feat: reasonix stats — cross-session cost dashboard + /stats slash (0.4.24)

Every turn run through `reasonix chat|code|run` now appends one line to ~/.reasonix/usage.jsonl carrying tokens + cost + the equivalent Claude Sonnet 4.6 cost. `reasonix stats` (no arg) rolls that log up into today / week / month / all-time windows with a "saved vs Claude" column. Pillar 1's pitch (94–97% cost reduction) becomes a fact users can check on their own machine. Same dashboard is available in-session via the new /stats slash, reading from the same file and rendering through a shared pure renderer. reasonix stats <transcript> keeps the old per-file summary (assistant turns + tool calls) for scripts. Privacy: only tokens, costs, session name. No prompts, completions, or tool args. Log append is best-effort — disk failure never blocks a turn. New files: src/usage.ts — appendUsage, readUsageLog, aggregateUsage, bucketCacheHitRatio / SavingsFraction tests/usage.test.ts — 15 tests (round-trip, malformed line, rolling windows, renderer, zero denom) Modified: src/cli/commands/stats.ts — dashboard mode + extracted renderDashboard src/cli/commands/run.ts — appendUsage on assistant_final (for CI) src/cli/ui/App.tsx — appendUsage on assistant_final (TUI) src/cli/ui/slash.ts — /stats slash (shared renderer) src/cli/index.ts — `stats <transcript>` → `stats [transcript]` src/index.ts — re-export usage module +17 tests (suite 708 → 725). Lint + typecheck + build clean.
feat(slash): /update shows current vs latest + shell command (0.4.23)
2026-11-08 01:48:26 -10:00 · 2026-04-22 22:24:59 -07:00 · 2026-04-22 22:13:32 -07:00 · 2026-04-22 22:06:29 -07:00 · 2026-04-22 21:34:11 -07:00 · 2026-04-22 19:07:44 -07:00
11025 changed files with 38876 additions and 1366648 deletions
@@ -1,5 +1,4 @@
-# Copy to .env and fill in. Only secrets belong here — a provider's base_url and
-# model are configured in reasonix.toml, where api_key_env points at these variables.
-
-DEEPSEEK_API_KEY=
-MIMO_API_KEY=
+DEEPSEEK_API_KEY=sk-your-key-here
+DEEPSEEK_BASE_URL=https://api.deepseek.com
+REASONIX_LOG_LEVEL=INFO
+REASONIX_TRANSCRIPT_DIR=./transcripts
@@ -1,33 +0,0 @@
-.gitattributes text eol=lf
-.gitignore text eol=lf
-.npmrc text eol=lf
-*.astro text eol=lf
-*.bat text eol=crlf
-*.css text eol=lf
-*.go text eol=lf
-*.golden text eol=lf
-*.html text eol=lf
-*.js text eol=lf
-*.json text eol=lf
-*.md text eol=lf
-*.mjs text eol=lf
-*.mod text eol=lf
-*.nsi text eol=lf
-*.plist text eol=lf
-*.py text eol=lf
-*.rs text eol=lf
-*.sh text eol=lf
-*.sql text eol=lf
-*.sum text eol=lf
-*.toml text eol=lf
-*.ts text eol=lf
-*.tsx text eol=lf
-*.txt text eol=lf
-*.xml text eol=lf
-*.yaml text eol=lf
-*.yml text eol=lf
-Makefile text eol=lf
-.githooks/** text eol=lf
-benchmarks/**/*.sh text eol=lf
-internal/runtime/agent/testdata/perseveration/** -text
-desktop/frontend-next/perf/media/delivery.pdf binary
@@ -1,6 +0,0 @@
-#!/bin/sh
-# Go-native pre-push gate replacing the retired v1 npm hook (install: make hooks).
-# Full tests run in CI; vet is the fast, cross-platform local check.
-set -e
-go vet ./...
-go run ./tools/repolint
@@ -1,44 +0,0 @@
-# Ownership for the studio line. Standard: docs/DOCS_STANDARD.md.
-#
-# Each rule lists exactly two owners: primary first, backup second.
-# GitHub requests review from both. The last matching rule wins.
-# repolint (codeowners, doc-owner) fails a rule for a missing path, a rule
-# without a backup, and a document header that names different owners.
-
-# Default: kernel, Studio shell, tooling, standing instructions.
-*                                         @esengine @SivanCola
-
-# User-facing guides and references.
-/docs/                                    @SivanCola @esengine
-/docs/THEME_AUTHOR_GUIDE.md                @esengine @SivanCola
-/sdk/                                     @SivanCola @esengine
-/README.md                                @SivanCola @esengine
-/README.zh-CN.md                          @SivanCola @esengine
-/SECURITY.md                              @SivanCola @esengine
-
-# Contracts and processes the Studio line runs on.
-/docs/DOCS_STANDARD.md                    @esengine @SivanCola
-/docs/STUDIO_*.md                         @esengine @SivanCola
-/docs/SESSION_MEMORY_RETRIEVAL.md         @esengine @SivanCola
-/docs/*_CONTRACT.md                       @esengine @SivanCola
-/docs/TOOL_APPROVAL_MODES.md              @esengine @SivanCola
-/docs/CAPABILITY_DIAGNOSTICS.md           @esengine @SivanCola
-/docs/CHECKPOINTS.md                      @esengine @SivanCola
-/docs/EXTENSION_*.md                      @esengine @SivanCola
-/docs/SUBAGENT_*.md                       @esengine @SivanCola
-/docs/ROADMAP.md                          @esengine @SivanCola
-/docs/MIGRATING.md                        @esengine @SivanCola
-/docs/design/                             @esengine @SivanCola
-/release-notes/                           @esengine @SivanCola
-
-# Release signing: provider policy, its contract and the workflow that uses it.
-/.signpath/                               @esengine @SivanCola
-/.github/workflows/release-studio.yml     @esengine @SivanCola
-/.github/workflows/studio-certum-signing-smoke.yml @esengine @SivanCola
-/.github/actions/setup-certum/            @esengine @SivanCola
-/cmd/signpath-contract/                   @esengine @SivanCola
-/scripts/install-smoke.ps1                @esengine @SivanCola
-/scripts/sign-certum.ps1                  @esengine @SivanCola
-/scripts/verify-windows-authenticode.ps1  @esengine @SivanCola
-/scripts/verify-windows-package.ps1       @esengine @SivanCola
-/scripts/windows-signing-lib.ps1          @esengine @SivanCola
@@ -0,0 +1,23 @@
+---
+name: Bug report
+about: Something is broken
+labels: bug
+---
+
+**What happened**
+A clear and concise description.
+
+**Expected**
+What you expected to happen.
+
+**Reproduction**
+Steps or minimal code that reproduces it.
+
+**Environment**
+- Reasonix version:
+- Node version:
+- OS:
+- DeepSeek model (e.g. `deepseek-chat`, `deepseek-reasoner`):
+
+**Logs / transcript**
+If using the CLI, attach the relevant chunk of `--transcript`.
@@ -1,62 +0,0 @@
-name: Bug report
-description: Report a bug in DeepSeek-Reasonix
-title: "[Bug]: "
-labels: ["bug"]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Thanks for filing a bug. Pick which version line you're on below — it gets
-        labeled automatically, no maintainer action needed. Not sure which line
-        you run? See the [version roadmap](https://github.com/esengine/DeepSeek-Reasonix/discussions/10748).
-  - type: dropdown
-    id: version-line
-    attributes:
-      label: Version line
-      description: Which line are you running?
-      options:
-        - "2.x — Reasonix Studio, studio branch (active development)"
-        - "1.x — main-v2 branch (maintenance / stable)"
-        - "0.x — legacy TypeScript (maintenance only)"
-    validations:
-      required: true
-  - type: input
-    id: version
-    attributes:
-      label: Exact version
-      description: Output of `reasonix --version`, or the version shown in Studio's settings.
-      placeholder: e.g. 2.20.0 or 1.39.0
-    validations:
-      required: true
-  - type: textarea
-    id: what-happened
-    attributes:
-      label: What happened?
-      description: A clear description of the bug, and what you expected instead.
-    validations:
-      required: true
-  - type: textarea
-    id: repro
-    attributes:
-      label: Steps to reproduce
-      placeholder: |
-        1. ...
-        2. ...
-        3. ...
-    validations:
-      required: true
-  - type: input
-    id: os
-    attributes:
-      label: OS / platform
-      placeholder: e.g. macOS 15.3 (arm64), Ubuntu 24.04, Windows 11
-    validations:
-      required: true
-  - type: textarea
-    id: logs
-    attributes:
-      label: Relevant logs or output
-      description: Paste any error output. Automatically formatted as code.
-      render: shell
-    validations:
-      required: false
@@ -1,14 +0,0 @@
-blank_issues_enabled: false
-contact_links:
-  - name: Version roadmap (1.x / 2.x)
-    url: https://github.com/esengine/DeepSeek-Reasonix/discussions/10748
-    about: Which line to use, which branch takes which changes, and where Reasonix is heading.
