
- the views, pickers and cards behind them, and the 42 test files that only
covered them
- 17 exported kernel functions the TUI was the last caller of, each checked
against what Studio actually calls first: boot.RebuildFrom (Studio uses
Rebuild/BuildRuntime), control.SaveAttachmentFile and friends (serve saves its
own bytes; the symlink checks guarded attaching a file *by path*, which only
the CLI could do), plugin.ClearHTTPMCPOAuth and mcpdiag.DiagnoseAuth (no
surface anywhere)
- mcpdiag.IsAuthFailure, which matched 401|403|unauthorized against prose an
external server wrote — the phrase table REASONIX.md says was retired, left
behind with no caller
cli leaves frontend-parity and the port-segregation guard, in both tables with
the reason: it launches serve and a one-shot run now, so a session capability it
does not drive is not debt. --preset joins run's completion, which it always
accepted and was only ever offered on the interactive command.
TestMain moved out of chat_tui_test.go. It pins the language for the whole test
binary, and two render tests started failing on this machine without it —
exactly what its own comment predicted.
internal/cli: 246 files to 162, 35,636 non-test lines to 18,224. repolint's
recorded budgets fall with it — complexity 1383 to 1014, file-size 29,492 to
24,191, frontend-parity 129 to 32 — and no ceiling was raised.
The shell asked for /_studio/ after the kernel stopped serving that namespace,
so index.html came back for every module the page imports: three script
requests answered 200 with text/html, strict MIME checking refused all three,
and the window sat on "connecting to the kernel" with React never mounted. The
page owns the root, which is where its relative asset paths already pointed.
macOS draws its window controls over the window's corner, and that corner
belongs to the rail rather than to the title bar, so they landed on the
wordmark. The reserved corner is a pair of tokens the rail head and the chrome
row both read, applied to whichever of them the rail state leaves there, and
the strip the rail gives up drags the window the way the bar it replaces does.
Their y is set rather than inherited: AppKit seats them nine points above the
line this row centres everything else on.
A reply's menu draws above the row that anchors it, and the row closed it when
the pointer left — but leaving the row is how the menu is reached, so it shut
on the way there, in the 5px offset that belongs to neither. Dismissal is
useDismiss, the one every other menu answers to. The deck reading has the same
shape and keeps its hover, so its anchor spans that offset instead.
The [desktop] table is written by hand, one fmt.Fprintf per field, so a field
added to the struct without a line in the renderer is dropped on every save.
There is nothing to notice: the control works, the file is written, and the
setting is gone on the next launch.
`editor`, added two commits ago, was exactly that. Anyone who named their editor
would have found it blank again the next time they opened settings.
The gate is the fix. It reflects over DesktopConfig, gives each field a value
that field accepts, renders, reads back, and reports every one that did not
survive. A marker the loader normalises away comes back as the default and is
indistinguishable from a field that was dropped, which is why the values are
the fields' own rather than one placeholder for all of them — two of the three
first failures were the test's fault for exactly that reason.
Three fields are exempt, each with its reason in the table: update_channel and
expand_thinking are read for compatibility and never written, and currency is
superseded by [billing].display_currency.
Checked the other tables the same way. background_jobs, system_one, wallpaper
and reasoning_display_mode are rendered through helpers. The six [agent] fields
with no renderer — auto_plan_classifier, soft_compact_ratio,
tool_result_snip_ratio, compact_force_ratio, context_editing, cold_resume_prune
— are the ones boot.go already reports as removed from config, so not writing
them back is what they are for.
Compared against the prototype, Studio's remote surface already carries more
than it does — a connection test, a proxy jump, ssh_config following, secrets
named by environment variable rather than typed, several workspaces per machine
— and the one thing the prototype states that this did not is which credential
gets used.
Leaving the key fields blank is not "no authentication". The kernel tries
ssh-agent's keys first, then the default keys under ~/.ssh, and reaches a
password only when one of the named variables is set or the machine asks
interactively. That order is the kernel's to say, and a reader left to guess
between three of them finds out on the first connect. It is on the form now.
Two comments in that file were in Chinese and are in English, per the tree's
own rule; the interface strings are untouched.
Also fixes the launch-health flake, which predates this branch and fires with
isolation on, so it was never a pooling artefact. The test sampled `said` part
way through a probation measured on a clock that advances by itself — a race
with whatever else the machine is doing, which says nothing on the run where it
loses. It reads the moment off the acknowledgement's own timestamp instead.
Verified by sabotage: with PROBATION_MS at 0 it fails with "expected 920 to be
greater than or equal to 2000", and three full runs are green.
Every http link anywhere in the window was intercepted and handed to the
machine's browser. That was right when Studio had no browser of its own; it has
one now, and it is the one the model can read and drive. A page opened outside
is a page nobody in this conversation can see — not the person who clicked it,
and not the model that would have to be told about it by hand.
A link now opens a tab in that browser and reveals it. Ctrl, Cmd or Shift is
the way out to the machine's own browser, and a shell that draws no views —
a plain browser tab on `reasonix serve` — has only that way. A kernel that
refuses to open one falls back rather than leaving a click that did nothing.
The handler moves out of App into useLinkRouting, because a rule about where
every link in the product goes should be readable and testable on its own
rather than as an effect halfway down a 700-line component.
Links inside a drawn page were already staying inside it: will-navigate allows
any http origin but the kernel's, and target=_blank becomes another internal
view rather than an OS window. Nothing there needed changing.
A button beside the file list, which is the one place the workspace is already
what you are looking at. The kernel opens its own workspace root rather than a
path the request names — taking one from the client would make this a way to
open anything on the machine.
internal/editor discovers what is installed the way internal/browser discovers
a Chromium: VS Code, Insiders, Cursor, Windsurf and VSCodium, by the paths their
installers use and then by PATH. Installed paths first on Windows, because
`code` there is a .cmd shim. A configured [desktop] editor is taken as given and
is the only candidate: naming one is how a machine with several says which, and
a search that found something else first would make the setting advisory.
Three outcomes, three codes: no editor installed asks the person to install or
name one, a launch that failed does not, and a kernel with no window says so
rather than opening a window nobody is sitting at. The button reports which
editor opened it, because a control that does nothing visible is
indistinguishable from a broken one.
Also takes `isolate: false` back out of the test config. It was fast — about 9s
against 15 — and it made the suite intermittent: a render test passed alone,
failed in one full run and passed in the next with nothing changed. A gate that
goes red by arrangement teaches people to re-run it rather than read it. The
threads pool stays, which is most of the win that does not cost correctness:
19.4s to 12s, stable across three runs.
Sub-agents and background jobs are readings about this turn, so they sit with
the turn's other readings at the right end of the run rail instead of at its
left, and the detail is inside the same anchor as the reading rather than a
panel that opened above the whole row. Hover reaches it, so does keyboard
focus, and a click pins it — the context reading already worked this way, and a
row where each control answers to a different gesture is a row you have to
learn.
The two chips are written out rather than sharing a component that computed
`data-action` from a template literal: the actions gate reads those names out
of the source, and a computed one is a name nothing can check.
Fixes a typecheck failure I committed in 71a63d325: vite.config.ts derived the
isolated-test list with node:fs, which this project has no types for. The list
lives in src/testing/isolated.ts now, and isolated.test.ts holds it to what the
sources actually mock — so it still cannot drift, and the config stays free of
node APIs.
The kernel has had these notifications since the CLI: a turn finishing, a stop
for approval, a question. Studio's host wired them and then never gave anyone a
way to turn them on — the only switch was a hand-edited config.toml, which is
why they read as missing.
Three things were wrong beyond the missing screen. The host decided at boot
whether to wrap a runtime at all, so "notify me" meant "notify me after a
restart"; every runtime is wrapped now and the sink reads a holder the settings
endpoint stores into, which is what makes the block honest in saying it applies
immediately. The bodies were English literals in a window set to Chinese; they
come from the catalogue now, like the tray's. And a kernel reached over the
network registers no route at all, because a notification fired there lands on
the server's desktop rather than the watcher's.
The block is one switch with three branches, drawn rather than greyed out of
existence, and it draws nothing where the kernel has no window to notify from.
Tests: the sink delivers once the switch flips on a runtime built while it was
off, stops when it flips back, and answers in the window's language; the block
writes what was asked and keeps what the host answered back.
Also splits the test suite by what needs a private module registry. `vi.mock`
cannot share one — a module another file already imported unmocked stays
unmocked — and format.test.ts began failing in the full run while passing alone,
which is exactly that. Those files run isolated; the rest keep the shared
worker. Which files they are is read out of the sources, never listed. 19.4s to
8.8s, verified under --sequence.shuffle.
Quoting a whole answer to ask about one sentence is not quoting. The button now
takes what is highlighted inside that card, and the quote rides above the box as
a chip the way a long paste already does — an answer pasted into the composer
becomes the composer. Which reply it is stays the kernel's to say: the turn its
checkpoint named travels with the text and is stated to the model, and a
transcript rebuilt without checkpoints sends no turn rather than a guess.
The token readings move while the model writes. usage only lands when a round
closes, so received is estimated from the chunks themselves and replaced by what
was billed. The two share one place, so which is on screen is said: an estimate
is drawn in --muted with ≈ on its unit. A number that just moved lights and lets
go on a timer; reduced motion keeps the numbers and drops the movement.
The receipt card was the only transcript card faking the gutter with a magic 42px
and owning a private row vocabulary. It is a host card now, each item a .find, so
a receipt and a notice read as one runtime speaking. The gutter is --call-sym +
--call-gap, stated once, and .nest-bd redefines those rather than re-specifying
the grid.
Tests: one worker per thread, reused across files. Re-importing React, the port
and app.css once per file was most of the run; `pnpm test` goes 19.4s to 9.4s,
verified twice under --sequence.shuffle. What it costs is written down in the
frontend README: module state outlives a file now.
.glyph leaves the mono exception list — it holds PNG/TXT/❝, which are marks, and
it no longer renders a bare string the gate reads as prose.
Ten extractions, each one concern leaving a file that had outgrown the
800-line ceiling: the gate and queue callbacks and the rewind group out of
Pane.tsx, the effort vocabulary out of Composer.tsx, provider-search splitting
out of session.ts, the mock usage report out of mock.ts, stream interrupts out
of provider.go, the steer wrapper out of agent.go, the config-forward chain
and system-prompt resolution out of config/load.go, on-demand MCP connect out
of usecapability.go, and session previews out of save.go. The MCP list filters
move next to listServerInfo, which is where they were always about.
The picker's two refusals now carry codes — picker.unsupported and
picker.failed — so a frontend can say which one happened instead of printing
whatever sentence the host wrote. EnsureBranchMetaLocked and TouchBranchMeta
were exported and called by nothing, including tests; the comment that
survived them narrated their removal, which is the commit message's job.
Also: three comment blocks in Pane.tsx that had drifted away from the elements
they described, one of which contradicted the code beneath it; the duplicated
status-totals dispatch; and three redundant nil checks whose fallthrough
returned the same value they guarded.
repolint is clean for the first time on this branch — every per-file budget
and all five repo-wide ceilings — and -update reclaims the 410 lines of
file-size budget the tree stopped using, so nothing grows back into it.
A queued line is the composer's to show, not the transcript's: leaving it in
the list split the running turn at the moment of typing and handed its work to
a line the model had not read. It now seats at delivery, and the outbox shows
only what is still owed.
Several subsystems were built and never rendered. Plan, Jobs, Agents, the
command palette and the reply actions are now mounted: the plan sits above the
composer as a one-line summary that opens, the deck chips ride the run rail,
and Ctrl K reaches sessions and commands.
Theme work: the sidebar's greys were hardcoded past the token closure, so every
migration silently missed them. Selection reuses the 2px run bar rather than an
accent fill. A ratchet test now counts the literal-colour rules that outrank
the closure.
Browser: manual tabs route through control.BrowserOpen, so what the person
opened is what the model can read and drive — there is no second
implementation. POST /browser/open carries the refusal code
browser.open_failed, and the CLI gets /browser for the same capability.
Credentials: APIKeyEnvFor is the one derivation, beside the validator that
judges it, and ErrInvalidCredentialKey gives callers an identity instead of a
sentence — a provider named "129" now reports the name as the field to change,
not the key that was pasted.
serve: the kernel serves the built page at its own paths and answers
page.not_built when none is mounted. Onboarding belongs to that page, so the
second inline setup page is gone and TestServeStartsWithMissingProviderKey
pins /provider-setup, which is what the kernel actually owes.
The System One decision backends collapse onto the general mechanism: the
hosted endpoint and its gateway become ordinary sources with a role, migrated
once for installs that already hold the old shape.
Also fixes three lint findings that predate this branch (a tagged switch in
agent/task.go, http.MethodPost in serve/hub_picker_test.go), so golangci-lint
is clean again.
repolint's repo-wide ceilings were already exceeded at 9a4ead5cd; every total
here is at or below that commit's. The per-file budgets Pane.tsx, Composer.tsx
and the config/agent files now owe are to be paid by extraction, not by
-update.
It filled the window and the only way out was a click. The dismissal every
other overlay in this window already uses, and a test that was checked against
the code without it.
`/sandbox revoke` with nothing after it said this session had allowed nothing —
the branch that lists them was lost when the command moved under /sandbox, so
the one case a person hits first was the one that lied. The test now walks it.
The clipboard went back 250ms after the paste keystroke, which is the step
saying "the application has surely read it by now" about an application it
cannot see. It has not always; a busy one reads it later and pastes what the
person had instead — their own clipboard, into their own document, silently.
The wait is now 1.75s and the step does not pay for it: it answers after 250ms
and the clipboard goes back on a timer, still only if nothing else claimed it.
Watched a real run: asked to operate the Calculator and show the result, the
model took the screenshot the tool gives it, then wrote sixty-three lines of
ctypes against CoreGraphics to find the window id, ran screencapture into a
file, and opened that file in the browser pane — six or seven calls to put a
picture somewhere it believed a person could look. It had no way to know the
card already draws the one it was given.
Sixteen tokens of schema (6751 -> 6767) against that.
The chain from a tool's image to a card is tested at each seam — the event
carries it, the wire mirrors it, the card renders it — and none of those asks
the real window. This turn takes a screenshot of the page and then reads the
renderer's own DOM for it.
The document opens by saying it is generated from the same canonical schema
path as the runtime registry. It was not: the table was maintained by hand, and
the check only asked whether a row existed with the right read-only flag. So a
description could drift from the one the model is actually sent, and sixteen of
them had — including bash, whose row still told a reader to prefer shell
redirects the tool now tells the model never to use.
The table is written from the registry, and the check compares it. Everything a
person wrote around it stays theirs. A round that changes a description on
purpose regenerates with -update-contract.
"Allow for this session" is written in no file. The rules editor showed the
file, so it showed less than the agent may currently do, and the only way out
of a grant was to end the session — which costs the work as well as the grant.
The rules the kernel is holding ride along with the rules it read, so one
request answers "what may it do right now". A revoke takes one back or all of
them, and is not behind the provider-edit grant: writing the boundary wider is
a privilege, and taking permission away is always the reader's to do.
Studio lists them above the table, each with a way back. The CLI answers the
same question under /sandbox, which is already where it says what the agent may
reach — `/sandbox revoke <rule>`, or `revoke all`.
That command took the boundary view out of chat_tui.go, which is 5468 lines and
where three budgets sat one line from their ceiling. The baseline moves down:
36 lines of file-size, and one frontend-parity edge, because reading the rules
from the CLI is what that view now does.
A screenshot the agent took reached the model and stopped there. The result
text says "[image: screenshot]", which is the tool telling the model a picture
exists — the reader was told one was taken and never shown it. It is the one
thing a person watching an agent operate an application, or a page drawn
somewhere they are not looking, most needs to see.
The tool result carries the images it showed, the wire mirrors them, and the
card draws them under the output: thumbnails, and the full size on a click. No
store and no second request — nothing persists the event, so what the window
needs travels on it.
The rules editor groups by tool and labels each group. A Computer= or Browser=
rule — which is what "always allow this application" writes — matched no label,
so it listed under a blank one, and fell through to the default note saying it
matches by path with * crossing a /. Neither is true of it: an application grant
is compared to a bundle id and only answers when it names one exactly, so a
glob there can refuse but never permit.
Typing a long value one synthetic keystroke at a time is what an editor that
completes, indents or reformats what it is given turns into something else.
paste puts the whole text in through the clipboard — and the clipboard is the
person's, so what was on it goes back, unless something else claimed it while
the step ran.
Measured first, and it changed the shape: an application that is not in front
never handles the keystroke at all. Bringing one forward is taking over the
person's screen, which is a thing they answer for separately, so paste does not
do it quietly — it refuses with computer.needs_front and names both ways out: a
pointer step to bring the application forward, or type and set_value, which
work while it is behind. The live test walks that path and reads the person's
clipboard back afterwards.
The probe application grew the Edit menu every application has. Without one
there was nothing for a paste keystroke to reach, so the fixture could not
stand for a real application.
Real run, asked whether a pricing page breaks at phone width: the model set the
viewport, saw the cards run off the side, and then had nowhere to go — scroll
only carried delta_y. It read the rest by dragging the horizontal scrollbar,
four drags and four screenshots to see three cards.
scroll takes delta_x. 17 tokens of schema (6706 -> 6723).
The request list outlives a navigation, which is what makes it useful — a click
that navigates is exactly when the agent wants to know what was asked for. But
nothing said where the page changed, so a 404 the previous document collected
read as this one's, which is a wrong answer rather than a missing one. Each
request carries the document it belongs to, and the list says where that
changes.
Alongside: the browser nobody could find says when the setting that fixes it is
read. A real run watched the model write [browser] executable into the config,
retry, get the same refusal, and start looking for somewhere to symlink a
browser into instead.
The shell target is a hand-written protocol in this window, not a browser's own
port, so what the kernel's live tests proved against Chromium says nothing
about it. Two checks read the real thing: the page laid out at phone width, and
the model told what the page requested.
Both passed the first time, which is the point of running them — but the
viewport check passed at first for the wrong reason twice over. It handed the
measured width to the argument that takes a condition, so any non-zero width
was a pass; and once that was fixed it read the wrong view, because by then the
page had opened another. The turn now names its tab and the check compares to
what it asked for.
Alongside: drawing a page over the rectangle it already has skips the work. The
panel reports its rectangle whenever anything in the window changes, which
during a turn is constantly and nearly always the same rectangle.
The resilient loader already does the right thing and records why: a user
config it cannot parse is replaced in memory by the last good one, or by the
built-in defaults, without touching the file. Whether anyone is told was left
to the frontend, through OnConfigLoadWarnings — which no frontend sets. Only
tests ever did.
So a typo in config.toml ran the session under another model, with no
providers and none of the person's permission rules, and said nothing. Driving
a headless run into it, what reached the terminal was two lines about a config
upgrade and an MCP migration failing, which name neither the cause nor what
the session is now running on.
Boot writes them to the diagnostic stream when no frontend takes them, so all
four inherit it. It does not claim they were handled: the migration notice a
window would have shown stays owed, because that one reaches a window and this
does not.
Two gaps the other implementations answer and this one did not. A page that
misbehaves is usually a request that 404ed, was refused, or never came back,
and the only thing the agent could see was the console. A layout that breaks
at a phone's width cannot be seen through a window that is not that wide.
- browser_read what=network lists what the tab requested, newest first, with
what came back: status, type, size and how long it took, or the browser's own
words when nothing arrived, or that it is still in flight. text narrows by
URL. The tab keeps the most recent 200.
- Headers and bodies are deliberately not kept. A credential travels in exactly
those, and a list that held them would put them in the transcript of every
session that read it.
- browser_act gains resize: the page lays out in the viewport it is given,
whatever the window is.
The schema surface grows 46 tokens (6660 -> 6706), which every session pays;
both are trimmed to their shortest useful description first.
TestEffectFoldDropsSupersededStandingState fails under that larger prefix, and
was wrong rather than unlucky: it asked a fold to leave strictly fewer copies
than the request before it, while the turn that follows a fold always adds its
own. It now asks for one fewer than the count that request would have carried.
Two packages had written the same size formatter, to different answers: the
storage panel's goes to PB and rounds down, the tool-output notice's stops at
MB and rounds to the nearest. A third caller was about to arrive with the
network list, so the judgement moves to the leaf both may import, and the two
callers read it from there.
The live shell run proved computer use end to end under YOLO, which answers
every prompt — so the one thing the pointer's design rests on was the one thing
that run could not see. It now runs under auto and answers as a person would.
What it reads: granting the application for the session covers operating it,
the accessibility steps go through with no further question, and the pointer
step is still put to the person. Refusing it leaves the application with
nothing — no mouse event in its log, the pointer where it was, and the
frontmost application unchanged — and the model is told it was declined.
A capture waited on the main thread for ScreenCaptureKit to finish, which is
the thread the rest of the helper's work needs; it now answers out of band,
from whichever thread the capture ends on, and the one output stream is
written under a lock.
That was not why a capture hung, though. Measured on macOS 15: while one
process that has captured a window is alive, a capture in any other process of
that same executable never returns — for any application, with no expiry, until
that process exits. Two Studio hosts on one machine is the reachable case, and
an orphaned host is the one that leaves no window to close. So the wait is
bounded at 10s, and what it says names the condition it can observe: the other
helper, by pid.
The live tests were making that state themselves, a helper per test, and the
third one waited out the timeout. They share one session now, which is what a
host holds.
Accessibility can only touch what an application published as an element. A
canvas, a drawn view, a map, a game — the other implementations reach those by
moving the pointer, and this one answered computer.no_action. The live test
pins the difference on one view: AXPress finds nothing there, and the same
point under pointer_click reaches the application as a real mouseDown.
So the pointer becomes an explicit class rather than another step in the list:
- pointer_move, pointer_click, pointer_drag and pointer_position aim in the
pixels of the screenshot the model was given, the same frame every other
point-taking step reads, and the helper posts real events to the HID tap.
- The helper refuses a point whose window belongs to another application, so
an approval for one application cannot walk into the next one's window.
- It is the person's pointer: taking it parks where they left it and the run
gives it back, whether the steps finished, failed part way, or were stopped.
- The permission subject carries a pointer prefix, and that subject is only
ever answered by an exact grant — no posture, no application-wide allow, can
hand over the pointer on its own. The approval says so in as many words.
Alongside it, the steps the other implementations have and an accessibility
tree already exposes: right_click opens the element's own menu, scroll says
whether it turned the wheel or brought a named element into view, hold_key
holds a chord for a duration, key repeats, and wait is bounded.
internal/computer's floor rises 85.8% -> 89.8%.
The golden tool schemas and the committed trace readings are what a test
compares the live assembly against, so they are only useful while they are
what it produces. Two rounds landed without them: the browser gained drag,
upload, forward, reload and find, and an approval gained the two fields that
say which answers the kernel will honour. Both tests have been failing on the
branch since.
Regenerating costs 106 tokens of cache-stable prefix (5335 -> 5441), which is
the schema of the five browser steps and nothing else: the pointer work in the
next commit registers its tools only where a computer is attached, so it does
not reach this baseline.
The scroll step's reveal worked only where an application offers an element a
way to reveal itself. AppKit does not: its scroll areas advertise
AXScrollDownByPage and then refuse to run it (-25205, measured on a live
window), while the scroll bar's own value moves the view. So the geometry is
solved on that instead — nudge the bar, see how far the element travelled with
it, and put the bar where the element lands inside what the area shows,
verifying that it did.
The live test holds it to the effect rather than to the application's own
report: an application that scrolls by pages never hears about the element at
all, so what says it worked is the scroll area having moved.
Read against Anthropic's computer tool (17 members), OpenAI's computer-use
action list and Playwright's MCP server, then filled the gaps that a real run
had already hit.
The browser gains reload — a page whose file changed is served again, which a
run worked around by appending ?v=2 to the address — forward beside back, drag
from a ref or point to another, upload, which hands a file input files from
inside the workspace and refuses anything outside it, and browser_read find,
which answers where text is on a page too long to read rather than paging 250
lines at a time. Verified against a real Chromium: the reload shows the changed
file, back and forward walk this tab, the upload arrives and /etc/hosts is
refused, and the drag travels so the page sees it.
Computer use gains right_click, which opens the element's own context menu
rather than borrowing a pointer, scroll, which brings a ref into view or turns
the wheel at the application, and wait. The keys and the pointer stay where the
person left them, as before.
And the host now names what a locked screen does: measured here,
CGSSessionScreenIsLocked makes every application answer with its own element in
place of its windows, so a snapshot holds a menu bar and a click by point finds
nothing to press. The snapshot, the missing element and the dead point all say
so; typing, keys and screenshots keep working, which is what the failing run
ended up using. The built-in schema budget grows 6346 -> 6512 for the two
vocabularies.
Measured on this machine: Calculator's AXWindows, AXMainWindow and
AXFocusedWindow all answer with the application element itself, whose children
are itself and the menu bar. Safari answers the same way; Finder does not. The
snapshot handed the model 195 lines of menu items with no window in them, and a
run spent twenty calls on it — coordinate clicks answered no_action, focus
failed, and the model ended up writing itself Quartz key-posting scripts.
The tree now says what it is: an application that hands its own element back in
place of every window gets the menus it does have plus the host's note that
nothing inside the window is there to read, click or hit, that typing, keys and
screenshots still reach it, and that relaunching usually brings the window back.
The key action also names its vocabulary when it refuses one: that run tried
"2", "Numpad2" and "Digit2" in turn against a message that said only that the
key was not one it could press, when digits go through the type action.
The card had three answers and one of them lied. "Do not ask again" sent a
grant that dies with the session — the sealed line under it even said so, in
smaller type — and the answer that writes a rule down, which the chat TUI has
offered for as long as it has had a prompt, was not reachable from this window
at all. Operating one application through nine calls meant nine prompts and no
way to say "this application, for this session".
The kernel now says with each request which answers it will act on: a session
grant, and writing the answer down. Both are derived from the call — a fresh
decision takes neither unless its tool allows a session grant, and a controller
with nowhere to write a rule does not offer to write one — so a window cannot
promise what the host would drop. The card draws exactly those: allow once,
allow for this session, do not ask again, refuse.
Verified in the real Studio: granting the session for com.apple.calculator
stopped the per-call prompts for it, and the two prompts that followed were
the ones the grant does not cover — a different subject, and a shell command.
Two things one screenshot run turned up.
The accessibility walk had no cycle guard, and Calculator's application element
lists itself among its children: the tree repeated to the depth cap, 303 lines
and 33 KB of nothing but that element and the menu bar, with the window's own
buttons never reached. The model read that, gave up on refs, and wrote itself
Quartz click scripts to finish the task. Every element is now walked once per
snapshot. The state that starts the walk at the application element rather than
a window was not reproducible on demand; the run that hit it is recorded.
And the full-width browser view left the page in the bottom of the pane: the
column that holds the conversation keeps its place in the body, and an empty
flex child still takes the room. It is not drawn while the pages have the pane.
The live test now checks the reserved rectangle is the pane, which the
comparison against that rectangle could never catch.
Every page the agent opened came back carrying an Electron security warning
about the page having no Content-Security-Policy. The window this browser runs
in injects its own bundle into every page it draws, and that bundle warns there
— so the model read the host talking to itself as the page reporting a problem,
on every read, and had to decide each time whether the site it was looking at
was broken.
A console message or exception whose every frame comes from a script the page
did not load — this window's bundle, an extension, devtools — is not the page's
and is dropped. The stack says so; nothing here reads the text. A message with
no stack at all still counts as the page's: unattributed is not the host's.
Watching the agent browse and reading what it says are one activity, and the
window made them exclusive: the pages were a pane view, so seeing them meant
leaving the transcript, and a run that opened one said nothing about it — the
reader had to know to go looking. Someone testing it asked how they were
supposed to watch both, which is the question the layout could not answer.
The pages now dock beside the conversation from the moment the agent opens one,
in a column this window remembers turning off. The browser tab still opens them
full width, and leaving it puts them back beside the transcript. The shell draws
the page over whatever rectangle the panel reserves, so the column needed no
work there.
The three diagnostic readings move into PaneDetail.tsx, which is what made room
for the layout under the pane's ceiling; their mounting contract moves with
them. pnpm browser-live now drives the dock, the full-width view and the switch
between them.
A browser task's verification is the browser: open the page the change is in,
act on it, read what it reported. The host counted none of that, so after the
model had fixed a page and proved it in the browser the turn was sent back for
"a verification command", and the shell checks it then invented were the ones
that went wrong — a real session spent 21 more tool calls and three forced
continuations on a task that was already done, at seven times the cost.
browser_act now reports what the call was, the way bash does: a page served by
this workspace — a file inside it, or something on loopback — acted on with
every step run and nothing thrown is a check that passed. Anywhere else stays
unclassified: a page on the open web exercises nobody's code here.
Re-run through the real Studio with the same task and the same model: 35 tool
calls, 3 continuations and ¥0.07 before; 14 calls, no continuation and ¥0.011
after.
Reopening a finished session showed "waiting on you" in the title bar and the
composer's amber posture, with nothing on screen to answer and the kernel
reporting neither a running turn nor a pending decision. The transcript is read
back from the record, and the frame that says how a turn ended is not in it, so
the terminal was null — which the run state read as "stopped part way".
A restored transcript now says so (TurnTerminal "unread"), and only that reads
as nothing happening. A live turn that vanished mid-flight still leaves null and
still reads as the turn stopping short, which is the case that shape was for.
The identity tail exists so a sign-off can cite a step id. A list whose every
item is complete has none left to sign, and the host has already told the turn
not to open new work under that plan — but the tail went on riding every later
request, so an unrelated task in the same session opened with the host asking
it to cite ids for a plan that ended. A real session spent a round reasoning
about whether it was supposed to adopt the finished list.
Owed is still recomputed per request from canonical state; a list with any item
left carries its identities as before.
Every request ends with what the host projects onto it — the task list's
identities, the blocks it owes this turn — and the body chain hashed those too.
They are re-derived per request and are not what the next request carries, so
from the first turn that had a task list onward every comparison reported the
carried body rewritten with no declared reason, and the window warned "the
prefix moved" on ordinary work. Measured through the real assembly: three
requests, two false reports.
A projected message says so (provider.Message.Derived, never stored and never
serialized), a coalesced run that swallowed one says so too, and the chain
stops there. A rewrite underneath the tail is still observed.
Usage and pricing move out of provider.go into usage.go so the new field fits
under the file's ceiling; the baseline update carries that file's existing
comment debt across and lowers the totals.
"The check you ran after the latest write did not pass" named nothing, and the
debt is keyed on the check's own identity: any other check passing leaves the
first one standing. A real run showed what that costs — a `grep -L` whose exit
status is 1 when it finds nothing was recorded as failed, the model rewrote the
check three different ways, each passed, each left the debt where it was, and
the turn was sent back twice more before it happened to re-run the original
spelling.
The ledger now answers which checks stand failed after the boundary, and the
readiness message names them and says the same one has to pass.
The card that asks a person to approve a call showed them the sentence written
for the model: three English paragraphs in an otherwise Chinese window, one of
them added this week with computer use. The window cannot translate a sentence
— matching prose is the one thing this tree does not build — so the kernel now
names the class instead: dynamic_bash, browser_credential, computer_use ride
the approval as ReasonCode beside the sentence, derived from the call so the
replay path answers the same as the first emission, and the window renders the
class it knows and falls back to the sentence for one it does not.
The model still reads the English it read before; only who the text is for
changed.
A page in a minimized window, or in one another application's window covers,
counts as hidden, and a hidden page drops the input sent to it: measured, the
click never arrives and Input.dispatchMouseEvent does not even answer. That is
the ordinary case, not an edge one — a person starts the agent and goes to
another application — and it failed silently: the step said it completed and
the snapshot afterwards showed the page unchanged, so the model concluded its
click had missed and tried again, twice, before falling back to a screenshot
and a coordinate.
Two mechanisms, both measured, and each one alone leaves half the failure:
occlusion is kept away from every page in this application by
disable-backgrounding-occluded-windows, and a minimize is answered by attaching
the agent's views again, which is what brings their widgets back. The cost of
the switch is that this application's renderers keep running at full rate while
nobody is watching them.
pnpm browser-live now drives the same greeting through a minimized window and
through one covered by another window; without either half a check fails. What
the two live tests share moves into test/livekit.js. A live browser test also
pins what was ruled out on the way: a click that starts a slow navigation still
answers with the page it led to.
Opening the browser view drew nothing: the panel showed "the page is paused
while something covers it" over an empty rectangle, with the tab and the
address bar correct beside it. Switching a pane view runs a view transition,
which covers the whole page while it animates, so the sampling that asks what
is drawn over the reserved rectangle answered "the document element" and the
panel put the page away. Nothing then said the animation was over: its end
changes no attribute inside the body, which is all the panel was watching, so
the page stayed away until something else moved.
The panel now also watches the mark the swap leaves on the root, which is what
says a transition is running, and places the page when it goes. The browser
live test never caught this because its window is not on screen, and a document
that is not visible skips the transition entirely.
packaging/build-host.js builds desktop/computer-helper beside the kernel, as
one universal binary for the same reason the kernel is one, and
electron-builder carries it into resources/bin. The shell finds it beside the
kernel on macOS only and passes -computer-helper when the file is there. The
kernel starts the helper, so macOS attributes Accessibility and Screen
Recording to Reasonix Studio.
pnpm computer-live drives it through the real shell with a scripted model:
the kernel lists applications, snapshots a probe application built from the
Go live test's source, and sets a value, presses a button, focuses and types
into it. All eight checks pass, including that the person's pointer did not
move and the frontmost application did not change. What the two live tests
share moves into test/livekit.js, and pnpm browser-live still passes on it.
STUDIO_SHELL_BOUNDARIES.md gains the split for other applications: the kernel
decides, the helper carries out, the shell only finds it.
Two tools over a native helper. computer_read lists the applications a person
can see (what=apps), reads one's accessibility tree with host-issued [aN] refs
(snapshot), or captures its front window (screenshot). computer_act runs steps
in order on one application — click by ref or at x/y in the latest
screenshot's pixels, focus, set_value, type, key — stops at the first failure
with its code, and returns the application's tree afterwards. An application
is named by its bundle id.
Nothing takes the person's pointer or the foreground. A click is an
accessibility action on the element under the point, and only an element of
the application the call names takes it; keys go to that application's
process. An element with no accessibility action answers computer.no_action
instead of being clicked some other way. The helper draws its own cursor where
it acts, and Escape pressed while that cursor shows stops the run between
steps (computer.stopped). Terminals, the keychain, password managers, System
Settings, authorization prompts and Studio itself are refused before the
helper is asked. A missing Accessibility or Screen Recording grant is requested
from the system once per helper, and the failure tells the model what the
person has to switch on and where.
desktop/computer-helper is the helper, in Swift: JSON lines on stdin/stdout,
built for macOS 12 with ScreenCaptureKit checked at run time. internal/computer
owns everything it is not: which applications, what a ref means, and the
screenshot geometry that turns image pixels into screen points. It is a leaf
package and declared sensitive, with a coverage floor of 85.8 from tests that
run the test binary as a fake helper; live_test.go drives a real application
through the real helper when REASONIX_LIVE_COMPUTER names one.
Permission: both tools form the Computer rule group, granted per application
as Computer=<bundle id>. A call on another application needs a person the way
typing a secret into a site does — auto, a glob and a bare rule do not answer
it; a person, the session grant they gave for that application, an exact rule,
or YOLO does. Headless auto refuses and says why. computer_act is an unknown
mutation for evidence, since an application can write into the workspace and
names no paths; computer_read is none.
The tools reach a provider only in a host that has a helper:
reasonix-studio-host takes -computer-helper, and no other host passes one, so
the default prefix and its goldens do not move. The built-in schema budget
is widened 6049 -> 6346 for these two schemas, which only a Studio session on
macOS carries.
A browser call's projected permission arguments kept every field the model
sent and wrote the origin beside them. Subjects reads its keys in priority
order and origin comes last, so browser_open {"url":"https://example.com/a",
"path":"/etc/passwd"} was decided on "/etc/passwd": in ask mode the prompt
named that, and "allow for this session" recorded Browser=/etc/passwd, a grant
any later call on any site could claim by sending the same field. On HEAD the
subject of that call is "/etc/passwd".
What the gate reads is now the arguments the tool's schema declares, with the
host's subject written over them; anything undeclared is dropped. The approval
still shows the steps, because steps is declared.
Studio half of the in-app browser. The shell answers the browser-level half of
the debugging protocol itself — targets are WebContentsViews it owns, each on a
partition of its own and never the session the credential lives in — and hands
each page's commands to that page's debugger. It holds the kernel's relay open
over the same HTTP as everything else and posts frames back one request at a
time, so an event that came before a reply reaches the kernel before it.
Pages refuse the kernel's origin from every frame, ask for no permission,
download nothing, and turn window.open into a tab the kernel is told about.
A pane gains a 浏览器 view while the agent has a page open. The page reserves a
rectangle and tells the shell which page to draw over it; four sender-checked
verbs are all the renderer gets. Whether anything covers that rectangle is read
by sampling what the page itself shows, so a menu or a sheet opened on top puts
the page away without every overlay having to announce itself. The person gets
back, forward, reload and an address bar for the page on screen.