-  - name: Questions & discussions
-    url: https://github.com/esengine/DeepSeek-Reasonix/discussions
-    about: For usage questions, ideas, and general discussion — please use Discussions instead of opening an issue.
-  - name: Discord
-    url: https://discord.gg/XF78rEME2D
-    about: Bilingual community chat for setup help, workflow showcases, and feature ideas.
-  - name: QQ group (DeepSeek-Reasonix官方群, 1093562660)
-    url: https://qm.qq.com/q/i59b0z2R8s
-    about: Chinese-language community chat for setup help and everyday questions.
@@ -1,30 +0,0 @@
-name: Feature request
-description: Suggest an idea or improvement
-title: "[Feature]: "
-labels: ["enhancement"]
-body:
-  - type: dropdown
-    id: version-line
-    attributes:
-      label: Version line
-      description: Which line is this for?
-      options:
-        - "2.x — Reasonix Studio, studio branch (active development)"
-        - "1.x — main-v2 branch (maintenance / stable)"
-        - "0.x — legacy TypeScript (maintenance only)"
-    validations:
-      required: true
-  - type: textarea
-    id: problem
-    attributes:
-      label: What problem does this solve?
-      description: What are you trying to do, and what gets in the way today?
-    validations:
-      required: true
-  - type: textarea
-    id: proposal
-    attributes:
-      label: Proposed solution
-      description: How would you like it to work?
-    validations:
-      required: false
@@ -1,35 +0,0 @@
-name: Connect to Certum cloud signing
-description: Verify the pinned SimplySign installer and connect to the configured certificate.
-inputs:
-  username:
-    required: true
-    description: SimplySign account
-  otp-uri:
-    required: true
-    description: TOTP provisioning URI
-  thumbprint:
-    required: true
-    description: Expected SHA-1 certificate thumbprint
-runs:
-  using: composite
-  steps:
-    - name: Verify SimplySign installer
-      shell: pwsh
-      run: |
-        $ErrorActionPreference = 'Stop'
-        Invoke-WebRequest 'https://files.certum.eu/software/SimplySignDesktop/Windows/9.4.3.90/SimplySignDesktop-9.4.3.90-64-bit-en.msi' -OutFile SimplySignDesktop.msi
-        $hash = (Get-FileHash -Algorithm SHA256 SimplySignDesktop.msi).Hash
-        if ($hash -ne 'CE2B38EF0124A574BC08E5558726099CAAC79A7C58B8D3D712F629371FE1BCB7') {
-          throw "SimplySign installer SHA-256 $hash does not match the pinned 9.4.3.90 build"
-        }
-        $signature = Get-AuthenticodeSignature SimplySignDesktop.msi
-        if ($signature.Status -ne 'Valid' -or $signature.SignerCertificate.Subject -notmatch 'Asseco Data Systems') {
-          throw 'SimplySign installer signature or publisher verification failed'
-        }
-    - name: Authenticate cloud certificate
-      uses: dismine/windows-app-signing-setup-action@89ae3b032d4bc7a5b98d1a42a34e61ecb6faad64
-      with:
-        certum-username: ${{ inputs.username }}
-        certum-otp-uri: ${{ inputs.otp-uri }}
-        certum-key-id: ${{ inputs.thumbprint }}
-        capture-diagnostics: 'false'
@@ -1,108 +0,0 @@
-version: 2
-updates:
-  # 2.x (studio): the development line.
-  - package-ecosystem: "gomod"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    groups:
-      go:
-        patterns: ["*"]
-        update-types: ["minor", "patch"]
-
-  - package-ecosystem: "gomod"
-    directory: "/desktop"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    groups:
-      go:
-        patterns: ["*"]
-        update-types: ["minor", "patch"]
-
-  - package-ecosystem: "npm"
-    directory: "/desktop/frontend-next"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    groups:
-      npm:
-        patterns: ["*"]
-        update-types: ["minor", "patch"]
-
-  - package-ecosystem: "npm"
-    directory: "/desktop/electron"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    groups:
-      npm:
-        patterns: ["*"]
-        update-types: ["minor", "patch"]
-
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    groups:
-      actions:
-        patterns: ["*"]
-
-  # 1.x (main-v2): maintenance. Dependabot reads this file from the default
-  # branch only, so the 1.x line is named here; it takes patch updates alone.
-  - package-ecosystem: "gomod"
-    directory: "/"
-    target-branch: "main-v2"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 3
-    ignore:
-      - dependency-name: "*"
-        update-types: ["version-update:semver-major", "version-update:semver-minor"]
-    groups:
-      go-1x:
-        patterns: ["*"]
-        update-types: ["patch"]
-
-  - package-ecosystem: "gomod"
-    directory: "/desktop"
-    target-branch: "main-v2"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 3
-    ignore:
-      - dependency-name: "*"
-        update-types: ["version-update:semver-major", "version-update:semver-minor"]
-    groups:
-      go-1x:
-        patterns: ["*"]
-        update-types: ["patch"]
-
-  - package-ecosystem: "npm"
-    directory: "/desktop/frontend"
-    target-branch: "main-v2"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 3
-    ignore:
-      - dependency-name: "*"
-        update-types: ["version-update:semver-major", "version-update:semver-minor"]
-    groups:
-      npm-1x:
-        patterns: ["*"]
-        update-types: ["patch"]
-
-  - package-ecosystem: "npm"
-    directory: "/site"
-    target-branch: "main-v2"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 3
-    ignore:
-      - dependency-name: "*"
-        update-types: ["version-update:semver-major", "version-update:semver-minor"]
-    groups:
-      npm-1x:
-        patterns: ["*"]
-        update-types: ["patch"]
@@ -1,51 +0,0 @@
-# Area labels auto-applied to PRs by .github/workflows/pr-auto-label.yml
-# (actions/labeler), based on the changed file paths. Keep the area set in sync
-# with issue-auto-label.yml. severity/platform are issue-only — a PR is a change,
-# not a bug report — and v1/v2 are handled by pr-version-label.yml.
-
-agent:
-  - changed-files:
-      - any-glob-to-any-file:
-          - 'internal/runtime/agent/**'
-          - 'internal/session/control/**'
-
-mcp:
-  - changed-files:
-      - any-glob-to-any-file:
-          - 'internal/ext/plugin/**'
-          - 'internal/codegraph/**'
-
-config:
-  - changed-files:
-      - any-glob-to-any-file:
-          - 'internal/contract/config/**'
-          - 'internal/assembly/boot/**'
-
-provider:
-  - changed-files:
-      - any-glob-to-any-file:
-          - 'internal/contract/provider/**'
-
-skills:
-  - changed-files:
-      - any-glob-to-any-file:
-          - 'internal/ext/skill/**'
-          - 'internal/contract/tool/**'
-
-tui:
-  - changed-files:
-      - any-glob-to-any-file:
-          - 'internal/frontend/cli/**'
-
-desktop:
-  - changed-files:
-      - any-glob-to-any-file:
-          - 'desktop/**'
-
-updater:
-  - changed-files:
-      - any-glob-to-any-file:
-          - 'desktop/cmd/sign/**'
-          - 'desktop/updater*.go'
-          - 'scripts/desktop-build.sh'
-          - '.github/workflows/release*.yml'
@@ -1,7 +0,0 @@
-# Logins allowed to open pull requests, one per line, matched case-insensitively.
-# Repository owners, members and collaborators, and bots, are always allowed.
-lancy69
-chuiwenwei
-xxoingr
-kevin9327
-imcreazy
@@ -1,63 +0,0 @@
-<!--
-Target branch: 2.x features and fixes go to `studio`. 1.x takes bug fixes,
-provider/API compatibility, release/updater, security and platform stability
-only, on `main-v2`.
-
-Pull requests are limited to maintainers and invited contributors; one from
-anyone else is closed automatically. Open an issue instead.
-->
-
-## Summary
-
-
-
-## Cause
-
-
-
-## Blast radius
-
-
-
-## Neighbouring behaviours tested
-
-
-
-## Why this layer
-
-
-
-## UI changes
-
-<!--
-Delete this section if the PR touches nothing under `desktop/frontend-next/src`
-or the website pages.
-->
-
- Screenshots, before and after: light and dark, a wide window and a phone-width one (about 390 px). Attach them to this description.
- Entries moved, hidden or removed: none / list each one.
- Hiding or removing a visible control needs a linked issue and a release-notes line naming it. Do not retire UI with `display: none !important` or a feature flag.
- If a row of `docs/STUDIO_PARITY.md` changes, update it here.
-
-## Issues
-
-<!--
-If this resolves a report, put `Fixes #123` on its own line — GitHub only
-auto-closes from a bare line, so `- Fixes #123` in a list does nothing and the
-report stays open. If it only relates to one, use `Refs #123` instead: the
-release workflow then asks that reporter to verify once the fix ships.
-->
-
-## Verification
-
-
-
-For a GSAP to WAAPI/CSS migration (or any cross-API replacement), document
-the source-to-target contract here: easing syntax, time units, callbacks,
-cancellation, reduced-motion behavior, and failure fallback. Verification must
-assert that the target API was actually called; a mock that silently skips it
-does not count.
-
-## Disclosure
-
- [ ] AI assistance was used for this change (optional; for transparency only, it does not change how the change is reviewed)
@@ -1,19 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg id="_图层_2" data-name="图层 2" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 145.55 113.29">
-  <defs>
-    <style>
-      .cls-1 {
-        fill: #ffffff;
-        stroke: #ffffff;
-        stroke-miterlimit: 10;
-      }
-    </style>
-  </defs>
-  <g id="_图层_1-2" data-name="图层 1">
-    <g>
-      <path class="cls-1" d="M144.68,38.49l-.06-.23c-.88-3.28-2.5-5.94-4.58-8.06.14,5.65-2.96,11.02-6.22,16.66l-.39.68c-2.26,3.91-4.66,7.94-6.57,11.1l-.86,1.38c-3.36,5.44-6.27,10.14-12.18,14.18-8.34,5.87-18.2,5.81-26.92,5.76-2.81-.02-5.48-.03-7.95.14l-.35.02c-3.22.06-5.96,1.57-8.17,4.49l-.14.18c-.86,1.06-1.7,2.26-2.58,3.54-3.43,4.92-7.69,11.04-16.17,12.42-4.37.86-9.98.84-14.94.83h-1.95c-.52,0-1.06,0-1.61,0-6.95,0-16.08-.89-21.94-6.55-.15-.15-.3-.3-.44-.45.5,4.73,2.33,8.64,5.44,11.65,5.86,5.66,14.98,6.55,21.94,6.55.55,0,1.09,0,1.61-.01h1.93c4.96.02,10.58.04,14.96-.83,8.48-1.37,12.74-7.5,16.17-12.42.88-1.27,1.72-2.48,2.58-3.54l.14-.18c2.21-2.92,4.95-4.43,8.17-4.49l.35-.02c2.47-.17,5.13-.16,7.95-.14,8.72.05,18.58.11,26.91-5.76,5.92-4.03,8.82-8.73,12.19-14.17l.86-1.39c1.91-3.15,4.3-7.18,6.57-11.09l.39-.69c3.81-6.6,7.41-12.84,5.86-19.57ZM120.9,23.02c-.28,0-.56,0-.83,0-9.68-.19-24.03-.09-35.57-.01l-2.04.02c-.93.01-1.82.02-2.67.03-8.36.08-14.4.13-23.33,3.82l-.27.12c-10.76,4.68-16.91,12.16-22.83,21.95-5.53,8.76-12.62,20.57-16.32,26.79-.41.69-.77,1.3-1.09,1.84l-.49.84c-1.49,2.53-3.23,5.49-4.21,8.95,3.98,1.9,8.52,2.65,12.71,2.91.27-.77.64-1.56,1.07-2.38.48-.94,1.05-1.9,1.63-2.89l.49-.84c.96-1.62,2.38-3.99,4.05-6.78,3.82-6.36,8.98-14.88,13.19-21.55l.07-.11c5.02-8.31,9.2-13.45,16.91-16.81l.11-.05c6.57-2.7,10.54-2.74,18.43-2.81.87-.01,1.78-.02,2.69-.03l1.99-.02c9.17-.06,20.13-.14,29.01-.07,2.26.01,4.39.04,6.32.08h.12s.11,0,.11,0c1.25-.01,2.91.11,4.61.46,1.03.22,2.08.52,3.05.93.21-.35.41-.71.62-1.06l.39-.68c1.92-3.33,3.79-6.57,4.97-9.82-4.08-1.92-8.7-2.76-12.89-2.82Z"/>
-      <path class="cls-1" d="M115.07,11.81c-9.7-.19-24.07-.09-35.62-.01h-1.99c-.93.03-1.82.04-2.67.04-8.36.08-14.4.14-23.33,3.83l-.27.12c-10.76,4.67-16.91,12.16-22.83,21.95-6.13,9.71-14.19,23.21-17.41,28.63l-.5.84c-2.08,3.55-4.68,7.97-4.94,13.39v.2s0,.21,0,.21c.01.81.06,1.61.15,2.38.14.15.29.3.44.45,1.53,1.47,3.28,2.63,5.15,3.52,3.98,1.9,8.52,2.65,12.71,2.91,1.41.09,2.78.12,4.08.12.55,0,1.09-.01,1.61-.01h1.95c4.95.01,10.57.03,14.94-.83,8.48-1.38,12.74-7.5,16.17-12.42.88-1.28,1.72-2.48,2.58-3.54l.14-.18c2.21-2.92,4.95-4.44,8.17-4.49l.35-.02c2.47-.17,5.14-.16,7.95-.14,8.71.05,18.58.1,26.92-5.76,5.91-4.04,8.82-8.74,12.18-14.18l.86-1.39c1.74-2.86,3.87-6.45,5.95-10.03.21-.35.41-.71.62-1.06l.39-.68c1.92-3.33,3.79-6.57,4.97-9.82.82-2.26,1.31-4.53,1.25-6.84-5.18-5.29-13.22-7.25-19.97-7.19ZM122.56,40.37l-.39.67c-2.21,3.81-4.55,7.77-6.39,10.79l-.84,1.36c-3.01,4.87-4.83,7.81-8.48,10.29l-.1.07c-4.94,3.49-11.95,3.45-19.38,3.41-2.88-.02-5.87-.04-8.79.16-7.1.19-13.51,3.58-18.07,9.57-1.13,1.4-2.12,2.83-3.08,4.21-2.92,4.18-4.71,6.57-7.64,7.02l-.31.06c-3.09.63-8.28.61-12.45.6h-2.16c-3.85.07-7.01-.16-9.45-.69-2.24-.48-3.87-1.22-4.89-2.2-.66-.64-1.54-1.81-1.63-4.65.11-1.35.71-2.82,1.52-4.35.48-.94,1.05-1.9,1.63-2.89l.49-.84c3.17-5.33,11.19-18.75,17.24-28.33l.07-.11c5.02-8.32,9.2-13.45,16.92-16.81l.1-.05c6.57-2.7,10.54-2.74,18.43-2.82.87,0,1.78,0,2.69-.03h1.94c11.52-.09,25.86-.19,35.38,0h.23c1.25-.01,2.92.11,4.61.46,3.15.66,6.4,2.12,7.27,5.02.2,1.2-.89,3.62-2.27,6.18-.7,1.31-1.48,2.65-2.2,3.9ZM120.07,23.01c-9.68-.19-24.03-.09-35.57-.01l-2.04.02c-.93.01-1.82.02-2.67.03-8.36.08-14.4.13-23.33,3.82l-.27.12c-10.76,4.68-16.91,12.16-22.83,21.95-5.53,8.76-12.62,20.57-16.32,26.79-.78-.35-1.41-.77-1.9-1.24-.66-.64-1.54-1.81-1.63-4.65.18-2.18,1.62-4.64,3.15-7.25l.49-.83c3.17-5.32,11.18-18.73,17.24-28.33l.07-.12c5.02-8.31,9.2-13.45,16.92-16.81l.1-.04c6.57-2.7,10.54-2.74,18.43-2.82.87-.01,1.78-.01,2.69-.03h1.99c11.5-.09,25.82-.19,35.33,0h.23c3.57-.04,10.55,1.02,11.88,5.48.14.84-.35,2.27-1.13,3.93-.28,0-.56,0-.83,0Z"/>
-      <path class="cls-1" d="M134.68,16.09l-.06-.23c-3.07-11.45-15.08-15.33-24.55-15.25-9.68-.19-24.03-.09-35.57-.01h-2.04c-.93.03-1.82.04-2.67.04-8.36.08-14.4.14-23.33,3.83l-.27.12c-10.76,4.67-16.91,12.16-22.83,21.95-6.14,9.73-14.2,23.22-17.41,28.62l-.49.85c-2.09,3.55-4.69,7.96-4.95,13.39v.2s0,.21,0,.21c.09,5.57,1.82,10.13,5.15,13.58.14.15.29.3.44.45,1.53,1.47,3.28,2.63,5.15,3.52,3.98,1.9,8.52,2.65,12.71,2.91,1.41.09,2.78.12,4.08.12.55,0,1.09-.01,1.61-.01h1.95c4.95.01,10.57.03,14.94-.83,8.48-1.38,12.74-7.5,16.17-12.42.88-1.28,1.72-2.48,2.58-3.54l.14-.18c2.21-2.92,4.95-4.44,8.17-4.49l.35-.02c2.47-.17,5.14-.16,7.95-.14,8.71.05,18.58.1,26.92-5.76,5.91-4.04,8.82-8.74,12.18-14.18l.86-1.39c1.74-2.86,3.87-6.45,5.95-10.03.21-.35.41-.71.62-1.06l.39-.68c1.92-3.33,3.79-6.57,4.97-9.82.82-2.26,1.31-4.53,1.25-6.84-.02-.96-.14-1.93-.36-2.91ZM119.76,25.27c-.7,1.31-1.48,2.65-2.2,3.9l-.39.67c-1.19,2.04-2.41,4.13-3.57,6.09-1.01,1.7-1.97,3.31-2.82,4.7l-.84,1.36c-3.01,4.87-4.83,7.81-8.48,10.29l-.1.07c-4.94,3.49-11.96,3.45-19.38,3.41-2.89-.02-5.87-.04-8.79.16-7.1.18-13.51,3.58-18.07,9.57-1.13,1.4-2.12,2.83-3.08,4.21-2.92,4.18-4.71,6.57-7.64,7.02l-.31.06c-3.09.63-8.27.61-12.45.6h-2.16c-3.85.07-7.01-.16-9.45-.69-1.16-.25-2.16-.57-2.99-.96-.78-.35-1.41-.77-1.9-1.24-.66-.64-1.54-1.81-1.63-4.65.18-2.18,1.62-4.64,3.15-7.25l.49-.83c3.17-5.32,11.18-18.73,17.24-28.33l.07-.12c5.02-8.31,9.2-13.45,16.92-16.81l.1-.04c6.57-2.7,10.54-2.74,18.43-2.82.87-.01,1.78-.01,2.69-.03h1.99c11.5-.09,25.82-.19,35.33,0h.23c3.57-.04,10.55,1.02,11.88,5.48.14.84-.35,2.27-1.13,3.93-.34.72-.73,1.48-1.14,2.25Z"/>
-    </g>
-  </g>
-</svg>