A page nobody is watching overlaps the window by one pixel in its bottom-left
corner, which took three wrong answers to find, all measured in the real shell:
moved wholly off screen it lays out at 0×0 and every click fails as not
visible; setVisible(false) keeps the layout, but a page whose renderer a
navigation replaced while hidden accepts no input until shown, and the
protocol's screenshot waits on a frame that never comes; and a child view at
index 0 is still drawn above the window's own page. Placement runs on a timer,
not an animation frame, because a window the system counts as hidden runs none.
pnpm browser-live drives it end to end — a scripted model, the real kernel, the
real window — and checks the page is operated, the model hears the change, and
the view is drawn exactly over the panel and put away again.
A window drawing the agent's browser needs to know which tabs exist and which
is active. The session announces that a tab opened, closed, became active,
navigated or finished loading; the controller turns it into a content-free
browser_tabs_changed frame; and every frontend reads the tabs back through
BrowserTabs (GET /browser/tabs, /tabs in the TUI), from the session that owns
them. A tab now carries the browser's target id, which is what a window keys
its views by. The page's BrowserTab mirrors the kernel's TabInfo under
wire-parity, and an empty list is [] rather than null.
Kernel half of the in-app browser. A browser.Pool can reach an Endpoint a host
provides instead of launching one: the same protocol client, the same
startup demands (version, target discovery, downloads denied), and no process
of its own. A host with nothing attached answers ErrNoHost and the pool
launches as before; a host that refuses is reported, not quietly replaced.
serve.BrowserHost is that host for Studio. The shell's main process holds one
SSE stream (GET /browser-host/stream) and posts back replies, events and the
connections it ended (POST /browser-host/frames); every workspace's browser is
one connection on it, opened with a partition name derived from the profile so
the window never learns its path. A new stream ends the old one's
connections, since their views went with the window that drew them. The Studio
host registers it for every pane through boot.SetBrowserHost, on the pool that
is already process-wide, so no build or rebuild path can forget to pass it.
The browser session now belongs to the controller rather than to one build:
retained on construction, released with the controller's resources, and handed
to the replacement on every hot rebuild (boot reload, serve rebuild, CLI model
switch) the way the private temporary directory is. A model switch no longer
closes the agent's tabs — and closing no longer depends on the cleanup chain,
which drops what was chained into it whenever an extension runtime exists.
Auto lets the agent onto any site without asking, which is the decision that
was made. Entering a password, a one-time code or card details is a different
question, and a site grant or a broad allow rule is not an answer to it.
Whether a browser_act enters a secret is read from markup, never wording: a
password input, or an autocomplete token naming a secret. Typing into a frame,
or into wherever a Tab or a coordinate click left focus, counts too, since the
host cannot see what is there. Such a call's permission subject becomes
credential:<origin>. It is also evaluated as a visit to <origin>, so a rule
denying the site denies it; otherwise only a rule naming that exact subject
allows it — no site grant, glob or bare Browser rule does — and the approval
bridge treats it like dynamic bash: Guardian and the approved-plan window do
not answer it, YOLO or an exact session grant does, and auto asks.
The check that allowed a call is what execution acts on: the verdict is noted
against the call's arguments, and a step whose target turns out to hold a
secret without that confirmation fails as browser.unconfirmed_secret before
any input is sent — which is what closes typing after focus moved somewhere
the permission check could not follow.
A headless run has nobody to ask, and its refusal now leads with why a person
was needed. Before that, a real run was refused with a reason that fits any
call, tried curl instead, and closed by suggesting an allow rule; with it, the
model filled the email, reported the password was refused, and stopped.
A fake CDP page lets this logic run in CI without a browser.
Every browser_open and browser_act was classified as a proven mutation, the
default for a writer-capable tool, so each one owed a stale_verification and a
turn that only browsed ended on "verification or review gap" — which asks the
model to go run checks against code nothing touched. A real run showed it on
every call.
The browser downloads nothing and has no way to upload, so no call of its can
write a workspace path; the classifier now says so for both. The grant group,
this classifier and the schema rule each know the tools by name without being
able to import them, and a boot test holds all three to the tools that exist.
Chrome saves a download to the person's Downloads folder without asking — a
write outside the workspace that nothing the host observes can account for.
Downloads are denied at launch, and each refusal is logged on the tab it came
from, so the act that triggered one tells the model the file never arrived
instead of leaving it to assume it did.
Three tools over internal/browser. browser_open loads a page and returns its
snapshot, so the first look costs no extra round; browser_read pages a
snapshot, scopes it to a ref, takes a screenshot or drains console errors and
failed requests; browser_act runs a list of steps in order, stops at the first
failure with its code, and answers with what the page reported and a line diff
against the snapshot the model last saw — a whole snapshot only when the
document changed.
[browser] enabled (default true) decides the schema; which browser runs is
found at first use, so the prefix answers to the config and not to the
machine, and a machine without one hears browser.engine_missing. executable
and headless are the other two keys. The tools are provider-visible rather
than behind use_capability: a browsing session is dozens of calls and nesting
each one's steps inside a proxy's arguments is where calls go wrong. This
moves the default prefix — tool schema tokens 4876 → 5335, goldens
regenerated — so every install pays one cold start on upgrade, and the
built-in schema budget is widened 5590 → 6049 for the same 459 tokens.
Permission reads the site, which is host state for a read or an act: a tool
may now project what the gate reads (tool.PermissionProjector) while the call,
its hooks and its evidence keep the arguments as sent. The browser tools write
the origin the host knows over any origin the model sent. The three share one
rule group, so a session grant or an always-allow names Browser=<origin> and
covers loading, reading and operating that site and no other; a bare grant
covers none. Ask prompts once per site, auto and yolo do not, and a read
follows the read-only fallback. Rule groups move into rule_group.go with the
file-writer group they generalise, whose predicate lost its last caller.
LSPConfig and its renderer move to config/lsp.go beside the new browser.go,
and the [tools] enabled list renders through renderStringArray.
A kernel package for an agent that has to see and operate web pages, with no
frontend attached: the tools and the Studio panel sit on top of it.
It finds a Chrome, Edge or Chromium already on the machine (never downloads
one), runs it on a profile of its own, and drives it over
--remote-debugging-pipe; Windows cannot hand a child descriptors 3 and 4, so
there it falls back to a loopback port. One process per profile is shared by
every session through a Pool, since a profile admits one process.
A page is rendered from the accessibility tree, one element per line, with a
ref the package issues, never reuses, and retires when its document navigates
away — so a stale ref fails as browser.stale_ref instead of landing on
whatever replaced the element. Inputs are real pointer and keyboard events; a
pointer input whose point another element would receive is refused as
browser.covered, naming that element. A JavaScript dialog stops the page from
answering anything that runs on it, so page-bound commands fail at once while
one is open and are abandoned when one opens mid-call. Every failure carries a
Code.
checkURL bounds a page to http(s), about:blank and files inside the workspace
once symlinks resolve; a page reached past that by a link is refused when read
or acted on. The package is declared sensitive, and a utility-layer leaf.
Live tests (REASONIX_LIVE_BROWSER=<executable>) cover both transports, forms,
selects, covering elements, dialogs, popups, stale refs and screenshot
coordinates; they skip where no browser is installed.
Prepare answers from modelVisibleMessages, which already appends the host
tails, and buildSamplingRequest appended them again. The todo tail checks
whether it is already visible; the host context tail does not, so every
request after a run that died waiting for a person carried the
interrupted-adjudication block twice — reached by quitting while an approval
was pending and reopening the session.
function_call_output carried text only and the images a tool returned were
dropped on the Responses wire, while the chat-completions client already
forwarded them. They now follow the run of outputs as a user turn with
input_image parts, the shape these vendors accept for user images; a turn
between two outputs would split calls from their results.
The error path built its outcome without the images the tool returned, so a
failure's screenshot — often the only record of the state that caused it —
reached the model as a bare placeholder.
Every image a tool returned stayed on its message and was resent on every
later request, with nothing in the window estimate accounting for it. A
session that takes a screenshot per round grows its request by one image per
round until the provider refuses it.
A request now carries only the newest three tool images. Older ones leave in
blocks of three, so the edit to earlier messages — which is what costs the
prefix cache — happens once per block instead of every round, and each
message that lost an image says so. User attachments are never detached. The
transcript keeps every image; only the request view ages them.
Images also reach the window estimate (width×height/750 from the header, the
largest image's size when unreadable), and a request that carried any no
longer trains the chars-to-tokens calibration: its prompt tokens bill pixels
the host never priced, the same pollution a provider-run web search caused.
The interrupted-request billing estimate stops counting base64 bytes as
characters.
8b2a05c51 moved a brokered pane's default model, picker and rebuilds onto
the broker, but only a kernel carrying it behaves that way. The pane
floor stayed at 2.0.0, so a host already holding a 2.18.0 kernel kept
reusing it after the window upgraded, and #10448 stayed broken for
exactly the machine that reported it.
A connect that publishes a broker now needs 2.18.1, the first version
that can carry the fix; a host on its own credentials keeps the 2.0.0
floor. PaneFloor is the one place both the connect and its probe read
the floor from, so a probe cannot call a kernel usable that the connect
would then replace.
Studio has no bot surface. On this line the QQ / Feishu / WeChat gateway
is reachable only as `reasonix bot`, a CLI command no Studio user starts,
and it carries about 12.9k lines: internal/bot, internal/botruntime, the
subcommand, its config section and its docs. It is also where the recent
Windows heap-corruption and gateway-wedge fixes had to land.
What goes with it:
- `reasonix bot`, its completion spec and its usage line in three locales.
- The typed [bot] config, its defaults, render block, model-ref and
migration hooks, and the 0.x QQ import.
- GatewayAPI, the control port only the gateway named, and the two
passive inbox variants only it called; neterr.IsTransient and
textutil.FitGraphemeBytes, which only it used.
- The bot entries in repolint's layer and frontend-parity declarations,
the bot race-test target in CI, BOT_GUIDE.md and its images, and the
[bot] example.
What stays, and why:
- The user config is shared with 1.x installs, which still run the
gateway. [bot] now decodes into an opaque table and is written back
unchanged on every save, so a settings change here does not switch
that gateway off or erase its allowlists. Credential variables the
table names are still kept out of subprocess environments.
- surface.Bot stays: usage records on disk carry it, and dropping it
would re-attribute them to another frontend.
- SECURITY.md and the crash-report worker still describe the bot, since
they serve every release line.
Budgets only fall: frontend-parity drops by 20 edges and the reclaimed
headroom is recorded with -update.
A host whose provider is "local" resolves every request on the machine
that connected to it, yet the pane's model surface still read the host's
own config. A pane opened with no model started on the host's
default_model, the picker listed the host's providers, and the broker
at home refused the first turn with `unknown model` for a model that
works fine when the host is used directly (#10448).
The broker catalog could not have said otherwise: it listed one
descriptor per provider, by bare name for any provider declaring
`models`, and named no default. It now lists one ref per chat model and
marks the one a new session starts on; the broker side offers only
models it holds a key for. A build given a resolver starts on that
default, the serve launched for a bootstrapped host leaves its model
implicit, and /models on such a pane lists the resolver's catalog
without writing the host's default_model on a switch.
The pane also lost the broker on every rebuild. A model switch, an
extension reload and a workspace move built from options that never
carried the hub's resolver, so the replacement resolved through the
host's config and credentials — the exact thing provider = "local"
exists to avoid. The server now keeps the resolver the hub gave it and
every rebuild passes it on.
A ref the broker's machine does not carry now crosses as its own kind
and arrives as provider.ErrUnknownModel naming where the lookup ran, so
a resumed session recorded against the host's own model says which
machine lacks it and what to change.
Both sides need this build: a host kernel from before it still applies
its own default_model.
Two user-visible fixes since 2.18.0, one line each per the release-note
format.
The Windows crash line says a known trigger was removed, not that the
crash is fixed: golang/go#81238 is still open, and any other recovered
hardware exception on such a host can corrupt the heap the same way.
2835cd5a5 is left out because no production controller lacks a runner.
runSettled and runComposedSyntheticTurn called c.runner.Run directly. On
a controller assembled without a runner, that was a nil dereference.
spawnGuardedTurn's recover turned it into "internal error: invalid
memory address or nil pointer dereference". On Windows the fault is a
hardware exception whether or not it is recovered, the class that
corrupts the heap on AMX runners (golang/go#81238, see 3d5b0b68d).
This was an audit of the recover() sites left after 3d5b0b68d:
- Three re-panic after recording: the CLI crash capture, the subagent
progress tracker and an SDK path. Nothing to change.
- The others isolate faults: background task jobs, guarded turns, the
rpcwire after-write callback, the jobs runner and the SDK handlers.
Isolation is their job, so they stay.
- What mattered was whether anything routinely sent a real fault
through them. Temporary instrumentation over control, serve, agent,
extension, jobs, boot and sdk/go found two nil dereferences, both this
runner call, plus six explicit panic("boom") values tests raise on
purpose, which are not exceptions.
runWithRunner returns ErrNoRunner when the runner is nil. Both call
sites use it, and the identity is a sentinel a caller can test with
errors.Is. Re-running the instrumented control and serve suites records
no nil dereference, only the two intentional panics.
TestATurnWithoutARunnerReportsErrNoRunner holds the identity.
The sentinel lives in turn_projection.go beside its use; controller.go
is already past its size budget.
getOrCreateSession took gw.mu, then called into the controller to decide
reuse (WorkspaceRoot, SessionPath, RuntimeStatus) and released the lock
by hand on each branch. A panic in any of those calls left gw.mu held:
- every later message waited on it forever;
- the turn cleanup that runs while unwinding (finishTurnItem ->
sessionAPI) waited too, so the gateway hung instead of crashing.
This showed up in 3d5b0b68d's investigation: a test fake still
embedding a nil controller hung its test rather than panicking.
The decision moves into claimSession, which holds the lock with defer
and returns what it decided: absent, reused, change deferred while work
is active, or retired. getOrCreateSession acts on that result outside
the lock, in the same order as before: set the approval mode and log for
reuse and deferral; close the retired state and log before rebuilding.
TestAPanicWhileClaimingASessionReleasesTheGatewayLock panics in
WorkspaceRoot with an explicit panic, not a nil dereference, so it
raises no hardware exception on Windows. It then requires the lock to be
free within a second. Against the previous session_routing.go it fails
with "the gateway lock is still held after the panic unwound".
The repolint baseline gives back 12 units of function-size budget that
the shorter functions stopped using.
The Windows CI leg crashed twice inside internal/bot's test binary with
Go runtime faults:
- "Exception 0xc0000005 ... PC=0x0" (44150b0aa);
- "fatal error: acquireSudog: found s.elem != nil in cache" during GC
mark termination (d636e93d5).
Both are heap corruption surfacing wherever it is next read.
golang/go#81238 is still open. On windows-latest runners (Windows Server
2025), a host whose CPU saves a large XSTATE (Intel AMX) writes the
exception context below the goroutine stack when a hardware exception is
dispatched, corrupting the Go heap. The pool mixes hosts, which is why it
is intermittent. It needs a real exception, a nil dereference for
example; an ordinary panic() does not trigger it. golang/go#77975, the
Go 1.26 overlapped-I/O corruption, was fixed in 1.26.2, and it involved
UDP receive, not these paths.
internal/bot dispatched such exceptions on purpose.
safeBotControllerRuntimeStatus, safeBotControllerWorkspaceRoot and
safeBotSetToolApprovalMode wrapped their call in recover(). Test fakes
embed a nil botController, so every call to a method a fake did not
define dereferenced nil and was recovered. Counted with temporary
instrumentation on one run of ./internal/bot: SetToolApprovalMode 7,
WorkspaceRoot 3. In production the controller is a complete
*control.Controller, so the recover only hid real bugs.
- The three wrappers keep their nil check and lose the recover.
- The eight fakes embed stubBotController, a nil botController plus
no-op SetToolApprovalMode, WorkspaceRoot and RuntimeStatus. A fake
missing a method the gateway starts calling now fails at once on every
platform.
- ci.yml runs internal/bot under the race detector, which it never did,
and the Windows test leg prints the runner CPU so the next runtime
crash can be matched against the host.
Found on the way and not changed here: a panic inside getOrCreateSession
unwinds through finishTurnItem, which takes the gateway lock the
panicking frame already holds. The gateway deadlocks instead of
crashing; with a fake that still embedded nil, the test hung rather than
panicked.
Checked: go test -race over internal/bot/... and internal/botruntime
passes; golangci-lint is clean on darwin and on GOOS=windows; actionlint
passes.
newStreamAttemptID built "sa-<attempt>-<UnixNano>". On Windows two
rounds that start within one tick of the clock get the same nanosecond
reading, so the second round reused the first round's id. Stream events
are keyed by that id:
- begin/commit/abort for a round;
- tool AttemptID;
- usage.
With a shared id they attach to the wrong round.
This is what made TestTraceFixturesMatchWhatTheKernelProduces flaky on
the Windows CI leg. Reproduced on a Windows 11 box with the serve test
binary built from the release-notes commit (d636e93d5): 8 of 12 runs
passed. A diverged fixture showed the third round's attempt normalized
to r2 instead of r3, because its raw id equalled round two's.
The suffix is now a process-wide atomic sequence. The id stays
host-local, never persisted or sent to a model, so its format has no
reader. With the fix the same box passed 24 of 24 runs.
TestStreamAttemptIDsNeverRepeat issues a thousand ids in a tight loop.
The first notes written to docs/DOCS_STANDARD.md section 6 and held by
the release-note gate: one summary line, fixed group headings, one
referenced line per user-visible change. repolint -strict reports
nothing for the file.
Left out as not visible to users: the documentation standard,
CODEOWNERS, the repolint rules, the removal of site/ and of the main-v2
release workflows. Also left out: c37dac3a4, which fixed a regression
introduced and fixed between 2.17.0 and this release.
reasonix.io is built and deployed from main-v2 only. pages.yml, removed
in 68b031ae5, ran on main-v2 pushes. On studio the directory was a
remnant, and it still read release-notes/releases.json, which that
commit deleted. main-v2 keeps the site; nothing here published it.
- site/ (60 files) is deleted.
- ci.yml loses the site job, which ran site/'s node tests, and the
`site` output of the path filter. The code and desktop skip patterns
no longer name site/.
- .gitignore loses the five site build-output rules.
- The crash-report worker's shell comment names the reasonix.io website
instead of a stylesheet path that no longer exists here.
studio has no branch protection or required status checks, so dropping
the job leaves no check pending. actionlint passes and make lint is
clean. internal/fileref still skips site/.astro in file pickers: that is
workspace behavior for users' Astro projects, not a dependency on this
directory.
Users report that the question box stops appearing. It shows at first.
Later it only shows when the user tells the model to ask. In the end it
does not show even then.
Prompt ids came from a counter in each controller, starting at "1". A
controller is rebuilt on model switch, extension reload, workspace
switch, /new, /resume and remote reconnect. The rebuild keeps the pane's
event stream (rebuildSink), so the window keeps its cards. The frontend
correlates prompts by id (prompts.ts `prompted`). An incoming request
whose id matches a card already answered is dropped as a replay, which
is correct for the kernel re-emitting a pending prompt on reconnect.