@@ -1,19 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg id="_图层_2" data-name="图层 2" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 145.55 113.29">
-  <defs>
-    <style>
-      .cls-1 {
-        fill: #111111;
-        stroke: #111111;
-        stroke-miterlimit: 10;
-      }
-    </style>
-  </defs>
-  <g id="_图层_1-2" data-name="图层 1">
-    <g>
-      <path class="cls-1" d="M144.68,38.49l-.06-.23c-.88-3.28-2.5-5.94-4.58-8.06.14,5.65-2.96,11.02-6.22,16.66l-.39.68c-2.26,3.91-4.66,7.94-6.57,11.1l-.86,1.38c-3.36,5.44-6.27,10.14-12.18,14.18-8.34,5.87-18.2,5.81-26.92,5.76-2.81-.02-5.48-.03-7.95.14l-.35.02c-3.22.06-5.96,1.57-8.17,4.49l-.14.18c-.86,1.06-1.7,2.26-2.58,3.54-3.43,4.92-7.69,11.04-16.17,12.42-4.37.86-9.98.84-14.94.83h-1.95c-.52,0-1.06,0-1.61,0-6.95,0-16.08-.89-21.94-6.55-.15-.15-.3-.3-.44-.45.5,4.73,2.33,8.64,5.44,11.65,5.86,5.66,14.98,6.55,21.94,6.55.55,0,1.09,0,1.61-.01h1.93c4.96.02,10.58.04,14.96-.83,8.48-1.37,12.74-7.5,16.17-12.42.88-1.27,1.72-2.48,2.58-3.54l.14-.18c2.21-2.92,4.95-4.43,8.17-4.49l.35-.02c2.47-.17,5.13-.16,7.95-.14,8.72.05,18.58.11,26.91-5.76,5.92-4.03,8.82-8.73,12.19-14.17l.86-1.39c1.91-3.15,4.3-7.18,6.57-11.09l.39-.69c3.81-6.6,7.41-12.84,5.86-19.57ZM120.9,23.02c-.28,0-.56,0-.83,0-9.68-.19-24.03-.09-35.57-.01l-2.04.02c-.93.01-1.82.02-2.67.03-8.36.08-14.4.13-23.33,3.82l-.27.12c-10.76,4.68-16.91,12.16-22.83,21.95-5.53,8.76-12.62,20.57-16.32,26.79-.41.69-.77,1.3-1.09,1.84l-.49.84c-1.49,2.53-3.23,5.49-4.21,8.95,3.98,1.9,8.52,2.65,12.71,2.91.27-.77.64-1.56,1.07-2.38.48-.94,1.05-1.9,1.63-2.89l.49-.84c.96-1.62,2.38-3.99,4.05-6.78,3.82-6.36,8.98-14.88,13.19-21.55l.07-.11c5.02-8.31,9.2-13.45,16.91-16.81l.11-.05c6.57-2.7,10.54-2.74,18.43-2.81.87-.01,1.78-.02,2.69-.03l1.99-.02c9.17-.06,20.13-.14,29.01-.07,2.26.01,4.39.04,6.32.08h.12s.11,0,.11,0c1.25-.01,2.91.11,4.61.46,1.03.22,2.08.52,3.05.93.21-.35.41-.71.62-1.06l.39-.68c1.92-3.33,3.79-6.57,4.97-9.82-4.08-1.92-8.7-2.76-12.89-2.82Z"/>
-      <path class="cls-1" d="M115.07,11.81c-9.7-.19-24.07-.09-35.62-.01h-1.99c-.93.03-1.82.04-2.67.04-8.36.08-14.4.14-23.33,3.83l-.27.12c-10.76,4.67-16.91,12.16-22.83,21.95-6.13,9.71-14.19,23.21-17.41,28.63l-.5.84c-2.08,3.55-4.68,7.97-4.94,13.39v.2s0,.21,0,.21c.01.81.06,1.61.15,2.38.14.15.29.3.44.45,1.53,1.47,3.28,2.63,5.15,3.52,3.98,1.9,8.52,2.65,12.71,2.91,1.41.09,2.78.12,4.08.12.55,0,1.09-.01,1.61-.01h1.95c4.95.01,10.57.03,14.94-.83,8.48-1.38,12.74-7.5,16.17-12.42.88-1.28,1.72-2.48,2.58-3.54l.14-.18c2.21-2.92,4.95-4.44,8.17-4.49l.35-.02c2.47-.17,5.14-.16,7.95-.14,8.71.05,18.58.1,26.92-5.76,5.91-4.04,8.82-8.74,12.18-14.18l.86-1.39c1.74-2.86,3.87-6.45,5.95-10.03.21-.35.41-.71.62-1.06l.39-.68c1.92-3.33,3.79-6.57,4.97-9.82.82-2.26,1.31-4.53,1.25-6.84-5.18-5.29-13.22-7.25-19.97-7.19ZM122.56,40.37l-.39.67c-2.21,3.81-4.55,7.77-6.39,10.79l-.84,1.36c-3.01,4.87-4.83,7.81-8.48,10.29l-.1.07c-4.94,3.49-11.95,3.45-19.38,3.41-2.88-.02-5.87-.04-8.79.16-7.1.19-13.51,3.58-18.07,9.57-1.13,1.4-2.12,2.83-3.08,4.21-2.92,4.18-4.71,6.57-7.64,7.02l-.31.06c-3.09.63-8.28.61-12.45.6h-2.16c-3.85.07-7.01-.16-9.45-.69-2.24-.48-3.87-1.22-4.89-2.2-.66-.64-1.54-1.81-1.63-4.65.11-1.35.71-2.82,1.52-4.35.48-.94,1.05-1.9,1.63-2.89l.49-.84c3.17-5.33,11.19-18.75,17.24-28.33l.07-.11c5.02-8.32,9.2-13.45,16.92-16.81l.1-.05c6.57-2.7,10.54-2.74,18.43-2.82.87,0,1.78,0,2.69-.03h1.94c11.52-.09,25.86-.19,35.38,0h.23c1.25-.01,2.92.11,4.61.46,3.15.66,6.4,2.12,7.27,5.02.2,1.2-.89,3.62-2.27,6.18-.7,1.31-1.48,2.65-2.2,3.9ZM120.07,23.01c-9.68-.19-24.03-.09-35.57-.01l-2.04.02c-.93.01-1.82.02-2.67.03-8.36.08-14.4.13-23.33,3.82l-.27.12c-10.76,4.68-16.91,12.16-22.83,21.95-5.53,8.76-12.62,20.57-16.32,26.79-.78-.35-1.41-.77-1.9-1.24-.66-.64-1.54-1.81-1.63-4.65.18-2.18,1.62-4.64,3.15-7.25l.49-.83c3.17-5.32,11.18-18.73,17.24-28.33l.07-.12c5.02-8.31,9.2-13.45,16.92-16.81l.1-.04c6.57-2.7,10.54-2.74,18.43-2.82.87-.01,1.78-.01,2.69-.03h1.99c11.5-.09,25.82-.19,35.33,0h.23c3.57-.04,10.55,1.02,11.88,5.48.14.84-.35,2.27-1.13,3.93-.28,0-.56,0-.83,0Z"/>
-      <path class="cls-1" d="M134.68,16.09l-.06-.23c-3.07-11.45-15.08-15.33-24.55-15.25-9.68-.19-24.03-.09-35.57-.01h-2.04c-.93.03-1.82.04-2.67.04-8.36.08-14.4.14-23.33,3.83l-.27.12c-10.76,4.67-16.91,12.16-22.83,21.95-6.14,9.73-14.2,23.22-17.41,28.62l-.49.85c-2.09,3.55-4.69,7.96-4.95,13.39v.2s0,.21,0,.21c.09,5.57,1.82,10.13,5.15,13.58.14.15.29.3.44.45,1.53,1.47,3.28,2.63,5.15,3.52,3.98,1.9,8.52,2.65,12.71,2.91,1.41.09,2.78.12,4.08.12.55,0,1.09-.01,1.61-.01h1.95c4.95.01,10.57.03,14.94-.83,8.48-1.38,12.74-7.5,16.17-12.42.88-1.28,1.72-2.48,2.58-3.54l.14-.18c2.21-2.92,4.95-4.44,8.17-4.49l.35-.02c2.47-.17,5.14-.16,7.95-.14,8.71.05,18.58.1,26.92-5.76,5.91-4.04,8.82-8.74,12.18-14.18l.86-1.39c1.74-2.86,3.87-6.45,5.95-10.03.21-.35.41-.71.62-1.06l.39-.68c1.92-3.33,3.79-6.57,4.97-9.82.82-2.26,1.31-4.53,1.25-6.84-.02-.96-.14-1.93-.36-2.91ZM119.76,25.27c-.7,1.31-1.48,2.65-2.2,3.9l-.39.67c-1.19,2.04-2.41,4.13-3.57,6.09-1.01,1.7-1.97,3.31-2.82,4.7l-.84,1.36c-3.01,4.87-4.83,7.81-8.48,10.29l-.1.07c-4.94,3.49-11.96,3.45-19.38,3.41-2.89-.02-5.87-.04-8.79.16-7.1.18-13.51,3.58-18.07,9.57-1.13,1.4-2.12,2.83-3.08,4.21-2.92,4.18-4.71,6.57-7.64,7.02l-.31.06c-3.09.63-8.27.61-12.45.6h-2.16c-3.85.07-7.01-.16-9.45-.69-1.16-.25-2.16-.57-2.99-.96-.78-.35-1.41-.77-1.9-1.24-.66-.64-1.54-1.81-1.63-4.65.18-2.18,1.62-4.64,3.15-7.25l.49-.83c3.17-5.32,11.18-18.73,17.24-28.33l.07-.12c5.02-8.31,9.2-13.45,16.92-16.81l.1-.04c6.57-2.7,10.54-2.74,18.43-2.82.87-.01,1.78-.01,2.69-.03h1.99c11.5-.09,25.82-.19,35.33,0h.23c3.57-.04,10.55,1.02,11.88,5.48.14.84-.35,2.27-1.13,3.93-.34.72-.73,1.48-1.14,2.25Z"/>
-    </g>
-  </g>
-</svg>
@@ -1,37 +0,0 @@
-name: acp-conformance
-
-# The agent is driven over stdio by the official ACP TypeScript SDK, and every
-# message it writes is held to the schema that SDK ships. Not a required check:
-# it runs when the ACP frontend or the harness changes, and on request.
-on:
-  pull_request:
-    branches: [main-v2, studio]
-    paths:
-      - "internal/frontend/acp/**"
-      - "tools/acp-conformance/**"
-      - ".github/workflows/acp-conformance.yml"
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: acp-conformance-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  conformance:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        with:
-          go-version-file: go.mod
-          cache: true
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
-        with:
-          node-version: "22"
-      - run: make acp-conformance
@@ -1,293 +0,0 @@
-name: Android
-
-# The Android shell under `android/` ships from the same tag the desktop line
-# publishes, and lands on the same release page.
-#
-# It is a separate workflow rather than a job inside release-studio.yml for two
-# reasons. The toolchains share nothing — Go, the Android SDK, a Gradle wrapper —
-# so a runner carrying both would install three toolchains to build one artifact.
-# And `signing-contract` pins which workflows may reach the SignPath credentials;
-# this one never touches them, and keeping it out of that graph is what keeps the
-# fingerprint stable.
-#
-# A failure here does not hold back the desktop release: the two are independent
-# by construction, and an APK is worth less than the desktop builds it sits
-# beside.
-on:
-  push:
-    tags: ['studio-v*']
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: "Existing studio tag to build for and attach to (for example studio-v2.51.0)"
-        required: false
-        type: string
-      ref:
-        description: "A branch to build as a trial run of this workflow; nothing is attached to any release"
-        required: false
-        type: string
-
-permissions:
-  contents: write # upload the APK to the release the tag belongs to
-
-concurrency:
-  group: android-${{ inputs.tag || inputs.ref || github.ref_name }}
-  cancel-in-progress: false
-
-jobs:
-  resolve:
-    name: resolve the tag
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    outputs:
-      tag: ${{ steps.release.outputs.tag }}
-      version: ${{ steps.release.outputs.version }}
-      sha: ${{ steps.release.outputs.sha }}
-      candidate: ${{ steps.release.outputs.candidate }}
-      publish: ${{ steps.release.outputs.publish }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      # The same tag grammar release-studio.yml enforces, spelled the same way:
-      # two workflows that disagree about which tags name a release would publish
-      # one artifact for a tag the other refused.
-      - name: Resolve tag and version
-        id: release
-        env:
-          IN_TAG: ${{ inputs.tag }}
-          IN_REF: ${{ inputs.ref }}
-          REF_NAME: ${{ github.ref_name }}
-        run: |
-          # A trial run builds a branch as a throwaway version and publishes nothing.
-          if [ -n "$IN_REF" ] && [ -z "$IN_TAG" ]; then
-            sha="$(git rev-parse --verify "origin/$IN_REF^{commit}")"
-            { echo "tag="; echo "version=v0.0.0-dev.${sha:0:7}"; echo "sha=$sha"
-              echo "candidate=false"; echo "publish=false"; } >> "$GITHUB_OUTPUT"
-            echo "trial build of $IN_REF at $sha"
-            exit 0
-          fi
-          tag="${IN_TAG:-$REF_NAME}"
-          semver='^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-([0-9A-Za-z-]+)(\.[0-9A-Za-z-]+)*)?$'
-          if [[ ! "$tag" =~ ^studio-v(.+)$ ]] || [[ ! "${BASH_REMATCH[1]}" =~ $semver ]]; then
-            echo "::error::studio release tag must be studio-vMAJOR.MINOR.PATCH[-PRERELEASE], got: $tag"
-            exit 1
-          fi
-          sha="$(git rev-parse --verify "refs/tags/$tag^{commit}")"
-          if ! git merge-base --is-ancestor "$sha" origin/studio; then
-            echo "::error::$tag is not on studio history"
-            exit 1
-          fi
-          version="${tag#studio-}"
-          candidate=false
-          if [[ "${version#v}" =~ $semver ]] && [ -n "${BASH_REMATCH[4]}" ]; then
-            candidate=true
-          fi
-          { echo "tag=$tag"; echo "version=$version"; echo "sha=$sha"
-            echo "candidate=$candidate"; echo "publish=true"; } >> "$GITHUB_OUTPUT"
-          echo "resolved $tag -> $version at $sha (candidate=$candidate)"
-
-  build:
-    name: build the APK
-    needs: resolve
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    # `publish` decides whether to attach anything, and the only honest answer to
-    # "will this APK install" is whether a key was restored.
-    outputs:
-      signed: ${{ steps.key.outputs.signed }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ needs.resolve.outputs.sha }}
-          fetch-depth: 0
-          persist-credentials: false
-
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        with:
-          go-version-file: go.mod
-          cache: true
-          cache-dependency-path: go.sum
-
-      # pnpm first: setup-node's pnpm cache needs the executable to exist.
-      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v4
-        with:
-          version: 10
-
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
-        with:
-          node-version: "24"
-          cache: pnpm
-          cache-dependency-path: desktop/frontend-next/pnpm-lock.yaml
-
-      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
-        with:
-          distribution: temurin
-          java-version: "21"
-          cache: gradle
-
-      # The SDK is the one thing nothing sets for you, per android/README.md. The
-      # runner image carries one; this asserts the two pieces the build names
-      # rather than re-installing them, so a missing package fails here by name
-      # instead of surfacing later as an unresolved compileSdk.
-      - name: Provide the Android SDK
-        run: |
-          if [ -z "${ANDROID_HOME:-}" ]; then
-            echo "::error::ANDROID_HOME is unset; the runner image is expected to provide the Android SDK"
-            exit 1
-          fi
-          for piece in "platforms/android-35" "build-tools/35.0.0"; do
-            if [ ! -d "$ANDROID_HOME/$piece" ]; then
-              echo "::error::the Android SDK at $ANDROID_HOME has no $piece; android/README.md names it as a requirement"
-              exit 1
-            fi
-          done
-          echo "ANDROID_SDK_ROOT=$ANDROID_HOME" >> "$GITHUB_ENV"
-
-      # A key that exists signs; a key that does not leaves the artifact
-      # unsigned, which is what a release with no key has always produced. The
-      # decision is the repository's, not this workflow's: it reads the four
-      # secrets android/README.md already names.