So after a rebuild the new controller's first question was "1", the
window had already answered a "1", and the request never reached the
screen while the run waited for an answer. Every answered card in the
session was one more id the next generation would reissue. The longer
the session and the more rebuilds, the more questions vanished.
The same ids are written to the session's adjudication journal, so a
resumed session also recorded a second, different "1".
Ids are now `<8 hex>-<n>`. The prefix is drawn once per approval manager
from crypto/rand, and drawn lazily for a zero-value manager. The counter
moves into a named promptIDs sub-state, so struct-state keeps its field
count. Answering still resolves only against the issuing runtime.
Tests:
- TestARebuiltControllerNeverReissuesAPromptID: asks twice on one
controller, rebuilds with InheritLifecycleFrom as a model switch does,
asks again. It fails on the old counter with `reissued "1"`.
- TestDecisionIdentitiesAreOnlyMeaningfulWithinTheirRuntime required the
two panes to mint equal ids. It now asserts the property directly: B
refuses A's id and keeps its own card.
- The trace fixture's stabilize() now normalizes decision receipt ids
with the approval and ask ids. The committed receipt read "1" against
an approval normalized to "b1", so the fixture never showed the
receipt sealing its own card.
Checked: the control, serve, bot, cli, acp and boot tests pass; the
frontend suite passes (748 tests); make check is clean.
68b031ae5 was pushed with only its deletions and renames staged. Its
`git add` named CHANGELOG.md, which was already removed, and the failed
pathspec skipped every modification after it. That commit alone does
not build:
- productdocs still imports reasonix/release-notes;
- repolint still calls checkSpecParity;
- the extension golden test reads the old fixture path.
This commit carries the changes 68b031ae5 describes: productdocs and
docs-manifest without the release catalog, repolint without spec-parity,
the golden test on testdata, the /docs tests, the link fixes, ci.yml,
CODEOWNERS, the standard, the theme generator and the lowered baseline.
Verified locally on this exact tree before 68b031ae5 was pushed:
go test ./... passes and make lint is clean.
Deletes what the documentation standard (6b6a41d36) classes as dead on
the studio line, as reviewed and approved item by item.
Deleted:
- Stale or unreferenced: production_checklist (a "v5.9.9 stable" that
never existed), the 4-line WINDOWS_LTSC_2019 stub,
SESSION_REFERENCE_ARCHITECTURE, docs/superpowers (the retired
autoresearch plans), docs/research, RELEASING.md (main-v2's three-tag
line), SIGNPATH_WINDOWS_ADMIN_SOP.md (desktop line only) and
CHANGELOG.md (main-v2's Go line).
- Chinese copies: 30 zh-CN documents with an English original, plus
three with none (COLLABORATION_MODES, DESKTOP_HOOKS, GOAL_ENFORCEMENT).
Only README, GUIDE and CLI keep a Chinese page.
- main-v2 release pipeline: the prepare-release-notes, release-notes,
release-verify-issues and pages workflows; their release-notes,
generate, event, stable-validation and public-contract scripts; and
release-notes/releases.json.
What had to move with it:
- releases.json was embedded, so the docs tool served main-v2's
1.17-1.24 history inside Studio 2.17, where "latest release" answered
1.24.1. productdocs drops the release catalog: release_notes.go, the
virtual changelog paths, the version boost and Manifest.ReleaseNotes.
docs-manifest --verify-source now compares docs/ only. The /docs
example no longer promises a changelog.
- spec-parity held SPEC.zh-CN.md to SPEC.md. With one language it has
nothing to compare, so the rule and its tests are removed.
- The spatiotemporal golden fixtures lived under docs/superpowers but
are test data. They move to internal/extension/testdata.
- Links: onboarding pages point at the English documents; English
documents lose their switch to a copy that is gone. GUIDE drops the
pointer to the Chinese-only hooks page. The theme provenance generator
stops writing THEME_ASSETS.zh-CN.md. ci.yml stops linting and running
what was deleted. CODEOWNERS and the standard lose the two dead paths.
Checked: no broken relative .md link remains; actionlint passes;
go test ./... passes; make lint is clean.
Baseline only goes down:
- doc-language 33 -> 0
- doc-owner 91 -> 44
- doc-prose 2755 -> 2375
- spec-parity removed
site/ is also main-v2's and still reads releases.json. It was not on the
approved list and is left for a separate decision.
docs/*.md is embedded and served to the model through the docs tool.
6b6a41d36 gave two documents the metadata header the documentation
standard requires. Markdown reads `---`, key lines, `---` as a setext
heading, so the tool listed "owner: @esengine / backup: @SivanCola / ..."
as a section of STUDIO_RELEASE.md and DOCS_STANDARD.md, beside an empty
title section. This was checked by reading both documents through the
tool.
The parser now blanks the header to spaces before parsing, so section
offsets and cited line ranges stay those of the file. An unterminated
delimiter is left as ordinary Markdown. STUDIO_RELEASE and DOCS_STANDARD
join the maintainer audience with RELEASING and the SignPath SOP, so a
user-facing search does not rank the release runbook.
The blanking lives in metadata.go: docs.go was at its 800-line budget.
Documents on the studio line had no owner, no status and no shape. Of
120 Markdown files, 544 paragraphs and list items ran past 320
characters. Chinese copies had drifted from the English ones (SPEC.md
1301 lines, SPEC.zh-CN.md 492). CODEOWNERS still named five paths that
no longer exist. The Studio release doc claimed a required approval and a
main-v2-only signing policy, neither of which is true any more.
- docs/DOCS_STANDARD.md states the rules as ID tables: ownership,
document classes, header, writing width, section shape per type,
language, and lifecycle.
- .github/CODEOWNERS gives every area a primary and a backup, in that
order. Every rule still lists both maintainers, so review requests do
not change.
- docs/STUDIO_RELEASE.md becomes a runbook: owners, preconditions,
steps, verification, recovery, release-note format, reference. Each
fact was checked against release-studio.yml, the environment's branch
policy and the 2.17.0 release.
- repolint gains five rules:
- codeowners: a rule must match a file and name two people.
- doc-owner: a document header's owner and backup must equal the
matching CODEOWNERS rule.
- doc-prose: a block must stay within 320 display columns, with a CJK
character counting as two.
- doc-language: only three onboarding pages keep a Chinese copy.
- release-note: fixed group headings, one referenced short line per
change.
Document classes are declared by path. Landing pages, model-read files,
GitHub templates and release notes carry no header, because each is
rendered or consumed verbatim; CODEOWNERS owns them.
Baseline: -allow-widen raises only the five new rules, from nothing to
the debt that exists today (doc-owner 91, doc-prose 2755 weighted,
doc-language 33, release-note 661, codeowners 0). No existing rule
widened. Deleting stale documents and the untranslated copies follows
in its own change, after the list is reviewed.
Users report deepseek-flash, a configured and verified vision model,
saying it cannot see an attached image. The image did reach it. The text
beside each image said "image bytes are never inlined into prompt text.
Whether this model receives the image ... is stated once in the turn's
attached-images note." That note was written only for a model that
cannot read images. A vision model got the deferral and no note, and a
model reasoning at length read that as the image not having arrived.
The same judgement was wrong on a second path. unreadable() treated "this
message carries no pixels" as "this model cannot read". A Goal
continuation under a vision parent carries its images in history, not in
the synthetic message, so the host told a vision model "This model cannot
read images, so they are not in your context" and told the user the same.
- A turn whose own message carries images now gets an attached-images
note saying they are in the message as images, to be looked at
directly.
- turnImages records modelReads, the model's capability, so a
continuation is no longer called unreadable.
- The image block drops the transport clause the model misread and keeps
only the deferral to the note, which now exists in every case.
Measured with the real CLI against deepseek-flash on DeepSeek's
Anthropic endpoint. Each run is one fresh single-turn session at effort
max, with a 1100x360 PNG pasted as .reasonix/attachments/*.png and the
prompt "I sent you a screenshot. Can you see it directly, or do you need
to call another model? First tell me what it says." (asked in Chinese).
- Denial means the final answer states the image did not reach the
model; every answer lacking image-only text was read by hand.
- Tool-first means the run's metrics show steps > 1, i.e. the model ran
tools before answering.
stock: denied 5/80; tool-first 36/70 (10 early runs had no metrics)
fixed: denied 1/80; tool-first 1/80
Denials alone are not significant at this n (two-sided Fisher p~0.21).
The tool-first drop is: in half the stock runs the model doubted the
image and inspected the file first. The fixed arm also cost ¥0.65 for 80
runs against ¥1.88 for 70. Four other phrasings (codeword, "can you see
it", owner/region, open review; 40 runs at the default effort) saw the
image every time on stock.
TestAVisionTurnLandsItsImageWithTheNoteSayingItIsThere drives
runOrchestratedTurn with a vision model and fails with the note removed.
#10435: Studio 2.17.0 on a Windows 10 machine never showed a window. The
kernel served the page; the renderer exited with STATUS_BREAKPOINT
(-2147483645) and the load failed with ERR_FAILED. The report read it as
an Electron 44 / Chromium 152 regression because a downloaded Electron
43.7.1 started, but that copy ran from a different directory.
Reproduced on a Windows 11 box with bare Electron apps: an allow entry for
a specific AppContainer package SID on the DLLs next to the executable
kills the sandboxed renderer on Electron 43.7.1 and 44.1.0 alike, and a
clean directory starts on both. One entry on ffmpeg.dll is enough. A live
package's SID fails the same as one whose profile was deleted. The entry
on the exe alone, on the directory without inheritance, on resources\app,
on the parent, or as a deny does nothing; the built-in package groups and
capability SIDs do nothing. --no-sandbox starts it and
--disable-gpu-sandbox does not, the same flag profile the report gives.
The real 2.17.0 zip with that entry on its root reproduces the report's
log lines.
Such entries come from any AppContainer sandbox that grants its package
read/execute on a tool's directory with inheritance, which is what
main-v2's winsandbox does for the executable it launches.
The kernel gets -strip-package-grants: for the directory the stated
application runs from, it removes allow entries whose SID is authority 15,
base RID 2, with more sub-authorities than a built-in group. The
judgement reads SID structure, never a name. Only allow entries go, so
access only narrows. An entry inherited from above the tree is cut by
protecting the object that inherits it, which keeps its other entries as
its own and leaves the parent untouched. The shell runs this
synchronously before Chromium starts a child, on packaged Windows builds
only (~20ms warm on a 100-file install). It logs what it removed, and if a
removal was refused and the renderer then dies before the window shows,
it names that cause in a dialog instead of exiting silently. Objects it
could not read are reported apart and never attributed.
Verified on the Windows box with the 2.17.0 zip, patched host and shell:
entry on the root, entry inherited from above, entry on one DLL, and a
clean install all start and load the SPA; the stock 2.17.0 with the entry
on its root does not. The rewritten DACL is byte-identical (SDDL) to one
set directly. internal/packagegrant's Windows tests ran there too.
TestNoApprovalPostureAnswersAQuestionForTheUser closed its signal in a
defer after AnswerQuestion returned, but the reply send inside it is
what unblocks the turn. The turn could finish and the non-blocking
select could run before the answering goroutine reached its defer, so
the race leg reported auto answering the question itself when the user
had in fact been asked and had picked B.
Controller.Ask has no posture branch: every mode emits AskRequest and
waits on the reply. The signal now closes on receipt, ahead of the
answer, which puts it ahead of the turn's end.
TestIsTransient built its reset error from syscall.ECONNRESET, which on
Windows is the APPLICATION_ERROR placeholder the package exists to stop
matching. IsTransient correctly refused it, so the Windows leg failed.
The refused case already drew from refusedErrors; the reset case now
draws from resetErrors the same way.
TestIsConnReset carried the same literal and passed on Windows only
because every *net.OpError is a net.Error, which never exercised the
reset identity at all.
393ec8eed removed desktop/third_party/go-webview2 with the Wails shell,
but desktop-windows still cd'd into it after go test ./..., so the leg
failed on every push regardless of what changed. The module's own
tests are all that remain to run there.
The macOS leg's note about cgo dock-icon glue goes too: desktop/ has no
darwin-only files and no cgo left.
The shell's smoke suite judges the workbench window, and a data home with no
model configured opens on the onboarding card instead — where none of that
window exists. The drag-region check then failed with "no .chrome", which
reads as a defect in the title bar and is the suite never reaching its subject:
run over an empty home, that judgement had nothing to weigh and said so in a
way nobody would read as nothing. It now brings the home to the state its
judgements assume before the shell reads it, and leaves a home that already
carries a configuration exactly as it is.
The contrast sweeps reported a disabled button. WCAG exempts text in an
inactive user interface component — a control greys out precisely to say it is
not one you can use — so 3.92 against a floor of 4.5 was a number nobody could
act on, sitting above the ones somebody could. Both sweeps skip an element
inside a disabled control, and dark comes back clean over twelve sections
where it had one finding.
The built-in verbs are worded by the kernel and read in a window, and the two
need not agree: a machine whose CLI speaks Chinese can have an English window
on it. The endpoint read config's desktop language and, where none is set —
the default, meaning "follow the machine" — fell through to the catalogue this
process installed from its own $LANG. So an English window on a Chinese machine
opened a Chinese menu under an English composer, twenty-one entries of it.
The window is the authority on what it is drawing: it has already adopted a
configured language, and where none is configured it follows its own locale,
which the kernel cannot read. So the request carries it and the config answers
only for a client that says nothing.
Verified in the shell it is about: with no desktop language in config and the
kernel's own LANG set to zh_CN, an English window's menu comes back with
thirty-nine entries and no Chinese in any of them; the i18n sweep over the same
kernel goes from twenty-two findings to one, the 中文 in the language picker.
The catalogue is keyed by the Chinese source text and assembled by spreading
ten modules into one object, so a key written in two of them keeps whichever
spread came last and the other reading is unreachable. Five keys were written
twice with different values, and three of them were rendering the wrong word:
记录 was "Save" beside the metrics and "Transcript" beside the graph, and the
graph won — so the button that records a model's context window read
"Transcript". 还原 was "Restore" for the window control and "Revert" for a
file, and the file won, so the maximised window's restore button announced
itself as Revert. 改动文件 names the edit_file tool in the permission rules
and a count of changed files in the chrome; the chrome won.
Where one Chinese word carries two meanings the fix is two Chinese words, not
a cleverer lookup: 保存 for the button that records a value, 向下还原 for the
window control, which is what Windows calls it in Chinese. The other two
conflicts (模型, 取消) rendered the same either way and lose the definition
that never won. Twelve keys written twice with identical values lose their
second copy.
The guard reads the sources rather than the assembled object, because after
the spread the loser is gone: neither the type system nor the runtime can see
a duplicate across two object literals. It also checks that the reading covers
the whole catalogue — an entry the pattern cannot parse is one it cannot find a
second definition of either — which is what caught the bare keys prettier
leaves unquoted, Chinese being a valid identifier.
stream_options was sent unconditionally to every OpenAI-compatible endpoint.
It is a 2024 addition, a gateway that predates it or forwards strictly rejects
the request that carries it, and all it asks for is the usage record — a token
count, not anything a turn needs. So a relay that other agents drive fine would
refuse every single message here, which is what a user reported.
The client now asks that endpoint once: when a body is rejected it retries
without the field, and if that answers it stops sending it. Asked once per
endpoint rather than on every refusal, so a gateway that rejects bodies for
some other reason is not probed twice forever, and the statuses that earn the
question are named — 400, 413, 422 — rather than taken from the 4xx range,
because 402 means the account cannot pay and a second request changes nothing.
Verified against a gateway built for it: a relay that rejects stream_options
failed every turn before and completes one now, sending the field once and
never again.
One side effect stated rather than claimed: openai's client leaves the
struct-state report, and not because it shed fields — it still carries twenty
scalars. Grouping authed with the two new facts means the client no longer
holds a concurrency primitive directly, which is what that rule looks for. The
budget is reclaimed rather than kept, so the next atomic added back to the
client fails immediately instead of fitting under an allowance it did not earn.
Reasonix is an agent, so a model it cannot hand tools to cannot run a turn.
The check sent messages and max_tokens and nothing else, which is why a relay
that answers chat and rejects a tools array passed verification and then failed
on the user's first message — with the settings panel still showing the model
as checked.
The probe now carries one tool. When the body is rejected it asks again without
the array, and reports "tools" only when removing it is what made the request
answer: the finding is the second attempt succeeding, not a word in the
refusal. A credential or a rate limit earns no retry, since the second call
would be refused for the reason the first was, and the one-attempt rule that
test pins stays intact for them.
Neither this nor the connect button ever claimed more than it proved — the
connect probe only lists models, as its own comment says — but "connected,
OpenAI-compatible" reads as "ready" and the model row said checked. Now the row
can say the endpoint answers chat and refuses tools, which is the one sentence
that sends the user to a different gateway instead of into a failing session.
Three subjects come out of evidence.go, each one a different kind of thing:
ledger_queries.go is what the ledger can be asked (thirty Has* answers, each
reading recorded receipts only), verification_command.go is whether a shell
command counts as verification — read from its parsed shape, which runner it
invokes and whether a flag turns that runner into something that writes a
report — and todos.go is the todo list as evidence.
evidence.go goes 2529 -> 723, which puts it under the 800-line ceiling: its
1729 lines of file-size debt are gone rather than moved, the first file in this
series to clear its own. essay and complexity travel with the code that carries
them (34 becomes 2+6+8+18) and neither total moves.
gateway.go held a third of the package and five subjects that answer different
questions: adapter_health.go (what each connection is doing, recorded as it
happens so a status command answers without asking the platform), slash.go (the
commands a chat can send and the text each answers with), approval_shortcut.go
(which reply counts as which answer to a pending approval or ask),
session_routing.go (which session a message belongs to, and the options one is
opened with), and outbound.go (what was sent, so the gateway does not answer
itself, plus the reactions to clean up).
gateway.go goes 2973 -> 1147. file-size drops 1826; essay, complexity and
function-size are unchanged. Emit, Start and Stop stay where they are — they
share a name with methods on other types in this package, and the gateway's own
lifecycle is what gateway.go is for.
The ACP package had ten files and one of them held a third of the package.
Three subjects come out of it, each a thing the protocol names rather than a
slice of the implementation: session.go (new, load, resume, prompt, cancel,
close and the lookups they share), session_config.go (which axes a client may
switch on a live session, and how a pending change merges and applies), and
session_meta.go (the sidecar that remembers a session between connections).
service.go goes 3047 -> 1676. file-size drops 1371 and every other budget is
unchanged — the same code, the same rules, read in the order the protocol is.