-      - name: Restore the signing key
-        id: key
-        env:
-          KEYSTORE_BASE64: ${{ secrets.REASONIX_KEYSTORE_BASE64 }}
-          STORE_PASSWORD: ${{ secrets.REASONIX_KEYSTORE_PASSWORD }}
-          KEY_PASSWORD: ${{ secrets.REASONIX_KEY_PASSWORD }}
-          KEY_ALIAS: ${{ secrets.REASONIX_KEY_ALIAS }}
-        run: |
-          if [ -z "$KEYSTORE_BASE64" ] || [ -z "$STORE_PASSWORD" ] || [ -z "$KEY_ALIAS" ]; then
-            echo "signed=false" >> "$GITHUB_OUTPUT"
-            echo "no signing key configured: the APK will be unsigned"
-            exit 0
-          fi
-          mkdir -p android/keystore
-          printf '%s' "$KEYSTORE_BASE64" | base64 --decode > android/keystore/release.jks
-          {
-            echo "storeFile=keystore/release.jks"
-            echo "storePassword=${STORE_PASSWORD}"
-            echo "keyAlias=${KEY_ALIAS}"
-            # PKCS#12 keystores use one password for both; only write the second
-            # when it is genuinely a different fact.
-            [ -n "$KEY_PASSWORD" ] && echo "keyPassword=${KEY_PASSWORD}"
-          } > android/keystore/keystore.properties
-          chmod 600 android/keystore/*
-          echo "signed=true" >> "$GITHUB_OUTPUT"
-          echo "signing key restored"
-
-      - name: Build the kernel and the page
-        working-directory: android
-        env:
-          VERSION: ${{ needs.resolve.outputs.version }}
-        run: |
-          export REASONIX_APP_VERSION="${VERSION#v}"
-          bash ./scripts/build-kernel.sh
-          bash ./scripts/sync-page.sh
-
-      # The one end-to-end check that needs no phone: the kernel the shell starts,
-      # serving the page the APK carries. Running it here means an APK that would
-      # open blank fails the build instead of the install.
-      - name: Verify the packaged page
-        working-directory: android
-        run: |
-          (cd .. && go build -o reasonix-verify ./cmd/reasonix)
-          KERNEL_BIN="$PWD/../reasonix-verify" bash ./scripts/verify-page.sh
-
-      - name: Assemble
-        working-directory: android
-        env:
-          VERSION: ${{ needs.resolve.outputs.version }}
-        run: |
-          # The version comes from the tag, so the About screen and the update
-          # check name this release. versionCode keeps its existing shape, which
-          # is why the build digit stays 1: it is a single decimal place, and a
-          # number that grows past it would collide with the next patch.
-          ./gradlew assembleRelease --no-daemon "-PreasonixVersion=${VERSION#v}"
-
-      - name: Name the artifact
-        id: apk
-        working-directory: android/app/build/outputs/apk/release
-        run: |
-          src="$(ls ./*.apk | head -n 1)"
-          if [ -z "$src" ]; then
-            echo "::error::assembleRelease produced no APK"
-            exit 1
-          fi
-          case "$src" in
-            *-unsigned.apk) name="ReasonixMobile-${{ needs.resolve.outputs.version }}-unsigned.apk" ;;
-            *)              name="ReasonixMobile-${{ needs.resolve.outputs.version }}.apk" ;;
-          esac
-          mv "$src" "$name"
-          sha256sum "$name" > "$name.sha256"
-          {
-            echo "path=$PWD/$name"
-            echo "name=$name"
-          } >> "$GITHUB_OUTPUT"
-          ls -l "$name" "$name.sha256"
-
-      # An unsigned package is not a lesser APK, it is an unusable one: Android's
-      # package manager rejects it outright rather than reporting a signature
-      # mismatch. Say so where the run summary can be read, instead of letting a
-      # green build imply a shippable artifact.
-      - name: Say what an unsigned build means
-        if: steps.key.outputs.signed != 'true'
-        run: |
-          echo "::warning::no signing key configured, so this APK is unsigned. Android refuses to install an unsigned package, so the release will carry no APK; the file stays a workflow artifact for whoever signs it."
-          {
-            echo "### No APK on this release"
-            echo ""
-            echo "The build produced an unsigned APK, which Android refuses to install."
-            echo "It is attached to this run as a workflow artifact only. Add the four"
-            echo "signing secrets to publish one."
-          } >> "$GITHUB_STEP_SUMMARY"
-
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v8
-        with:
-          name: android-apk
-          path: |
-            android/app/build/outputs/apk/release/*.apk
-            android/app/build/outputs/apk/release/*.sha256
-          if-no-files-found: error
-
-  publish:
-    name: attach the APK
-    needs: [resolve, build]
-    # Nothing to attach unless the build was signed. Skipping is the honest
-    # outcome: a release page with an APK nobody can install is worse than a
-    # release page without one.
-    if: needs.build.outputs.signed == 'true' && needs.resolve.outputs.publish == 'true'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
-        with:
-          name: android-apk
-          path: dist
-
-      # The release itself belongs to release-studio.yml, which creates it and
-      # owns its notes. This waits for it rather than creating a second one: two
-      # jobs racing to define a release is how a page ends up with the wrong body.
-      - name: Attach to the release
-        env:
-          GH_TOKEN: ${{ github.token }}
-          TAG: ${{ needs.resolve.outputs.tag }}
-          REPO: ${{ github.repository }}
-        run: |
-          # 90 minutes: on the last Studio release the page appeared about 40
-          # minutes after the tag run started, and the APK build spends part of
-          # that before this wait begins.
-          for _ in $(seq 1 360); do
-            if gh release view "$TAG" --repo "$REPO" >/dev/null 2>&1; then
-              gh release upload "$TAG" dist/*.apk dist/*.sha256 --repo "$REPO" --clobber
-              echo "attached to $TAG"
-              exit 0
-            fi
-            sleep 15
-          done
-          echo "::error::release $TAG did not appear within 90 minutes; the APK was built but not published"
-          exit 1
@@ -1,35 +0,0 @@
-name: Close linked issues
-
-# GitHub closes an issue named by "Fixes #N" only when the pull request merges
-# into the default branch. This does the same for the 1.x line. It reads the
-# merged pull request's description and never checks out its code.
-on:
-  pull_request_target:
-    types: [closed]
-    branches: [main-v2]
-
-permissions:
-  issues: write
-
-jobs:
-  close:
-    if: github.event.pull_request.merged == true
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
-        with:
-          script: |
-            const pr = context.payload.pull_request;
-            const { owner, repo } = context.repo;
-            // GitHub's own closing-keyword grammar, applied to this repository's issues only.
-            const keyword = /\b(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s*:?\s+#(\d+)\b/gi;
-            const numbers = [...new Set([...(pr.body ?? '').matchAll(keyword)].map((m) => Number(m[1])))];
-            const sha = (pr.merge_commit_sha ?? '').slice(0, 9);
-            for (const issue_number of numbers) {
-              const { data } = await github.rest.issues.get({ owner, repo, issue_number });
-              if (data.pull_request || data.state !== 'open') continue;
-              await github.rest.issues.createComment({ owner, repo, issue_number,
-                body: `Fixed on the 1.x line by #${pr.number} (${sha}). It ships in the next 1.x release.` });
-              await github.rest.issues.update({ owner, repo, issue_number, state: 'closed', state_reason: 'completed' });
-              core.info(`closed #${issue_number}`);
-            }
@@ -1,63 +0,0 @@
-name: CodeQL
-
-on:
-  # Docs/release-notes/root-Markdown changes carry no analyzable code; the
-  # weekly cron keeps the full scan cadence regardless.
-  push:
-    branches: ["main-v2", "studio"]
-    paths-ignore:
-      - 'docs/**'
-      - 'release-notes/**'
-      - '*.md'
-  pull_request:
-    branches: ["main-v2", "studio"]
-    paths-ignore:
-      - 'docs/**'
-      - 'release-notes/**'
-      - '*.md'
-  # A schedule runs only from the default branch, so the weekly scan checks out
-  # both lines itself: 1.x is in maintenance, and security is part of it.
-  schedule:
-    - cron: "27 3 * * 1"
-
-jobs:
-  analyze:
-    name: Analyze (${{ matrix.language }}${{ matrix.branch && format(', {0}', matrix.branch) || '' }})
-    runs-on: ubuntu-latest
-    permissions:
-      security-events: write
-      packages: read
-      actions: read
-      contents: read
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [go, javascript-typescript, actions]
-        # Empty means "the ref this event is about"; a scheduled run names each line.
-        branch: ${{ fromJSON(github.event_name == 'schedule' && '["main-v2", "studio"]' || '[""]') }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ matrix.branch }}
-      - id: head
-        if: matrix.branch != ''
-        run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
-        with:
-          languages: ${{ matrix.language }}
-          build-mode: ${{ matrix.language == 'go' && 'autobuild' || 'none' }}
-      - name: Perform CodeQL Analysis
-        if: matrix.branch == ''
-        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
-        with:
-          category: "/language:${{ matrix.language }}"
-      # Results from a checked-out line are filed under that line's ref, not the
-      # default branch the schedule happened to run from.