Extensions to extensions.go, steering to inbox_steer.go, the job verbs to
jobs_bridge.go, plan mode to planlifecycle.go, and close/rotate to
session_lifecycle.go — each into the file its subject already had. The turn
entry points get a new one: Send, RunTurn and the loop they drive are what a
frontend calls to start work, and turn_orchestrator.go is over 670 lines
already.
controller.go goes 2024 -> 1430, so its overage is 630 where it was 2432 two
commits ago. What stays is the constructor and the accessors — the session
state every subject reads — which is what a controller is once its behaviour
lives beside the state it acts on.
file-size drops another 594. The other budgets are byte-for-byte unchanged,
including essay: the one line this pass added was a four-line file note where
three is the limit for that position, and it says the same thing in three.
Seven groups of methods move to the file their subject already owns: skills to
skill.go beside skillSet, checkpoints and summarize to checkpoint.go beside
checkpointManager, memory to memory_command.go, the in-flight and interrupted
turn bookkeeping to turn_cancel.go (where appendUniqueString's four callers
already were), branches to branches.go, session artifacts and recovery notices
to session_snapshot.go, and the goal verbs to a new goal_control.go rather than
into goal.go, which is over the ceiling already.
controller.go goes 3232 -> 2024. The essay, frontend-parity, complexity and
function-size budgets are unchanged to the point — this is the same code under
the same rules — while file-size drops 1208, which is what a 2400-line overage
becoming a 1200-line one is worth. The baseline is updated with -allow-widen
because an extraction moves each file's share, and REASONIX.md asks for that to
be visible in the command.
The approval bridge earns more than a move. gateApprover decides whether a tool
call runs, and it sat in controller.go — outside the sensitive paths, which
name approval.go and approval_orchestration.go and could not reach it there.
approval_bridge.go is declared sensitive, so the review and the coverage floor
now cover it: 77%, against 94% and 91% for the two files beside it.
Two coverage floors move on their own merit — approval_bridge.go is new, and
shellsafe rose to 81.6% when the redirect guard got the tests its own comment
promised. The rest are restored to what they were: `covergate -update` had
raised every floor to one run's reading, and providerbroker's 83.6% was seen at
83.1% on the next, which is a gate that fails for no reason.
The comment said desktop/next is absent from frontendPorts because it drove the
kernel over HTTP, where wire-parity is the guard. That shell is retired; what
the note still has to say is why botruntime is absent, which is a different
reason — it never reaches the controller at all.
The three fields already had a lock of their own — externalFolderRefsMu sat in
the Controller beside the map it guarded and the tool-side registrar it fed —
which is the shape a collaborator takes before it has a name. It has one now,
and the lock travels with the state it protects rather than sitting among
forty other fields that answer to c.mu.
A strict leaf in the sense memoryManager set: register, resolve and roots touch
only their own map, so a dropped folder never contends with a turn's run state.
The three call sites lose the locking they were open-coding — dropped.go's
seven lines become one, and refs.go's prefix walk moves next to the map it
walks.
build-host.js ran go from desktop/electron, so Go resolved
../../cmd/reasonix-studio-host against desktop/go.mod — a main-module package
built in the desktop module's context, working only while that module's go.sum
happened to carry the main module's whole dependency closure. Retiring the
Wails shell ended that: `go mod tidy` there keeps what the desktop module's own
code imports, and the build stopped with a missing go.sum entry for sftp.
It now runs from the repository root, where that package's module is, and names
its output by absolute path since the working directory moved.
vite's proxy comment matched its Origin rewrite against "production and the
Wails shell"; there is one shell now and production is the whole claim.
release-studio.yml opened by saying which of two shells it builds. And a
completion test used a wailsjs path as its nested-file fixture, where any
nested path proves the same thing — that a file below the workspace is offered
and node_modules is not.
The comparisons that remain in release-studio.yml are load-bearing: they say
what the Wails line installed, which is what the Electron package has to take
over rather than sit beside.
Section 6 of the migration contract bound these into one transaction, because
deleting any one first leaves a broken shell rather than a smaller tree:
desktop/next and its event pump, remote_pump.go, /rx-replay, the frontend's
WAILS_* constants and bus branch, the apiPaths/apiPrefixes whitelist, the
vendored go-webview2 fork, and the Wails dependency with its CGO and
GTK/WebKitGTK build requirements. They go together here.
What allows it now is the condition section 7 named — no exclusive semantics
left — plus the one ledger entry that had been recorded as unverified: the
release line. studio-v2.11.0 (2026-09-01) through studio-v2.16.0 shipped the
Electron bundle seven times, and the crossing from an installed Wails 2.10 was
confirmed by the maintainer rather than assumed here.
The kernel loses what only that shell reached: update.LocalApplication (a
process that is its own application, which Electron's is not), update.Here,
appidentity's AppUserModelID application and shortcut repair — Electron states
its own appId — and crashreport.CaptureStudioPanic. AppUserModelID itself stays,
because Windows toasts still carry it.
Two consequences worth stating. The desktop module is now CGO-free, so neither
CI nor a contributor installs GTK or WebKitGTK to build it, and the webkit2_41
tag is gone from every command. And what the old shell installed is untouched:
winuninstall, the Electron shell's legacy takeover and studio_line's binary name
are how an installed 2.10 becomes a 2.11, and none of them are Wails code.
The contract becomes docs/STUDIO_SHELL_BOUNDARIES.md: the rules the migration
established outlive it, and the ledgers it kept do not. The presentation gaps it
tracked are carried over as known gaps, with the host's missing panic capture
added to them.
SetDesktopUpdateChannel was kept for pre-single-channel Wails clients, which
reached it through Wails bindings. Those bindings are gone — the migration
contract records their removal under version reading and pinning — so nothing
can call it, and its own package is its only mention. The legacy field it
cleared is still read: NormalizeDesktopUpdateChannel folds an old config's
value on load, which is the half that has to stay.
These three outlive the application they drove. `dev` runs `wails dev` in
desktop/, which holds no Go file at all since that app was deleted; `prod_test`
copies `desktop/wails.json` and calls `scripts/desktop-build.sh`, neither of
which exists, so it fails on its first command. `.wails-version` pinned the
Wails CLI for them, and prod_test was its last reader — the shell that is still
here needs no CLI, as scripts/studio-build.sh says in its own header ("Studio
has no wails.json, so this drives go build directly").
README and CONTRIBUTING told a contributor to run `make wails-install`, a
target the Makefile does not define, and then to launch
`build/bin/reasonix-desktop`, a binary nothing builds. They now name the
command that does work. CONTRIBUTING also asked for Go 1.25 where go.mod
requires 1.26, which sends a first-time contributor to install the wrong
toolchain.
This is the retired desktop's residue, not the Wails shell: desktop/next and
everything section 6 of the migration contract binds to it stay, because that
shell still compiles in CI and the contract retires it in one transaction or
not at all.
Thirty places built the same four lines — make with len(m), range-append,
slices.Sort — to get a map's keys in order, while nine others already wrote
slices.Sorted(maps.Keys(m)). The long form says nothing the short one does
not, and having both means a reader has to check each one for the difference
that is not there.
The four collectors that do not sort are left alone: their callers may or may
not be relying on something about the slice, and a shorter spelling is not
worth deciding that here.
Two ways to sort a string slice were in the tree at once — slices.Sort in 30
places, sort.Strings in 148, and internal/hook/inspect.go used both. Since Go
1.22 sort.Strings is a call to slices.Sort, so this settles which one a reader
meets, not what the code does.
The four files that would have grown by an import line are already over their
size budget, so their remaining sort.Slice calls move too: cmp.Or over
cmp.Compare says a multi-field ordering in one expression where the boolean
form needed a chain of ifs, and the four files come out shorter than they went
in.
math/rand becomes math/rand/v2 throughout. The seeded call sites all use a
fixed seed for repeatability rather than asserting particular values, so PCG
replacing the v1 source changes which sequence they walk and nothing about
what they prove.
Backoff stays as it is. Four packages compute a retry delay and it is tempting
to share that too, but provider caps at 15s and the stream retry at 8s to match
a reference implementation's timing, while feishu uses proportional jitter and
remote full jitter. Those are four calibrated decisions, not one judgement
copied four times, and the formula is the part that was never hard.
Three packages defined pathWithin and meant three different things. sandbox
excluded the root itself and normalized neither side; environment included the
root and cleaned both; instruction included the root and resolved both to
absolute. Two of the three decide a security boundary — instruction fences
@import against escaping the workspace, environment blocks executables under a
denied root — and a reader moving between them had no way to see the rule
change under the same name.
fileutil.Under and fileutil.AtOrUnder name the two questions apart and resolve
both sides before comparing, so a relative path or an interior ".." cannot
answer by spelling rather than by location. sandbox keeps the strict form on
purpose: /tmp is not a directory inside /tmp, and mounting it would not be the
same operation. Both of its call sites already passed cleaned absolute paths,
so what changes there is only that a future one cannot forget to.
The redirect guard gets the tests its own doc comment implied: eleven safe
spellings it promises to strip, and the file-reaching forms it must refuse,
none of which had a case. That also restores the shellsafe coverage floor,
which slipped when an earlier pass retired a fully covered wrapper.
boot/runtime_plan.go spelled out extension.ComponentID("plugin/" + name) on
line 50 and called sidecar.PluginNameFromComponentID on line 136 — the same
file encoding by hand and decoding through the constructor's own package. That
is why PluginComponentID had no caller: the one place that should build an id
built its own. The two halves also disagreed on whitespace, the constructor
trimming where the literal did not, and a manifest name keeps its surrounding
spaces (IsValidName trims only to match).
The kernel's own "is this a plugin component" test reads the prefix from
extensioncontract rather than repeating the literal a fourth time.
Fifty-seven comments carried a development stage or phase — "stage 7",
"Stage 6b1", "Phase 0" — that no document in the tree defines. A reader who
never saw the plan they came from loses nothing by their removal, which is
what REASONIX.md asks of a comment. The budget is now zero, so the rule stops
being a ratchet and starts being a gate.
Three of them were not only unreadable but wrong, because a comment naming a
future stage goes stale the moment that stage lands:
- SandboxConfig said reads were unrestricted and that confining bash was
still to come, while the struct it documents carries ForbidRead, Bash,
Network and HostAuthorities.
- Activator said stage 2 wires none; boot has installed one since.
- UIHandler said stage 8 would wire real frontends; the host UI hub serves
them now.
Where a stage is a real step rather than a plan — the rewind overlay's three
screens, restoreReleaseUnit's stage-then-swap — the step keeps its meaning and
loses only the number, which the reader had to count anyway.
pluginpkg.validRuntimeProviderRef said in its own comment that it mirrors
extension.validProviderSlotTarget, and it did — by hand, with the two-branch
shape retyped and the whitespace check repeated. The parser decides whether a
package may install and the kernel decides whether its claim resolves, so the
two disagreeing is a package that passes validation and then cannot bind.
pluginpkg cannot import the kernel (extension -> hook -> pluginpkg is a cycle),
which is what extensioncontract exists for. Both now read the rule from there,
so agreement is structural rather than maintained.
boot.splitProviderRef keeps its own shape on purpose: it cuts at the first
slash and tolerates what has none, which is parsing a user's input, not
validating a kernel ref. Sharing a name with the strict one is a separate
hazard and stays as it is.
Thirteen exported functions each forwarded to a fuller form with one argument
filled in — RenderTOMLForScope(RenderScopeFull), StartPackagesWithPlan(nil,
nil), decodeForDirection(direction, strict), NewProviderWithProxy(ModeAuto) —
and production used the fuller form every time. The shorter shape had one
audience, the tests that wanted fewer arguments, so it now lives beside them:
a same-package helper where the fuller form is unexported, a direct call where
it is not.
environment.RunProbesWithOverrides shows why the shape keeps coming back: the
previous pass retired RunProbes onto it, and it turned out to be the middle of
three generations, itself forwarding to RunProbesWithOptions.
ClaimRename, SharedCatalog, CommandOverview and SharesRepo each forward to
something the tree still calls, from tests alone. fileutil.GlobSet went further:
the type, its constructor and its Match method had no user in any module, so
what survives the file is the two slash helpers other packages do call, under a
name that says what they are.
MatchSlashGlob keeps a behaviour worth stating, since the deleted GlobSet was
where it was covered: a "**/" prefix also matches at the root, which doublestar
does not do on its own.
Three packages each carried their own answer to "is this socket failure worth
another attempt": provider.IsConnReset, the duplicated case inside
ClassifyStreamInterrupt that its own default already covered, and feishu's
isTransientError, which fell through to a list of English substrings.
All three matched syscall.ECONNRESET, which on Windows is an APPLICATION_ERROR
placeholder rather than a socket code — errors.Is against it cannot match what
the runtime returns there, so the sentinel arm was dead on that platform and
the substring list was the only path left. That list reads the operating
system's own sentence, which arrives localized, so on a non-English Windows
neither arm fired and nothing retried.
internal/neterr holds the judgement once and names the identities each platform
actually reports. netclient's transport-error trimming was the other text
match: net/http hands back a *url.Error whose Op and URL are the prefix it was
cutting by hand, so it reads the field instead.
Seventeen exported kernel functions were reachable from tests alone. Each one
forwards to something the tree still calls — ensureBranchMetaUnlocked,
UpdateBranchMeta, editConfigFile, CommandDirsForRoot, DecidePlannerRoute,
RunProbesWithOverrides, ClassifyWorkspaceNonMutatingCommand,
SessionGrantRuleForScope, acquire — or, for LoadRecoveryDefaultsForRoot,
ResetOfficialProviderPricingOnUpgrade and TaskWarrantsPlanner, says in its own
doc comment that it exists for callers that no longer exist. A test calling the
wrapper is not covering the path production takes; it is keeping a second
entrance warm. The tests now call what production calls.
event.FanOut had no user at all: the type, its constructor and its whole file
were reachable only from the sink-capability guard's fixture list, which covers
the three wrappers boot actually chains.
AcquireWithExternalTimeout carried one thing its callee does not, a rejection
of a non-positive budget. That contract was the wrapper's own — acquire treats
zero as "follow ctx", which is what Acquire passes — so the case asserting it
goes with the entrance it belonged to.
adapters.go offered seven Contributor factories that each ran their own
discovery — command.LoadRoots, hook.Load, skill.Store.List. boot discovers
first and hands the kernel resolved records, so it built its contributions
from the single-record mappers and wrapped them in an anonymous "boot-legacy"
ContributorFunc instead. The two models are exclusive and only one of them
ever ran; the factories were reachable from tests alone.
Delete them and the two mappers only they called. The package comment claimed
the adapters wrapped discovery, which stopped being true the moment boot took
discovery over, and it now says what the file does. It also records that
KindPrompt and KindTheme have no contributor at all: pluginpkg parses a
package's prompts and themes and nothing carries them to a snapshot.
`default_tool_approval_mode` reached exactly one shell. The Wails binary read
it and called SetToolApprovalMode; the Electron one never did, so the same
config opened Ask in Studio and the configured mode in the shell it replaced.
The hub then propagated that wrong posture to every later pane on purpose —
`h.stance` takes whatever the first controller came up with, which is the right
rule applied to a value nobody had set.
It belongs in the shared assembly rather than in whichever shell remembers it,
so `boot` now hands back a controller already in that posture, for the desktop
surface only: a terminal frontend states its own on the command line, and
`reasonix serve` is left where it was. An unset config normalises to Ask, so
this loosens nothing nobody asked for.
`internal/boot/effect_test.go` asserts both sides through the real assembly.
Reverted, it reports `ToolApprovalMode() = "ask", want "yolo"` — the sentence
the report described.
The same change also retires a second field for a setting that already had one:
yesterday's `measure` and the existing `desktop.conversation_width` are the same
question, and the older one had a setter, a renderer and installs that may
already carry it. The endpoint now reads and writes that one, as `width`.
Two changes that look like one, and are not.
A clipped command is not a preference. `--doc` held the whole transcript to a
reading line length, so a Bash line ran off at `rm xiangqi.html xiangqi.js
xi…` and the rest of what it deleted was simply not on screen. Cards, commands,
code and output now take the container's width — a new `--wide` — while prose
keeps the measure it was given. The three places that align to the transcript's
left edge (the tabs, the run header, the task list) follow the container, not
the measure, or they would sit 100px off it.
How far prose runs is a preference, and it now has a setting: 外观 → 行宽, beside
the body size, because they are one question asked twice — how big the letters
are, and how far they run before the eye comes back. Two answers, not four: a
line short enough to find the next one, or a window used to its edge. A step
between them would be a number nobody could tell from its neighbour.
Measured at 1920: the transcript was 706 wide in a 1288 column, 291 empty on
each side. It is now 1120 at the default and 1180 when someone asks for the
window. The composer's own width was computed from a different subtraction than
the flow's, which nothing showed while both were clamped by the same max-width
and showed as a 14px misalignment the moment they were not.
`renderAppearanceSection` is hand-written and drops what it does not know, as
its own comment says: the field reached disk through the endpoint and was gone
from `/appearance` on the next read until it was added there too.
A Windows update runs the *previous* install's uninstaller first, and
electron-builder's uninstaller takes $INSTDIR whole — it enumerates every entry
under the directory and moves it aside, then `RMDir /r $INSTDIR`. It is not a
record of what was installed. With `allowToChangeInstallationDirectory` on, a
person can point that at a folder that already holds their work, and nothing
says a word until the next update removes all of it. What it moves aside goes
to $PLUGINSDIR, which is under %TEMP% and swept when the installer exits, so
there is nothing to recover.
Reproduced on a real machine with the shipped v2.15.0 and v2.16.0 packages:
four files in the chosen folder, all four present after the install, all four
gone after the upgrade.
The choice of folder is the only place left to refuse, because an upgrade runs
the uninstaller that was compiled with the *old* build. So this lands in the
directory page (`.onVerifyInstDir` greys out Next) and in `customInit` for the
silent `/S /D=` path, which never sees that page and is how a scripted deploy
names a folder. A folder carrying our own uninstaller is the one that may
already have things in it — that is what an upgrade is.
Verified against a build of this change, silently, on Windows:
into a folder with files in it → exit 2, files untouched, nothing installed
into an empty folder → installs
over our own install → installs
Two notes on the NSIS side: this file is included before electron-builder's own
script, so LogicLib has to be included here (its guard makes that a no-op) and
${UNINSTALL_FILENAME} is not defined yet — PRODUCT_FILENAME arrives on the
command line, so the name is built the same way common.nsh builds it.
This cannot help an install that is already sitting in a shared folder: that
machine's next upgrade runs its existing uninstaller, which has none of this.
A new sweep refuses every write the settings panels make and asks the four
things a refused write has to answer: did the control roll back, did the window
say anything, is anything stuck, did anything go uncaught. Seventeen writes
across twelve panels; sixteen answered all four.
The one that did not was activating a theme pack — `.catch(() => {})`, so the
card sprang back to the palette that is really on and the window said nothing
about why. Clearing a wallpaper swallowed its refusal the same way. Both now
land in the state this screen already had for the one write somebody
remembered, which was being rendered inside the wallpaper block: a palette that
would not activate is not news for the wallpaper section, so it is said at the
top, where the rest of settings says it.
Two judgements in the sweep had to be fixed before the report was worth
reading, and both are a probe answering for something other than what it names:
a panel that sends no write was being scored on whether its control rolled back
(nothing was injected, so it had not), and one shared error sentence made the
previous panel's message part of the next panel's baseline — four panels that
did speak read as silent.
Deduplicating the i18n sweep's findings — one string is one finding, wherever
it was first seen — took the report from 49 lines to 33 and brought 25 real
ones out from under an error card that rides every section and was being
counted 29 times.
What they were: the completion menu rendered its kind column and its key hints
straight from a constant table, past t(), which no static check can see —
`t(variable)` hides its key from every one of them. And the built-in verbs are
rendered by the kernel from the process's catalogue, while the window reads the
interface language: a machine whose CLI speaks Chinese showed an English window
a Chinese menu. The kernel now renders that catalogue in the language of
whoever asked, which is a per-request answer because a menu is.
What is left on an English screen: the kernel's error text, which rides the
event stream to two frontends at once and so has to carry a code rather than a
sentence, and the language picker's 中文.
Also: the fixture's "this machine has a provider" belongs to a window, not to
a module. Holding it per module leaked between tests — four of them failed
together and passed alone, which reads exactly like flake.
The i18n sweep was opening settings by an English aria-label the button had
already stopped carrying, and threw rather than passing — the one of the three
that failed loudly. The contrast sweep found the same button by trying both
languages, so it kept working and kept its own copy of the walk. A step is a
claim about what the window can be driven to show, and two copies of that
claim drift: the walk now lives in tools/steps.mjs and all three take it.
Two ways a sweep was proving nothing while reporting zero:
The contrast sweep switched themes by setting `data-theme` by hand. A pack
writes its palette to `root.style`, which outranks that attribute and does not
move until the window repaints — so the "dark" pass was reading a pack's light
inks under a dark stylesheet, a state nothing renders, and reported ten
failures in it. It reloads into the theme now, and prints the theme that
actually painted, because two passes over one theme also report zero.
The i18n sweep set `rx-lang` and trusted it. The kernel's own language setting
outranks that and reloads the window with it, so a home configured for Chinese
turned the sweep into a Chinese window reporting Chinese: 4012 hits, not one of
them a finding. It reads back what rendered and refuses to go on otherwise.
Its walk goes from 12 settings pages to 29 sections. What is left on screen in
English is the kernel's own error text — a separate setting, tracked — and the
language picker's 中文, which is written in its own language on purpose.
The connect card is the first thing a new machine shows and the last place to
be stingy with ink: its field labels, the env-var name beside them, the note
under the button and the line under the brand all sat between 2.71 and 3.46
against AA's 4.5. They were white at .30–.38 opacity on a near-black scene;
.48 reads without taking the scene's own darkness away.
The sweep had been reporting the brand heading at 1.00 — text painted through
a gradient has no colour of its own to weigh, so its transparent ink resolved
to the surface behind it. One impossible number sitting on top of five real
ones is how a report stops being read.
A rule written for a row that does not exist. `.lrow .ds` was declared twice,
and the second one — paired with a `.lrow .nm` the interface has never
rendered — clipped it to a single line with an ellipsis. All 26 descriptions
in settings were cut at 820px wide with no way to read the rest; they now
wrap, in the size and colour the first declaration always meant.
Two strings painted over their neighbours rather than being clipped: a word
longer than the box it had been squeezed into (`overflow-wrap`), and a status
that had nowhere left to go on a row that would not wrap.
What is still deliberately clipped now carries the whole string on `title` —
an MCP server's line, its tools' descriptions, a provider's host, and the
activity row, where the tail of an error is the half that says what failed.
`--accent-ink` cleared the completion popover at 6.4:1 and the selected row
inside it at 4.40. The darkest surface an ink lands on is the one that sets
its value.
And the boot line's Chinese was under Latin letterspacing, which pulls Han
characters apart for no reading it helps.
Two things the token validator cannot see, because every value involved is a
legal colour on its own.
Contrast is a property of a pair. All nine shipped packs put `fgFaint` — what
`--faint` and `--ghost` are drawn from — below AA on their own surfaces: 2.56
to 3.58 against a line of 4.5, which the default appearance has always met.
A light window under a pack reported 137 unreadable strings. Each value is
moved on lightness alone, so the palette keeps its hue and chroma, and
`TestShippedPacksMeetTextContrast` now holds the set to the line. The one
string left is the in-use badge on a selected model row, which had stayed on
`--faint` over the accent wash while everything else in the row stepped up.
Contrast is also the reader's, the way reading size already is: a pack states
a palette, not how legible it has to be for whoever is in front of it. Pinning
`--text` inline won every step of the setting, so someone who asked for
stronger text got the author's answer for as long as the palette was on. A
pack's inks are now read as the step someone who never opened the setting
sees, and the two stronger steps are derived from them by the same lightness
the built-in palette moves.
The interface sweep had been walking five of its thirty steps and reporting
the rest as skipped. Three things were behind that, and each of them failed
silently:
The entry script answered the connect card on fixed timers — 200ms, then
1800ms for a probe that takes longer — so it walked away from a card still
on screen, and its return value was dropped rather than printed. A dozen
unreachable steps read as a dozen skipped ones.
The steps named their controls by label and by DOM shape: `.sesstitle` had
not existed for months, so the step meant to open a session "succeeded" into
the rename button beside it, and the tab steps looked for English the window
only renders in Chinese. They now name the intent the interface declares —
`data-action` — which is the one thing that moves with neither.
And the fixture held "this machine has a provider" per port instance. A
session opens a second pane, which builds its own port, which had never been
given a key: the connect card came back over a window already in use.
Thirty steps, nothing skipped.
`.main` took a `--surface` background, and it is the one surface in the
middle column that the `data-bg` set never hands a transparent one: the
rails, the panes and the app itself are all cleared when a pack brings a
picture, so an image survived at the edges of the window and was painted
over everywhere a transcript is read.
The pack was loading the whole time — the asset answered 200 and the
alpha was right — which is why this read as "the image stopped showing"
rather than as a missing file.
`test (full)` timed out at 20 minutes on three separate pushes, each time
with every package it had reached reporting ok and the step dying mid-run.
The budget was set to sit "above normal full-suite wall time (~8-12m)", and
that is no longer where the suite is: green runs on this branch measured
520s, 661s, 844s, 874s, 885s, 936s and 976s, while the three that died
measured 1287s, 1295s and 1305s. 20m was inside the distribution, so a slow
runner arrived as a failed test — the same reading the package budget above
was widened to stop producing.
30m keeps what the step is for: a hang still dies on it rather than on a
package timeout that names the wrong cause.
Opening a second conversation left every answer in it rendered as its own
source text, and switching back left the first one that way too.
The three deferred plugins are held in module slots and read with
`useState(slot)` — and a plugin is a function, which React takes as a lazy
initializer and calls. What the state then held was not the attacher but the
transformer it returns, and unified attaches that in turn: it runs with no
tree at all, which is the `Cannot use 'in' operator to search for 'children'
in undefined` the renderer threw into SayCard's boundary. A boundary does not
reset, so the card stayed at its source text for as long as it was mounted.
The highlighter has therefore never worked past the card that loaded it: the
listing that triggered the fetch rendered, because the value that reached it
came from setPlugin rather than from the initializer, and every card mounted
after that fell back. katex escaped it because its slot holds
`[plugin, options]`, an array; gemoji did not.
The three hooks were one shape written three times, so they become one that
takes the slot, and every read goes through a thunk.
Measured in the workbench against a mock kernel: opening a second pane went
from 2 rich / 3 plain with two TypeErrors to 5 rich / 0 plain with none, and
highlighted tokens from 3 to 9. Markdown.plugins.test.tsx mounts a listing,
waits for `code.hljs`, then mounts a second card — and fails on exactly that
TypeError with this change stashed.
modernize fails both Index-then-slice pairs in tsRecordKeys, and the
lint job runs with cross-platform build tags where the root `make lint`
does not reach the desktop module at all.
TestAnUncontendedHoldStillReports acquired and released with nothing in
between and then asserted Held > 0. Go's monotonic clock on Windows
advances on the system tick, about every 15ms, so the whole hold fell
inside one reading and the account came back {Held:0s} — the test was
asserting clock resolution, and only that platform was red.
The hold now spans 40ms and the assertion asks for 30, the same shape
the idle test beside it already used. What it proves is unchanged: an
uncontended hold is accounted for and reports no contention.
The committed readings gate what the desktop reducer is checked against,
so stabilize() strips everything that is a measurement rather than turn
structure — a tool call's DurationMs has been zeroed there all along.
The workspace lease account arrived beside it carrying heldMs and idleMs
and nothing stripped them, so the file recorded how long one run of the
test happened to hold the lease: 24ms when it was written, 23ms on the
next machine to run it. The test could not pass twice.
It failed on ubuntu, macos, windows, race and coverage at once, which is
what a fixture keyed on wall-clock looks like rather than five separate
breaks.
Waited, held and idle are zeroed with the rest. What the fixture still
carries is the fact that a lease event was emitted, where it sits in the
turn, and that it was uncontended — the shape the reducer is judged on.
PROJECTION_CAUSE_WITHOUT_SOURCE stood at 17: every interaction whose
lifecycle axis reached Transcript's presence carried an unmount-open
cause with nothing behind it, so the invariant the reduction exists to
hold — a projection always names its sources — was broken tree-wide by
one component.
Openness is decided over every effect a component owns, and the sources
were read off `d.by`, which is the single effect a displayed line names.
Transcript has twelve: the one that makes unmountOpen true is the
useEffect at 456 whose cleanup the walk cannot read, while `by` points
at 325, the first with an open setup and no cleanup at all. Reading a
cleanup off an effect that has none yields an empty set, which is a
debt with no mechanism under it.
The predicates are now declared once and both the verdict and the
attribution read them, so the two cannot diverge again: mountOpenBy and
unmountOpenBy are the effects the verdict was taken over, and a cause's
sources are the union across them. The mount side had the same shape and
was one component away from the same result.
census:verify is unchanged across all ten fixture reports.
The account the kernel closes at each release is five integers with no
path, command or identity in it, so it can ride the channel that already
has consent: three closed enums added to the upload allow-list, and a
group on the dashboard beside the other settings metrics.
lease_hold contended | uncontended
lease_wait the existing latency tiers, contended holds only
lease_idle how much of the hold came after the last write asked
The third is the one that decides anything. A high contention rate with
a low idle share means the lease is held exactly as long as it is used,
and the proposal to release at the last verification would return
nothing; the reverse says the opposite.
Flushed on its own rather than into the turn's batch, because the lease
is released when a session's last run ends and that is not reliably
before the TurnDone that empties the batch. Nothing here changes who
reports: the policy is unchanged and still refuses a non-release build,
CI, DO_NOT_TRACK, and anything but an interactive session under `auto`.
A hold with no length has no idle share rather than a share of zero,
which would read as a hold measured to have been busy throughout.
The dashboard's group table moved to a file of its own instead of
stats.ts growing past its ceiling, and the 17 lines that file had been
carrying are reclaimed.
The kernel now closes an account at each release; this is what reads them.
It reports holds, how many were contended, how long those waited, and the
share of each hold that came after the last write asked for the lease.
Four things it refuses to let a number mean something it does not. The
denominator is holds, so a session that wrote and never waited counts —
it is most of the rate. contended and reported are separate columns,
because a wait inside the one-second grace never becomes a notice and
those are the common case. A zero-length hold has no idle share rather
than a share of zero. And a log the size cap truncated makes every
number a floor, which is said in the rendering rather than left for the
reader to remember — the frames that go missing are the ones written at
the end of long turns.
Run against every session on this machine it reports 35 logs and no
holds, which is the honest answer: the instrument shipped an hour ago
and the corpus starts now.
The workspace write lease is the reason two sessions cannot write one
project at once, and whether that costs anyone anything had no number
behind it. The only record was a sentence on screen — "waited 2.3s" —
and only for a wait that outlived the one-second grace, which hides the
common case entirely.
workspacelease.Stats closes one account per hold: contended acquisitions
including the ones under the grace, how many became notices, total time
waited, how long the lease was held, and how much of that hold came after
the last write asked for it. That last one is the number the proposal to
release at the last verification stands or falls on, and nothing was
measuring it. It rides a shadow event, the shape TodoProgress already
uses: no gate reads it and no prompt byte moves with it.
Writing the test found a real ordering error: the ask that takes the
lease is dated before the acquisition it waited for, so Idle measured
longer than the Held it is part of. It runs from whichever came later.
internal/event/event.go was at the 800-line ceiling, so the audit
forwarders moved to a file of their own rather than the budget moving.
The card was behind a localStorage key no control ever wrote, so it was
not off by default — it was unreachable. What it reports is what the
turn changed, what it verified, and what went unverified, which is
exactly what a reader wants once the turn stops moving; without it most
turns simply stopped.
It is on unless this machine turns it off, and the switch now exists,
beside the other per-machine display choices. The kernel still decides
whether a receipt has anything to say; the preference only decides
whether a reader sees one that does. The control declares that it takes
effect from the next turn, because the reducer records the card when the
turn ends rather than the view choosing per render.
A shell row showed the first 96 characters of the command, which for
`PATH=$(echo $PATH | …) go test ./x` is sixty characters of plumbing and
no verb. Which part of a command names what it runs can only be answered
by a parser — a regex over the text is the word-matching this tree does
not build — so the kernel answers it: shellrun.OperativeCommand cuts the
leading assignments positionally, from the parsed command's own byte
offsets, so quoting and substitutions survive as written. It rides
ShellExecution.Subject and never replaces the command: authorization
surfaces carry the full text, and so does the row's title.
Declaring that pair in wireparity found three drifts already there:
shellVersion and supportsAndAnd were sent and unreadable — which is
PowerShell 5.1, where `&&` is a syntax error, arriving indistinguishable
from 7 — and contextTokens was declared here while only Tool sends it.
A MultiEdit card named its file in the headline and again in the diff
header, truncating one fact twice. The diff takes the path only where
nothing around it has said it, which is the change preview.
A settled call whose whole output was "ok" measured 109px, against 39px
for one that printed nothing — a 2.8x height for two characters. Nine
ordinary calls filled a screen, two thirds of it padded ground holding
nothing. A surface exists to cut a block of machine text into the page,
and one line is not a block.
Three separate costs, each measured:
- The block's own padding and ground: a one-line output takes neither.
- The "more below" fade, drawn on every settled card whether or not
anything was clipped. Clip already knows; it now says so.
- .term's 13px bottom margin, which held the surface off the next
element and holds nothing off anything once there is no surface.
A turn of nine plain calls: 1474px to 1162px.
The diff header wrapped a long path across three lines, so the card grew
by what a path happened to measure — 37px of header became 105px, and
the file read as an empty band above its own diff. It ellipses now, with
the whole path in the title.
The bar floats over the transcript's top edge, so a row landed at the
usual 12px clearance arrived underneath it — the first hit of a search
was the one hit that could not be read.
668 comment blocks, 1500 lines, met one aside at a time while reading
rules. Almost none of them restated the CSS: they are measured colours,
layout mechanics, and why the obvious rule is the wrong one — knowledge
worth more than its placement.
It moves to two companion documents read end to end. TOKENS.md holds the
vocabulary's law: why --float exists apart from --raised, what the
categorical palette was measured against, why the type floor is 11px.
LAYOUT.md follows app.css rule by rule.
No declaration moved: both files are rule-for-rule identical to what
they were, apart from the diff gutter taking --faint and the plan's
completed rows losing the opacity that dimmed them twice.
REASONIX.md states the rule and where a constraint goes: to the
component that has to honour it, or to the stylesheet's companion when
the decision is about the medium itself. It also states that comments
are written in English — commentary in two languages is two codebases,
and the half a reader cannot read is the half that rots.
`"[data-pane="flow"]"` closed its own string, and since 60b028856
cards, bench, look, motion, scale and verify have not parsed at all —
21 card-geometry assertions and 20 behaviour assertions that nobody ran.
selfcheck read that as health: it injects a false assertion and asks
whether the exit code turns red, and a SyntaxError is also non-zero. It
now asks whether the guard parses first, then whether it can fail.
contrast.mjs could only draw four of the transcript's cards, so the
diff gutter's line numbers sat at 4.42 against AA's 4.5 undetected. Its
feed now covers sixteen, which found five more: the plan's completed
rows were dimmed twice, by colour and by opacity, putting their text at
3.22 and the tick at 2.86. Three further corrections to the guard
itself: it stops animations rather than waiting them out (a staggered
entrance measured .cost at 2.04 while it sat at opacity 0.46), it prints
the ink, the ground and the ancestry rather than a signature that four
cards share, and it skips fully transparent text — unpainted text has no
contrast, and whether a hover-only control is reachable is another
question.
**Find in a conversation.** The transcript mounts a few dozen cards out
of however many the session holds, so the browser's own find sees only
what is on screen: with 200 messages, 59 cards are in the DOM and the
first one cannot be found at all. The search reads the rows instead —
saidBy() is exhaustive over Item, so a new card has to answer what text
it carries. Matches are painted with the highlight registry rather than
by wrapping text, which would mean rewriting markdown React owns inside
cards that re-render on every delta.
**Listings are highlighted.** rehype-highlight, lazy like katex, emits
classes rather than inline colours: a highlighter writing its own hex
values leaves the token system and stops following the theme. The
palette is four new tokens; comments and punctuation ride --faint and
--muted, so they follow the contrast tier. A fence with no language
stays unpainted — guessing a grammar paints prose as code.
**A message can be rewritten and sent again.** Composed from what the
kernel already owns: a conversation rewind to that turn, then a send.
The TS mirror of RewindResult was missing conversationOk, so a commit
that touched files and left the conversation standing was
indistinguishable from one that truncated it — which would send the
message twice. The type is completed and the pair is declared in
wireparity.
**The capability a call resolved to reaches the card**, when the name
has not already said it: `tool:grep` beside Search is one fact twice,
`skill:review` is not.
**The task list draws the status its owner keeps.** Three renderers
each re-derived "which step is underway" as the first unticked one,
while HostTodo has carried status, activeForm and level all along. A
list the kernel has written but not started now points at no step, the
step in hand reads as its active form, and sub-steps indent. A
complete_step advance reaches the panel on its own frame instead of
waiting for the turn to end.
Pane.tsx was at the 800-line ceiling, so find and rewind became hooks
rather than the baseline being widened.