-      - name: Perform CodeQL Analysis (${{ matrix.branch }})
-        if: matrix.branch != ''
-        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
-        with:
-          category: "/language:${{ matrix.language }}"
-          ref: refs/heads/${{ matrix.branch }}
-          sha: ${{ steps.head.outputs.sha }}
@@ -1,51 +0,0 @@
-name: Deploy accounts worker
-
-on:
-  push:
-    branches: [main-v2]
-    paths:
-      - 'workers/accounts/**'
-      - '.github/workflows/deploy-accounts-worker.yml'
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: deploy-accounts-worker
-  cancel-in-progress: false
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
-        with:
-          version: 10
-          run_install: false
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
-        with:
-          node-version: "24"
-          cache: pnpm
-          cache-dependency-path: workers/accounts/pnpm-lock.yaml
-      - name: Deploy
-        working-directory: workers/accounts
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-        run: |
-          pnpm install --frozen-lockfile
-          pnpm test
-          pnpm typecheck
-          npx wrangler deploy
-      - name: Sync RESEND_API_KEY to the worker
-        working-directory: workers/accounts
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          RESEND_API_KEY: ${{ secrets.RESEND_API_KEY }}
-        run: |
-          if [ -n "$RESEND_API_KEY" ]; then
-            printf '%s' "$RESEND_API_KEY" | npx wrangler secret put RESEND_API_KEY
-          else
-            echo "RESEND_API_KEY not set in repo secrets; skipping (worker stays in stub email mode)."
-          fi
@@ -1,60 +0,0 @@
-name: Deploy crash worker
-
-on:
-  push:
-    branches: [main-v2]
-    paths:
-      - 'workers/crash-report/**'
-      - '.github/workflows/deploy-crash-worker.yml'
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: deploy-crash-worker
-  cancel-in-progress: false
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
-        with:
-          node-version: '22'
-          cache: npm
-          cache-dependency-path: workers/crash-report/package-lock.json
-      - name: Validate
-        working-directory: workers/crash-report
-        run: |
-          npm ci
-          npm run typecheck
-          npm test
-      - name: Apply and verify diagnostics v2 D1 migration
-        working-directory: workers/crash-report
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-        run: npm run migrate:diagnostics-v2
-      - name: Deploy
-        working-directory: workers/crash-report
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-        run: |
-          npx wrangler deploy
-      # Mirrors the ALERT_WEBHOOK repo secret into the worker so the ingest
-      # sentinel can push alerts (see runIngestSentinel). Managed here so
-      # nobody needs local Cloudflare credentials; when the repo secret is
-      # unset the sentinel stays log-only.
-      - name: Sync alert webhook secret
-        working-directory: workers/crash-report
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          ALERT_WEBHOOK: ${{ secrets.ALERT_WEBHOOK }}
-        run: |
-          if [ -z "$ALERT_WEBHOOK" ]; then
-            echo "ALERT_WEBHOOK repo secret not set; removing any existing worker secret."
-            printf '{"ALERT_WEBHOOK":null}' | npx wrangler secret bulk
-            exit 0
-          fi
-          printf '%s' "$ALERT_WEBHOOK" | npx wrangler secret put ALERT_WEBHOOK
@@ -1,40 +0,0 @@
-name: Deploy forum worker
-
-on:
-  push:
-    branches: [main-v2]
-    paths:
-      - 'workers/forum/**'
-      - '.github/workflows/deploy-forum-worker.yml'
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: deploy-forum-worker
-  cancel-in-progress: false
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
-        with:
-          version: 10
-          run_install: false
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
-        with:
-          node-version: "24"
-          cache: pnpm
-          cache-dependency-path: workers/forum/pnpm-lock.yaml
-      - name: Deploy
-        working-directory: workers/forum
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-        run: |
-          pnpm install --frozen-lockfile
-          pnpm test
-          pnpm typecheck
-          npx wrangler deploy
@@ -1,44 +0,0 @@
-name: Deploy ops events relay
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: deploy-ops-events
-  cancel-in-progress: false
-
-jobs:
-  deploy:
-    if: github.ref == 'refs/heads/platform'
-    runs-on: ubuntu-latest
-    environment: production
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
-        with:
-          node-version: '22'
-          cache: npm
-          cache-dependency-path: workers/ops-events/package-lock.json
-      - name: Validate
-        working-directory: workers/ops-events
-        run: |
-          npm ci
-          npm run typecheck
-          npm test
-      - name: Deploy
-        working-directory: workers/ops-events
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-        run: npx wrangler deploy
-      - name: Sync secrets
-        working-directory: workers/ops-events
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          GITHUB_WEBHOOK_SECRET: ${{ secrets.OPS_GITHUB_WEBHOOK_SECRET }}
-          OPS_LISTEN_TOKEN: ${{ secrets.OPS_LISTEN_TOKEN }}
-          OPS_EMIT_TOKEN: ${{ secrets.OPS_EMIT_TOKEN }}
-        run: |
-          node -e 'process.stdout.write(JSON.stringify({GITHUB_WEBHOOK_SECRET:process.env.GITHUB_WEBHOOK_SECRET||null,OPS_LISTEN_TOKEN:process.env.OPS_LISTEN_TOKEN||null,OPS_EMIT_TOKEN:process.env.OPS_EMIT_TOKEN||null}))' | npx wrangler secret bulk
@@ -1,49 +0,0 @@
-name: Deploy Web Studio
-
-on:
-  push:
-    branches: [studio]
-    paths:
-      - "desktop/frontend-next/**"
-      - ".github/workflows/deploy-web-studio.yml"
-
-permissions:
-  contents: read
-
-concurrency:
-  group: web-studio-production
-  cancel-in-progress: true
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: desktop/frontend-next
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-
-      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
-        with:
-          version: 10
-          run_install: false
-
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
-        with:
-          node-version: "24"
-          cache: pnpm
-          cache-dependency-path: desktop/frontend-next/pnpm-lock.yaml
-
-      - name: Install
-        run: pnpm install --frozen-lockfile
-
-      - name: Build
-        env:
-          VITE_REMOTE_HOME: https://reasonix.io/remote/
-        run: pnpm build
-
-      - name: Deploy
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
-        run: npx --yes [email protected] deploy --config wrangler.jsonc
@@ -1,191 +0,0 @@
-name: e2e-bot
-
-# Comment "/e2e" (fixed suite) or "/e2e diff" (generate tests for the PR's diff)
-# on a pull request to run the e2e benchmark against the real provider and post a
-# report back. Gated to trusted authors: the job checks out PR-head code and runs
-# it with the provider API key, so only the repo owner, members, and collaborators
-# may trigger it.
-
-on:
-  issue_comment:
-    types: [created]
-
-permissions:
-  contents: read
-  pull-requests: write
-
-concurrency:
-  group: e2e-bot-${{ github.event.issue.number }}
-  cancel-in-progress: true
-
-jobs:
-  e2e:
-    if: >-
-      github.event.issue.pull_request &&
-      contains(github.event.comment.body, '/e2e') &&
-      contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
-    runs-on: ubuntu-latest
-    # Running PR-head code with the provider secret is gated twice: the author_
-    # association check above, and this deployment environment. Configure the
-    # `e2e-bot` environment with required reviewers in repo settings to force a
-    # human approval per run (actions/untrusted-checkout-toctou).
-    environment: e2e-bot
-    steps:
-      - name: Acknowledge
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
-        with:
-          script: |
-            await github.rest.reactions.createForIssueComment({
-              owner: context.repo.owner, repo: context.repo.repo,
-              comment_id: context.payload.comment.id, content: 'eyes',
-            });
-
-      # Default-branch checkout: this is where the harness (cmd/e2ebench), the
-      # suite, and a run --metrics-capable agent live.
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        with:
-          go-version-file: go.mod
-          cache: true
-
-      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
-        with:
-          python-version: '3.12'
-
-      - name: Install and verify Linux sandbox backend
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y bubblewrap
-          if sysctl -n kernel.unprivileged_userns_clone >/dev/null 2>&1; then
-            sudo sysctl -w kernel.unprivileged_userns_clone=1
-          fi
-          if sysctl -n kernel.apparmor_restrict_unprivileged_userns >/dev/null 2>&1; then
-            sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
-          fi
-          bwrap --ro-bind / / --dev /dev --proc /proc -- true
-
-      - name: Build harness + fallback agent from the default branch
-        # Harness (e2ebench) and suite always come from main-v2 so a PR can't weaken
-        # its own grader or tests. The agent is rebuilt from the PR head below; this
-        # main-v2 build is only the fallback for heads that predate `run --metrics`.
-        run: |
-          go build -o "$RUNNER_TEMP/reasonix-base" ./cmd/reasonix
-          go build -o "$RUNNER_TEMP/e2ebench" ./cmd/e2ebench
-          cp -r benchmarks/e2e "$RUNNER_TEMP/suite"
-
-      - name: Check out the PR head
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        # Pin to the head commit resolved now and check it out detached, not the
-        # mutable PR ref: a force-push mid-run can't swap in different code after
-        # the trusted-author gate passed.