Twenty-two of the fifty-four tools the kernel registers had no entry in
either table, so a call through use_capability rendered as its own
title-cased id under the mark that draws a page with a folded corner. A
delegation, a memory write and an install all read as file reads, and
the category colour — the row's only warning — was the neutral one.
install_source was the worst of them: it is not read-only, it installs
an MCP server, and it had no identity at all. It was found by the gate
rather than by the sweep, whose regex missed its Name() spacing.
The fallback mark becomes a neutral dot: "·" is a document, so a name
with no entry was claiming to have read a file.
tool_identity_test.go holds both directions — a registered tool with no
label, and a label naming nothing the kernel registers. A tool is a type
with a Name and a Schema; matching on the name alone reads every bot
adapter in the tree as one.
The rule in this tree is that an error a caller must tell apart carries an
identity and never a sentence. Tool results were the exception, and the
projection comment said so outright: "only that record says a tool call failed"
— meaning ToolExecution, which the shell path writes and nothing else does.
Everything else left the fact in the words, and isErrorMessage matched "error:"
against prose the tool itself wrote.
Measured across real sessions by day: the shell side was closed on 08-17 and
has written an identity for every failure since. The rest never was — 27 on
08-16, 10 on 08-17, 16 on 08-25, and still arriving in September.
toolOutcome already held what was missing. Its refusalCode comment even says
the identity is "carried beside the words rather than recovered from them" —
it just stopped at the message. ToolFailure now carries it: non-nil is the
fact, RefusalCode names a host refusal. Local metadata on the ToolExecution
pattern, so projection.go keeps it for the next compaction and strips it at the
provider boundary. isErrorMessage reads it first; the prefix match stays as the
answer for transcripts written before any of this, which is what it always was.
The identity also never crossed the wire. event.Tool has had RefusalCode all
along and eventwire.Tool did not, so no frontend could read one — parity was
silent because both sides were equally missing it. Both carry it now, the
history projection carries it, and a failure label says which refusal it was
instead of "失败".
ToolFailure and ToolExecution move to local_metadata.go: provider.go was 1087
lines against an 800 ceiling and -update refused to widen for the extraction,
which is what it is there for. Trimming one sentence that the new file's own
header already states brings both budgets down instead — essay 3218→3217,
file-size 38207→38188.
use_capability is one provider-visible tool that stands in for every hidden
capability. The card takes its heading, its hue and its argument summary from
what the call resolved to, which is why a live transcript reads "Remember ·
2026-08-20 会下雨" and not "MCP". Reopening the session read "MCP" with no
argument at all: three separate places dropped the identity on the way.
historyMessages projected ID/Name/Arguments and left ResolvedName and
CapabilityID behind, though provider.ToolCall carries both and their comment
says they exist for exactly this. The rebuild in state/session.ts then had
nothing to pass on. And shortArgs read only the envelope's top level, where a
proxied call has action and capability_id and nothing a reader wants — the real
call sits under `arguments`, a field the proxy's own schema declares, so
reading one level in is following the contract rather than guessing.
Measured on a real session before and after: one blank "MCP" card became
Memory · 天气 下雨, Remember · 2026-08-20（周四）会下雨, and a Remember whose
arguments were refused. The remaining MCP card is action=list, which resolves
to no capability and correctly says so.
historyToolCall joins mirroredWireTypes. It was a hand-written pair with no
guard, which is how a field goes missing on one side and nothing notices;
removing resolvedName from the TypeScript side now fails wire-parity by name.
The history projection moves to its own file rather than widening serve.go's
budget — 1294 lines against an 800 ceiling — which hands back 70 lines.
Narrowing the provider surface to what a turn admits left the estimate behind:
context_breakdown and estimatedVisibleRequestTokens both asked the registry for
Schemas(), which answers with everything provider-visible whether this turn
carried it or not. The estimate is compared against a window the provider
enforces and a maintenance line the host folds at, so an estimate that counts
tools no request carried folds earlier than the conversation needs.
The surface is recorded where it is already computed — run_loop asks
ProviderSchemas once per round and hands it to the prefix-shape capture — and
the two estimators read that instead. Before any request has gone out there is
nothing to have carried, and the whole visible set answers: it overstates, which
is the direction that folds early rather than overrunning the window.
lastProviderSchemas is on sessionCarryOver for the same reason lastPrefixShape
is: the next request rebinds it before anything reads it.
The gutter names a category twice: the mark carries the hue and the line under
it carries the same hue at 30%. net, deleg, write and ask each had both. mcp
had only the mark — its line fell through to the default grey, so the icon said
"this went out to the network" and the stripe beneath it said "ordinary tool".
mem had the same gap, unrendered in the fixture and visible only in the
stylesheet.
src/styles/gutter.test.ts reads both halves out of app.css and fails a mark
whose line carries a different hue, or none. host is the one exception and
carries its reason: its line is a dash, because colour names the category and
texture names who authored the step.
Found by measuring what the fixture actually paints rather than by reading the
rules — the two mcp declarations sit four lines apart and look complete.
Three states existed where the model could only tell two apart: in the schema
and callable, registered but hidden behind use_capability, and — the one that
was nobody's intent — in the schema and refused. update_goal lived in the third:
its ProviderVisible already reads the turn for a goal recorder and its refusal
already carries goal.no_active_turn, but provider requests asked Schemas(),
which answers without a context. Across 534 real sessions it was called 121
times and refused 116.
The reasoning for asking without a context is in SchemasForContext's own
comment: a contextual answer would churn the cache-stable contract. Under
alphabetical order it would — bash_output sorts fourth of twenty-five, and
moving it invalidates the twenty-one after it. Measured rather than assumed, in
benchmarks/tool-surface-cache: at the head a tool costs 896 cached tokens, in
the middle 384, and appended at the tail it costs nothing at all.
So ProviderSchemas sorts in two segments — every stable tool, then every
contextual one the turn admits — and the two request sites take it: the sampling
request, and the prefix-shape capture, which has to see what was actually sent
or the cache diagnosis reports a surface no turn carried.
The five guards that held the old surface are rewritten to the new contract,
which is stronger than what it replaces rather than narrower:
- the stable segment must be byte-identical whatever the context, and every
contextual tool must come after all of it, so an absence is a prefix of a
presence. Nothing asserted that before; it is the property the cache rests on.
- the contract/provider comparison matches by name. Position-wise only held
while the two sets were identical, which is exactly the assumption being
dropped.
- subagent and planner isolation now read the schema rather than the refusal: a
child without the parent's recorder must not be offered update_goal at all.
The executor, which holds one, still is — an asymmetry the old "always
present" assertion could not express.
The tool schema was held still on the reasoning that changing it churns the
cache-stable prefix. True of a change anywhere, false of a change at the end,
and nothing measured which applied.
Against deepseek-chat, 10 tools behind a 1278-token system prompt: appending at
the tail reports 2048 cached tokens against a 1920 baseline — more, because
every token before the new one is unchanged and the request is longer. The same
tool at the head reports 1024, and editing the fifth tool's description 1536,
which is the tail after the edit.
A tail tool alternating absent/present holds 1920 and 2048 across three
switches with no miss spike, because the absent surface is a byte prefix of the
present one and one cache entry serves both.
It reaches the network and spends a few thousand input tokens, so it stays out
of lint and CI, next to pricecheck.
A capability kept out of the provider schema is reached by listing the catalog
and then calling by id. The listing named every id and no arguments, so the
first call could only be a guess. Measured over 534 real sessions: 12 calls
went out against 3 inspects, and 5 came back "it requires ..." — the proxy
description does say "inspect one for its arguments before calling", and a 12:3
ratio is what that instruction is worth.
The two lists the contract error prints after a call has been spent are now in
the listing before it: required field names, and every declared property. Read
from the target's own schema through the registry, the same source inspect
already used, so a tool that changes its schema changes what list reports. An
entry that is not a registry tool, or whose schema declares no properties, says
nothing rather than reporting empty lists a reader would take for "takes no
arguments".
listCapabilities and listServers move to their own file. usecapability.go was
1667 lines against an 800-line ceiling and this would have added 23 more;
carrying the debt forward through -update is what the ratchet exists to refuse.
Split instead, and the file drops to 1557 — 113 lines of file-size budget
handed back.
Not done: projecting the hidden-capability catalogue onto the turn, which was
the other half of the plan. Built, measured, removed. The block ran 870
characters against a 3486-character turn — a quarter of it — and broke
TestEffectFoldDropsSupersededStandingState by moving the fold boundary. The
premise did not hold either: remember fails once on arguments and succeeds on
the retry in the same session, so the model finds it when a task calls for it.
Zero use across 534 sessions is 534 tasks that never needed to remember
anything, not a capability out of reach.
id="flowScroll" was written into Transcript, which renders once per pane, so
two open panes answered to one id and the rail's aria-controls pointed at
whichever came first — not necessarily the one it scrolls. The sweep only ever
reported it with two panes open, which is a state its 23-step walk does not
reach; it turned up on a session opened by hand.
useId per pane. The stylesheet and the perf scripts move to [data-pane="flow"],
an attribute the element already carried, so nothing depended on the id being
the same string twice. Specificity drops from (1,0,0) to (0,1,0) and the four
rules still land: .scroll is written earlier in the file, and the [hidden] rule
gains a second attribute.
#trajScroll in that same [hidden] rule has no element anywhere and is left
alone.
Vertically clipped output has two tells — the fade at its foot and "Show all".
Horizontally hidden output had none, and the scrollbar is an overlay: at rest
the line simply looks finished.
Measured over 499 real sessions, 7587 tool outputs: 54% have a longest line
past the ~80 columns this width fits, and 31.5% past 120. In one session on
screen, 19 blocks scroll sideways; the worst holds 2881px of content in a 624px
box, so 78% of it is off-screen with nothing saying so.
A right-edge fade on the same gradient as the foot, driven by the block's own
inline scroll position: opacity starts at 0, so a timeline that is inactive —
which is what an output narrower than its column has — draws nothing at all.
Verified by progress rather than by computed style, since an opacity animation
is composited and the main thread reads the base value: 0 unscrolled, 0.5 at
the midpoint, 1 at the end, where it fades out.
712 assertions, and audit-sweep clean at 1600/820 in both themes. The dupId it
reports for #flowScroll is present with this stashed — two panes, one id.
Four levels sit in the right rail, and the block title was at the bottom of all
of them: 12px w700 at --ghost, against rows of 13px at --faint, a legend at
--muted and values at --text. Smaller than anything it introduces, and the
palest ink in the column. Of the three signals it carried, two said "minor".
In English the tracked uppercase carries it — that is what an eyebrow is, and
the sweep has never had anything to say about it. Chinese has no small caps to
carry, so once the letterspacing came off there was nothing left but a slightly
bolder, slightly paler line the same length as the rows beneath it.
It takes the column's own size now and ink one step darker than the rows, so
weight alone carries the rank. Not a larger size: the context total went to 22px
to give this column one place for the eye to land, and six more large things
would be six more places. Size is what that landing is made of, and spending it
here spends it there.
The rule is split out of the :lang(zh) group rather than layered over it, since
:is() takes the specificity of its strongest arm and the group has a
three-class one. .side .lbl is named inside the new :is() for the same
arithmetic — the rail's own rule for it is written later in the file.
Six titles measured: 13px w700 --muted, no tracking, no transform. Clean at
1600/820 in both themes in Chinese, and in English, where the rule does not
apply; contrast-sweep reports zero across twelve sections in both schemes.
The sweep parsed getComputedStyle's text by hand, and a computed colour comes
back in whichever notation its value was authored in. An oklch colour arrives
as `oklch(0.85 0.012 255)` — lightness under 1, hue past 255 — and read as
8-bit RGB that is r=1, g=0, b=255, which is the #0100FF the report was full of.
Hue 262 gave b=262 and printed #0100106, seven digits wide.
So every settings page was being judged against colours nothing on screen has.
Ten rows of "below AA" in dark and eight in light were invented, and a real
failure among them could not have been told apart. A gate that misfires is
worse than no gate: this one was printing a verdict on eleven panels it was
not measuring.
It paints instead of parsing now, the way audit-sweep already did: fill a 1×1
canvas with the value and read the pixel back, which is the same engine that
drew the thing under test and accepts every notation there is. The fillStyle
reset before each fill is not decoration — an unparseable value leaves the
property at what it held last, and the sweep would report the previous
element's colour as this one's.
Both schemes now report zero across twelve sections. Raising --text to 88%
brings eight rows back with every colour legible, and dropping it again clears
them.
The light scheme's neutrals were laid out along hue 255. #EEF1F7 has more blue
in it than red, which is what an engineering tool looks like, and it sat under
an amber accent — the two are on opposite sides of the wheel, so the largest
surface in the window and the colour that means "you are needed here" were
quietly working against each other. They run along hue 85 now: #F4F1EA, red
over blue instead of under it.
Only the hue and the chroma move. Lightness is untouched at every one of the
52 declarations, so no contrast ratio was traded for this, and --raised and
--float keep a chroma of zero — a card stays white on a warm ground, which is
the arrangement that was drawn and chosen.
Dark keeps its blue. The two schemes' neutrals interleave through this file by
selector — :root under a media query, then [data-theme], then three contrast
tiers of each — so which side a declaration belongs to is read from its own
value instead: in light a surface is bright and ink is dark, and in dark both
are the other way round. 52 declarations moved and 52 stayed.
--shadow-float stays cool. It is a fifth of an alpha over the ground, and it
was not part of what was drawn.
contrast-sweep could not check this: on every settings page it now prints
colours like #0100106, a channel-parsing fault that reproduces with the change
stashed and predates it. audit-sweep's own contrast judgement is sound —
raising --text to 88% made it report 174 rows with the warm ground resolved
correctly in every one — and it reports none here, at 1600/820/760, with dark
unchanged.
Letterspaced uppercase is Latin lettering. Tracking separates words there; on
Han characters it pulls apart the strokes of a single glyph, and uppercase has
nothing to act on at all. The stylesheet already knew this — a :lang(zh) rule
hands seventeen small-caps selectors a normal face, no tracking and no
transform — but ten more had been written since, and one of them is the only
semantic heading the workbench has. In Chinese the right rail's block titles
were 11px at 1.54px of tracking, uppercase, with .dgrp-h's own count inheriting
both: 成本, 运行指标, 子代理, 本会话.
Which ones belong is settled by where the text comes from, never by reading it.
A class carries Han if its element's children call t(): .hl .fail says "{n}
项失败" and joins, while .hl .src and .hl .who sit in the same badge row and
stay, because what they render is an MCP server's name and a subagent's id.
.shot .glyph stays too — IMG, TXT, PDF are not words.
Two things that judgement cannot see, so both were measured in a running
window: a label handed down through props (.seglb, .dgrp-h) shows no t() at the
element, and it is exactly .dgrp-h that was worst.
audit-sweep grows a ninth judgement rather than leaving this to a script that
runs once. hanCaps reads resolved style — Han text under tracking or uppercase
— so it holds whatever rule set it, and it rides the walk into the panels a
render-time check would never open.
The first clean run was a false one: the sweep drives the kernel build, where
the language comes from the kernel's config and adopt() overwrites the
localStorage the fixture answers to, so it had been measuring English. With
[desktop] language = "zh" and .dgrp-h pulled back out, the sweep reports the two
rows; put back, zero. Clean at 1600/820 in both themes in Chinese, and at 1600
in English, where nothing in this change applies.
Monospace says a machine produced this: a path, a command, an id, a column of
figures that must not jump, a mark that has to hold its cell. The window was
setting its own sentences in it — "仅当前项目 · 后续相关时会被检索", "Palettes
install under themes/ …", every empty state, every settings footnote — and a
column of prose in that face reads as a terminal rather than as something
written. Measured on the fixture: 54% of the transcript's characters, 37% of
the right rail's.
The judgement is structural and never looks at the words, because a rule that
sorted sentences from identifiers by reading them would be the phrase table
this repository does not build. A class is monospaced if a rule in app.css
gives it var(--mono); an element renders prose if its own children call t().
The two together found 63 classes across 155, which a screenshot could not
have — a sweep sees what one render drew, and most of these live on panels a
walk never opens.
46 rules move to var(--ui). What stays is what earns it: terminal output, tool
arguments, paths, URLs, ids, every figure, and the marks. Where a rule wanted
figures not to jump rather than a face, --msub already said so with
tabular-nums; .fold gets the same, because it repaints every second while a
turn runs.
src/styles/mono.test.ts holds it, and holds the two exception lists apart. Nine
marks and keycaps carry a reason each, plus the welcome screen, whose wordmark
is deliberately set in the terminal's own face. Thirty-six classes render prose
and data through one box; splitting those is a change per call site rather than
per rule, so they are recorded and may not grow. A third assertion fails an
entry that stopped being needed, so the lists cannot outlive their reasons.
Reverted one rule to check the gate reports it, then reverted that.
Characters set in monospace: 42% → 33% overall, 54% → 45% in the transcript,
37% → 22% in the right rail. Held by audit-sweep at 1600/820/760 in both
themes against a kernel, and by 712 unit assertions.
Two numbers that only mean anything together. The transcript's prose was
13.5px in an 820px column, which measures 103 Latin characters or 56 Han to
the line — half again past the 45–75 / 30–40 where the eye still finds the
start of the next line without hunting for it. The column was right and the
size was small, so neither one looked wrong on its own.
--read moves to 15px, 16 in Chinese where the strokes are denser, and the
step ladder shifts with it so a reader who had already picked a size keeps
the one they picked. --doc goes to 706px, which is not taste: the narrowest
thing this column has to hold is 80 columns of IBM Plex Mono at --fs-ui,
measured at 624px, and the transcript's own indent and padding want 82px
more. The main-line terminal block now lands on exactly 80 columns.
Measured on the fixture at 1600x1000: the answer's line goes 103 → 71 Latin
characters and 56 → 39 Han, 36 at the Chinese default. Sub-pixel spill is
unchanged at seven elements, every one a 2px rounding that predates this.
Held by audit-sweep at 1600/820/760 in both themes, against a kernel and
against the fixture, and by the 709 unit assertions. Both sweeps still
report four prefs truncations and the oobe contrast findings; both are
there with the change stashed.
Twelve counts render in the rail and six of them say "0 会话". A machine row
counts open panes, so every machine says it at rest; a workspace with no saved
conversation says it under its own name, and the absence of rows beneath it had
already said so.
Plan.tsx settled this for the transcript — a block reading "0 / 0 · 尚未制定" is
a wall to skip on every glance — and the session row in this same file has
always followed it, printing nothing for a turn count of zero. The workspace row
and both remote rows did not.
An empty project has nothing to report and one thing to offer, which is the "+"
beside its name.
Five measurements, five changes, all in the stylesheet.
The transcript separated what the model said from what a tool did by colour and
leading alone — same 14.5px, same weight — so a column of them scanned as one
undifferentiated stream of events. The answer gets a size step; machine output
stays where it was. Its own breathing room widens with it, which pulls the
rhythm apart into three real steps: 22px between two machine rows, 32px across
the boundary into speech, 42px between two separate utterances. It was 22/28/34,
a ladder pointing the right way with treads too shallow to feel.
Every tool card carried a filled icon chip, which meant the fill said nothing.
It is transparent now for the neutral ones, so net/write/ask/deleg/mcp keeping
theirs turns the fill into the signal the gutter's own comment always claimed it
was. Their headlines keep the heavier weight too; the rest step down.
Settled output that succeeded is clipped to a glance. The criterion is outcome
rather than category: a call still running and a call that failed keep theirs,
because a failure's output is the only thing that step has to say. Measured on a
full turn: unrequested output 560px to 358px. The transcript itself only drops
7.6% — the bulk of it is card count, not output, and this does not change that.
The right rail read as a dump because it was set as one: 33 numbers at rest and
37 of its 62 text elements sharing two nearly identical steps, with a single
15px element as the only hierarchy. Nothing was removed and nothing shrank —
hierarchy by making five things smaller is five chances to make CJK illegible.
The context total goes to 22px and its gauge from 6px to 10px, so the eye has
somewhere to land and everything else becomes background by staying still.
The product introduces itself in Inter 200 under a 0.34em all-caps eyebrow,
which is what any product reaches for. Its own vernacular is the terminal, and
that face is already in the bundle: the wordmark is set in it, and the eyebrow
becomes a lowercase line. No new bytes, the metallic sweep intact, and no
overflow at 900px where a monospace wordmark could have found one.
Held by contrast/cards/motion/panels/overflow/press/lang, in both themes.
"Never: incident or conversation history" is a rule nobody recognises breaking.
A writer with a fix in hand narrates the fix, and the result passes every gate
there is, because the essay rule compares line counts and nothing reads
register. Meanwhile the instruction to write code that reads like the code
around it is unambiguous, and much of the tree reads as prose — so the tree
teaches the habit back faster than the rule removes it.
The rule now states its test — a reader who has never seen an earlier version
must lose nothing, and past tense about this code's own behaviour is the tell —
gives the paired example, says where the narrative does belong, and says that it
outranks the surrounding style. It also says no gate reads register and why one
will not be built: separating narrative from a statement of constraint needs a
phrase table, which is the one thing this repo does not build. That rule is held
by review, and saying so is better than implying a check exists.
repolint's paragraph no longer claims to enforce all of it.
Deleting a conversation another Reasonix process has open is refused, and the
refusal was a dead end. The pane map belongs to one process, so the sidebar
shows no pane to close, no button in that window would close one, and
session.in_use rendered as "held elsewhere — close it there first" while naming
no there. The guard had already read the lease in order to refuse and knew the
pid, the hostname and when it was taken; all of it was dropped at the boundary,
and the wording it left behind — still being written to — is not even true of
that case, since nothing is writing.
session.in_use_by carries the holder, and only when the holder is another
process: a lease this one holds does mean a write is in flight here, which is a
different cause and keeps the old code. Params already reach the window's own
wording, which is what busy's params exist for.
Verified against two hosts sharing a state root: the refusal named pid 88240,
pgrep confirmed that was the second host, and the delete succeeded once it was
gone. The rest of the flow was exercised in the same run and is sound — an
unheld session deletes, close-then-delete deletes, and the rail's own gesture
asks, deletes what it asked about, and sequences the pane close ahead of the
delete rather than racing it.
Orphan hosts are what produce the state in the first place, and nothing here
stops them being produced.
GET /todos has been publishing the canonical task list — the latest todo_write
merged with every complete_step advance — and the window never called it. The
panel derived its own instead, by parsing todo_write arguments back out of the
transcript, which is a second implementation of rebuildTodoState and drifted
from it two ways: it replayed no complete_step, so every sign-off was lost, and
it checked no receipt, so a list the kernel refused became the plan. Every
rebuild — on mount, on rebinding a pane, on a stream gap — reset the panel to
the list as the model last wrote it. A signed-off item rendered as the current
one and no later call could move it, which is what "the todo panel will not
clear" looks like from the outside.
The task list is not derivable from a transcript at all: the advances are not
todo_write calls, and the refused writes are. So fromHistory stops trying, the
window asks, and the reads that re-open a session are collected in one place
with the new one. A turn's end re-reads the list too, for the points it moves
with no event to say so — a cancel makes the kernel rebuild its own state. A
read that fails leaves the panel as it stands rather than blanking it. The live
path is unchanged except that a refused todo_write no longer sets the plan.
"A plan that ran to the end is spent" now has one definition, because two ingest
paths have to draw a finished list the same way.
todoItem is lifted to a named type and declared in wireparity: the desktop keeps
a hand-written copy of it, the two are compiled by different toolchains and meet
only over JSON. The handler moves to its own file, which takes serve.go 21 lines
further under its ceiling; the reclaimed budget is recorded.
withTodoIdentityTail decided it owed nothing whenever every step id was still
readable in the view. Ids are readable forever: they sit in the model's own
todo_write arguments. The statuses under them do not stay put — complete_step
advances the canonical list host-side without the model writing anything — so a
list the host had moved on went on reading as the model last wrote it, and the
next sign-off named an item the host no longer called current. complete_step
refuses that, which costs a whole round at full context to learn nothing about
the task.
Canonical state changing and no projection rendering the change is the case
"Detection is semantic" exists to forbid. Freshness is now decided against the
rendered line — citation and status together — through a single todoStateLine
shared by the note and the check, so what the projection says and what the
check looks for cannot diverge.
In 23 recorded sessions complete_step failed 16 times in 43 calls; five of those
are this, the largest single group.
Every session stays mounted and the off-screen ones are hidden with CSS, so a
tab switch throws away no stream, no transcript and no scroll position. That
trade is affordable only while the hidden panes are quiet, and one of them was
not: the /status poll was gated on the turn running, never on the pane being
visible. Each background pane with a live turn therefore cost a round trip and
a full re-render of its subtree four times a second, plus two JSON.stringify
passes over the status object, and the bill scaled with the number of open
conversations rather than with the one being watched.
The poll and the elapsed clock now need the pane to be visible; when the run
began is still recorded either way, so a pane brought forward mid-turn shows the
time that passed instead of restarting at zero, and the tick fires on the way in
so it is current rather than up to 250ms stale. The wait spinner in the
transcript gets the same treatment: ten redraws a second are wasted on a pane
nobody has open, and it reads from the stamp, so the tick on the way back in
covers the whole wait.
Measured on a real pane driven by a mock port with fake timers: four /status
reads per second per hidden running pane before, zero after. That is what the
new test asserts, and removing the visibility gate turns it red.
A turn that stopped with items still open was read as work left undone, and
continueUntilReady pushed it on for up to eight rounds with a message the host
wrote. That is right for a step the model can advance alone. It is wrong for a
step whose next input is the user's — presenting one item of a list and waiting
for a reply was indistinguishable from quitting early, so a list worked one item
per turn could not be worked at all: the turn stopped, the host restarted it,
and the whole list came out in one round.
Nothing about the shape of a turn tells those two apart, so a call does.
await_user joins ask and conclude_blocked as the third way a turn ends on the
model's terms: it names the waiting item and what the user must supply, the list
is kept as it stands, readiness waives the open list, and the continuation loop
does not run. Under a Goal the gate is a pause cause, so the FSM stops rather
than driving through it and the evaluator does not spend a call judging a turn
that already said why it stopped; the next user turn lifts that pause and no
other.
The guards are structural: there must be an open list, the step_id must name an
item on it that is not completed, and there must be an interactive user — a
headless run refuses and is pointed at conclude_blocked. The continuation prompt
names the call too, so the round being told to keep going can take it.
Prefix cost is 292 tool-schema tokens for the new schema, and every existing
session cold-starts its prompt cache once.
Left undone and worth its own change: conclude_blocked is registered but absent
from HostControlToolNames, so the host names it as a way out of an unfinished
turn while the schema does not carry it and only use_capability reaches it.
Adding it grows the prefix enough to move where the compaction fixture in
TestEffectFoldDropsSupersededStandingState lands its first fold, which that
test reads as a fold that dropped nothing.
2026-09-14 01:05:43 -07:00
5547 changed files with 383411 additions and 335493 deletions
Write-Output "::error title=studio-signing.unexpected-signer::STUDIO_SIGNING_SUBJECT is '$($env:EXPECTED_SUBJECT)' but $file is signed by '$($certificate.Subject)'"
$failed = $true
}
}
if ($failed) { exit 1 }
'Certum payload and installer signing, signer, trust and timestamps passed.' >> $env:GITHUB_STEP_SUMMARY
<p align="center"><strong>Open source · MIT · a single Go binary</strong></p>
<h3 align="center">A coding agent you can leave running.</h3>
<p align="center">One local engine, four ways in — terminal, desktop app, browser, or your editor over ACP. Plan mode, permissions, a workspace sandbox and per-turn checkpoints keep a long autonomous run something you can still read and undo.</p>
<p align="center">Maintained by <strong>Huahui Yu</strong>.</p>
> [!IMPORTANT]
> **Community · 加入社区** — bilingual Discord for setup help (`#help` / `#求助`), workflow showcases, and feature ideas. → **<https://discord.gg/XF78rEME2D>**
<br/>
## Versions
Reasonix ships on two lines. See the [version roadmap announcement](https://github.com/esengine/DeepSeek-Reasonix/discussions/10748) for the reasoning behind the split.
- HTTP `serve` protections for the unauthenticated local server, including
localhost binding assumptions, JSON-only state-changing requests, and CORS
restrictions.
- HTTP `serve` protections, including the default per-launch token, the launch
token every state-changing request requires when authentication is opted
out, localhost binding assumptions, JSON-only state-changing requests, and
CORS restrictions.
- Desktop and bot session isolation, including per-workspace session metadata
and configured bot allowlists.
- Updater, install, and release verification paths.
@@ -67,10 +68,10 @@ The following are normally treated as trusted local/operator-controlled inputs
unless another bug lets an untrusted actor supply them:
- CLI arguments and text typed directly by the local user.
-Project configuration files intentionally loaded from the current workspace.
-The user's own configuration under the Reasonix home directory.
- Explicit `@path` references supplied by the local user to attach local files.
- MCP servers, language servers, hooks, and slash commands installed or enabled
by the local user.
- MCP servers, language servers, hooks, and slash commands installed, enabled,
or approved by the local user.
- Provider base URLs and model names configured by the local user.
The following can be security issues when reachable by an untrusted actor or
@@ -89,6 +90,56 @@ when they bypass the intended boundary:
- Trusting unverified update artifacts, plugin definitions, or downloaded
binaries.
## Project Configuration
Files that arrive with a workspace are untrusted input: `reasonix.toml`,
`.reasonix/settings.json`, `.mcp.json` and the project `.env`. Cloning a
repository is not a decision to trust its author, so these files may narrow
what the user configured and never widen it.
| Setting | What a workspace file may do |
| --- | --- |
| `sandbox.bash` | Move `off` to `enforce`, never back |
| `sandbox.network` | Move `true` to `false`, never back |
| `sandbox.forbid_read`, `sandbox.denied_domains` | Add to the user's lists |
| `sandbox.allow_write`, `sandbox.workspace_root` | Apply only when they resolve inside the workspace, symlinks followed; `${VAR}` in any sandbox path expands from the process environment only |
| `sandbox.host_authorities`, a user's `sandbox.allowed_domains` | Nothing |
| `permissions.deny`, `permissions.ask` | Add to the user's rules |
| `[[providers]]`, `tools.system_one` endpoints | Declare them; they stay out of use until approved, and model settings naming them fall back to the user's |
An "always allow" answer, or extra write access, granted in a workspace is
stored under the Reasonix home, not in the workspace.
Programs a workspace names for the host to run stay off until the user
approves them for that workspace:
- Hooks, language server commands, `tools.search.rg_path`,
`tools.shell.path`, `[browser]` and `tools.system_one.laya.python` are
approved with `reasonix trust`, or for hooks by saving them from the hooks
editor.
- An approval is stored under the Reasonix home with a digest of the
declaration and of the workspace files it names; any change needs approval
again. Approvals and grants belong to one workspace folder.
- Hooks and language servers are checked against their approval again before
each start, and refused if a file they name changed, appeared or now
resolves elsewhere.
- A single program path (`tools.shell.path`, `tools.search.rg_path`,
`[browser]`, `laya.python`) may not point into the workspace, an
`allow_write` root, a temporary directory or a toolchain cache the bash jail
leaves writable, and may not climb with `..`; its approval covers the
program file's content.
-`tools.system_one.laya.local` is read from the user's configuration only.
- Without an interactive frontend they stay off.
- MCP servers a workspace declares stay off until the user enables them for
that workspace.
A project value that is not applied is reported as a load warning with the
reason. A way for workspace files to widen any of the above without the
user's approval is a security issue.
## `@` File References
Reasonix supports `@path` references so users can include local files and images
| `-task` | *(all)* | Suite mode: run only these comma-separated task IDs (e.g. `-task fix-add-bug`); unknown IDs fail with the available list. |
| `-attempts` | `1` | Suite and diff modes: retry a task until an attempt passes, up to N; enables the `Pass@≤N` KPI, and TTCS charges a retried solve with its failed attempts' wall. |
| `-trials` | `1` | Suite mode: run every task N times and keep every outcome. Adds a **Reliability** line: `pass^N` (tasks that passed every trial), `pass@N` (any trial), mean `pass@1` over all trials, and the flaky tasks by name. `Pass@≤N` asks whether the agent can solve a task; `pass^N` asks whether it does so every time. Cannot be combined with `-attempts`. |
| `-tape-record DIR` | — | Suite mode, with `-meter`: record every provider exchange at the meter, one tape per task and trial (`DIR/<task>/trial-N/0001.request.json`, `.response.json`, `.response.body`). Taped runs use a fixed workdir path and pin the seeded files' times, because both reach the model through the workspace block and file listings. |
| `-tape-replay DIR` | — | Suite mode, with `-meter`: answer each run from its tape instead of the provider, and add a **Replay** line naming the first request whose body differs from the recorded one, down to the message (`request 2, message 4 (tool)`), the tool list, or a field. The diverging request is kept as `NNNN.replayed.json` beside the recorded one. A kernel change that should not alter what the model is asked replays with every request matched. |
| `-bin` | `reasonix` | Path to the reasonix binary. |
| `-profile` | `baseline` | Tool-surface/runtime tier: `baseline` \| `economy` \| `balanced` \| `delivery`. All but `baseline` append `--profile <tier>` to the agent invocation; `baseline` passes no flag (byte-identical legacy control, behaviorally `balanced`). Economy starts with the core tool set and pays `connect_tool_source` rounds plus prefix resets to grow it — the report's Tool surface line prices that trade. |
| `-json` | *(none)* | Write the JSON report here (optional). |
| `-trajectories` | *(none)* | Suite mode: write one `<task-id>.trajectory.jsonl` per task into this directory (the agent's full event stream with timestamps — see `reasonix run --trajectory`). The report gains a time-attribution line (tools vs. model) and each JSON result a `trajectory` digest. |
| `-force-planner` | `false` | Suite mode: prefix each prompt with a plan-first directive so the two-model turn engages regardless of the planner gate. Use for the "with planner" arm of an A/B; results carry `plan_forced` so arms are only comparable with equal forcing. |
| `-anchor` | `blind` | Suite mode: which hypothesis the agent holds before it looks at anything — `blind` (none, the control) \| `correct` \| `wrong`. The seeded arms prefix each prompt with the task's authored seed and **skip** tasks that have none, so an unseeded control run never lands in a seeded denominator. Results carry `anchor`. See [Anchor resistance](#anchor-resistance). |
| `-cache` | `cold` | Suite mode: `cold` runs each task as a fresh session (the fair cross-agent comparison arm); `warm` primes the provider prefix cache with a one-step run in the same workdir first, measuring the long-lived-session steady state. Never mix arms in one report — compare them with `-mode compare cold.json warm.json`. |
| `-policy` | *(none)* | Suite mode: experiment arm. `memory-off` hides the memory store, which is the MemoryBench counterfactual arm; the empty default runs the baseline. |
| `-budget` | `800000` | Abort once total tokens cross this (`0` = no cap). Remaining tasks are reported as skipped. |
| `-meter` | *(off)* | Suite mode: route the benchmarked provider through the neutral measuring proxy, using this `config.toml` as the source. Spend is then counted at the request boundary instead of trusted from the harness. See [Neutral metering](#neutral-metering). |
| `-faults` | *(none)* | Suite mode: inject provider failures through the meter — absolute indices (`3:429`) and/or a cadence that scales with the run (`every:5:500`). Requires `-meter`. See [Fault recovery](#fault-recovery). |
@@ -538,33 +542,32 @@ writer.
## context-maintenance-e2e
This harness measures what happens when a long session goes idle past the
provider's cache TTL and then resumes: it A/B-compares cold-restart miss tokens
with and without pruning, and checks that the agent re-reads a file behind a
prune placeholder instead of hallucinating.
A cost-capped smoke for content-driven maintenance, in three legs over one state
directory: seed a session just below the compaction trigger, load it back and
check nothing is re-derived, then grow it past the trigger and check exactly one
summary lands.
It is hardcoded to the `deepseek-v4-flash` model at `https://api.deepseek.com`
and requires the `DEEPSEEK_API_KEY` environment variable.
Seed and resume take no provider; `continue` samples and needs
`DEEPSEEK_API_KEY`. The model is hardcoded to `deepseek-v4-flash` at
`https://api.deepseek.com`.
```sh
export DEEPSEEK_API_KEY=...
# Seed below the trigger: no checkpoint installed, no summary started
go run ./benchmarks/context-maintenance-e2e -offline seed
# Seed both arms (pruned + control) with a large session and warm the cache
go run ./benchmarks/context-maintenance-e2e seed
# Wait past the provider's cache TTL, then resume: prune the "pruned" arm and
# compare cold-restart miss tokens
# Reload: the projection version must not move and no summary may run
go run ./benchmarks/context-maintenance-e2e resume
# Run the comprehension trials (agent must re-read a pruned file and answer
# from it); exits non-zero unless every trial passes
go run ./benchmarks/context-maintenance-e2e comprehension
# Grow past the trigger: one summary, version +1, then no further summary
export DEEPSEEK_API_KEY=...
go run ./benchmarks/context-maintenance-e2e continue
```
| Flag | Default | Purpose |
| --- | --- | --- |
| `-dir` | `benchmarks/context-maintenance-e2e/run` | State directory for `seed`/`resume` (sessions + `meta.json`, `resume-<ts>.json`). |
| `-trials` | `5` | Number of comprehension trials. |
| `-dir` | `benchmarks/context-maintenance-e2e/run` | State directory shared by the three legs (session + `meta.json`). |
| `-max-usd` | `0.50` | Hard cost cap for the live legs. |
| `-offline` | off | Skip the live provider; `seed` only. |
Loaded 100 of 5547 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
esengine