-        run: |
-          SHA=$(gh pr view ${{ github.event.issue.number }} --json headRefOid -q .headRefOid)
-          git fetch -q origin "$SHA"
-          git checkout -q --detach "$SHA"
-
-      - name: Build the agent from the PR head
-        # The whole point of the bot is to drive the PR's code, not main-v2's. Fall
-        # back to the main-v2 build only when the PR head can't yield a
-        # run --metrics-capable binary (build break or predates the flag).
-        id: agent
-        run: |
-          bin="$RUNNER_TEMP/reasonix-base"
-          src="main-v2 fallback (PR head lacks run --metrics)"
-          if go build -o "$RUNNER_TEMP/reasonix-pr" ./cmd/reasonix \
-            && "$RUNNER_TEMP/reasonix-pr" run -h 2>&1 | grep -q -- '-metrics'; then
-            bin="$RUNNER_TEMP/reasonix-pr"
-            src="PR head ($(git rev-parse --short HEAD))"
-          fi
-          echo "bin=$bin" >> "$GITHUB_OUTPUT"
-          echo "src=$src" >> "$GITHUB_OUTPUT"
-          echo "agent under test: $src"
-
-      - name: Write provider config
-        env:
-          REASONIX_HOME: ${{ runner.temp }}/reasonix-e2e-home
-        # User config covers suite tasks (they run in temp dirs); the repo-root copy
-        # covers diff mode (the agent runs in the repo root, where project config wins).
-        run: |
-          mkdir -p "$REASONIX_HOME"
-          cat > /tmp/reasonix-e2e.toml <<EOF
-          default_model = "e2e"
-
-          [[providers]]
-          name = "e2e"
-          kind = "openai"
-          base_url = "${{ vars.REASONIX_E2E_BASE_URL || 'https://api.deepseek.com' }}"
-          model = "${{ vars.REASONIX_E2E_MODEL || 'deepseek-v4-flash' }}"
-          api_key_env = "DEEPSEEK_API_KEY"
-          context_window = 20000   # small so the suite actually exercises compaction + cache churn
-
-          [providers.price]
-          cache_hit = ${{ vars.REASONIX_E2E_PRICE_CACHE_HIT || '0.02' }}
-          input = ${{ vars.REASONIX_E2E_PRICE_INPUT || '1' }}
-          output = ${{ vars.REASONIX_E2E_PRICE_OUTPUT || '2' }}
-          currency = "${{ vars.REASONIX_E2E_PRICE_CURRENCY || '¥' }}"
-
-          [permissions]
-          mode = "allow"
-
-          [codegraph]
-          enabled = false
-          EOF
-          cp /tmp/reasonix-e2e.toml "$REASONIX_HOME/config.toml"
-          cp /tmp/reasonix-e2e.toml ./reasonix.toml
-
-      - name: Run e2e
-        env:
-          DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
-          REASONIX_HOME: ${{ runner.temp }}/reasonix-e2e-home
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          COMMENT_BODY: ${{ github.event.comment.body }}
-        run: |
-          if [ -z "$DEEPSEEK_API_KEY" ]; then
-            printf 'missing DEEPSEEK_API_KEY secret\n\nAdd a repository secret named DEEPSEEK_API_KEY to enable the e2e bot.\n' > report.md
-            exit 1
-          fi
-          # Provider credentials are deliberately loaded only from Reasonix's
-          # global credential file, not inherited process variables. Keep this
-          # ephemeral runner copy private and outside the checked-out project.
-          umask 077
-          printf 'DEEPSEEK_API_KEY=%s\n' "$DEEPSEEK_API_KEY" > "$REASONIX_HOME/.env"
-          if printf '%s' "$COMMENT_BODY" | grep -q '/e2e[[:space:]]\+diff'; then
-            ATTEMPTS=$(printf '%s' "$COMMENT_BODY" | sed -nE 's@.*/e2e[[:space:]]+diff[[:space:]]+x([0-9]+).*@\1@p' | head -1)
-            [ -z "$ATTEMPTS" ] && ATTEMPTS=1
-            [ "$ATTEMPTS" -gt 5 ] && ATTEMPTS=5
-            BASE_REF=$(gh pr view ${{ github.event.issue.number }} --json baseRefName -q .baseRefName)
-            git fetch -q origin "$BASE_REF"
-            BASE=$(git merge-base "origin/$BASE_REF" HEAD)
-            "$RUNNER_TEMP/e2ebench" -mode diff -bin "${{ steps.agent.outputs.bin }}" -repo . -base "$BASE" -model e2e -attempts "$ATTEMPTS" -out report.md
-          else
-            # The current five-task baseline can exceed 400k after only three
-            # successful tasks. Keep bounded headroom so every scenario is graded.
-            "$RUNNER_TEMP/e2ebench" -bin "${{ steps.agent.outputs.bin }}" -suite "$RUNNER_TEMP/suite" -model e2e -out report.md -json report.json -budget 800000
-            node -e '
-              const results = require("./report.json");
-              const unsuccessful = results.filter((result) => !result.Passed || result.Skipped);
-              if (results.length === 0 || unsuccessful.length > 0) {
-                console.error(`e2e suite incomplete: ${unsuccessful.length}/${results.length} unsuccessful`);
-                process.exit(1);
-              }
-            '
-          fi
-
-      - name: Post report
-        if: always() && hashFiles('report.md') != ''
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          TRIGGER_USER: ${{ github.event.comment.user.login }}
-        run: |
-          printf '\n> agent: %s · triggered by @%s\n' "${{ steps.agent.outputs.src }}" "$TRIGGER_USER" >> report.md
-          gh pr comment ${{ github.event.issue.number }} --body-file report.md
-
-      - name: Report failure
-        if: failure()
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh pr comment ${{ github.event.issue.number }} --body "🤖 e2e bot failed — see the [run log](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})."
@@ -1,77 +0,0 @@
-name: Sync in-app feedback
-
-# Turns feedback submitted from Reasonix Studio into issues and reports issue
-# state (in progress, fixed in a tag, won't fix, duplicate) back to the worker,
-# and mirrors the reporter's replies onto their issue as bot comments.
-# Text from the public reaches the script only through the worker's JSON and
-# the GitHub API, never through a shell command line or an expression.
-
-on:
-  schedule:
-    - cron: '*/10 * * * *'
-    - cron: '5 3 * * *'
-  workflow_dispatch:
-    inputs:
-      dry_run:
-        description: Print what would happen without creating issues or writing back
-        required: false
-        default: false
-        type: boolean
-      full:
-        description: Re-read every open entry instead of only recently changed issues
-        required: false
-        default: false
-        type: boolean
-
-permissions:
-  contents: read
-  issues: write
-
-concurrency:
-  group: feedback-sync
-  cancel-in-progress: false
-
-jobs:
-  sync:
-    if: github.repository == 'esengine/DeepSeek-Reasonix'
-    runs-on: ubuntu-latest
-    timeout-minutes: 8
-    steps:
-      - name: Check secret
-        id: gate
-        env:
-          FEEDBACK_ADMIN_TOKEN: ${{ secrets.FEEDBACK_ADMIN_TOKEN }}
-        run: |
-          if [ -z "$FEEDBACK_ADMIN_TOKEN" ]; then
-            echo "::notice::FEEDBACK_ADMIN_TOKEN is not set; feedback sync skipped"
-            echo "run=false" >> "$GITHUB_OUTPUT"
-          else
-            echo "run=true" >> "$GITHUB_OUTPUT"
-          fi
-      - if: steps.gate.outputs.run == 'true'
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          # git tag --contains needs full history; the tag API would cost a request per entry.
-          fetch-depth: 0
-          persist-credentials: false
-      - if: steps.gate.outputs.run == 'true'
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
-        with:
-          node-version: '22'
-      - name: Sync
-        if: steps.gate.outputs.run == 'true'
-        env:
-          FEEDBACK_ADMIN_TOKEN: ${{ secrets.FEEDBACK_ADMIN_TOKEN }}
-          # crash.reasonix.io answers runner IPs with a managed challenge; workers.dev serves only the converter's admin paths.
-          FEEDBACK_BASE_URL: https://reasonix-crash-report.reasonix.workers.dev
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          DRY_RUN: ${{ github.event.inputs.dry_run || 'false' }}
-          FULL: ${{ github.event.inputs.full || 'false' }}
-          SCHEDULE: ${{ github.event.schedule }}
-        run: |
-          set -euo pipefail
-          args=()
-          if [ "$DRY_RUN" = "true" ]; then args+=(--dry-run); fi
-          # The daily schedule sweeps everything the change window could have missed.
-          if [ "$FULL" = "true" ] || [ "$SCHEDULE" = "5 3 * * *" ]; then args+=(--full); fi
-          node scripts/feedback-sync.mjs "${args[@]}"
@@ -1,99 +0,0 @@
-name: Auto-label issues
-
-# Classify new issues into area / platform / severity labels using the DeepSeek
-# API (the project's own model). The model is constrained to a fixed label set —
-# anything it returns outside the set is dropped — so it can't invent labels.
-# Issues it can't place into any area get `needs-triage` for a human to look at.
-# Version (v1/v2) labels are handled separately by issue-version-label.yml.
-on:
-  issues:
-    types: [opened, reopened]
-
-permissions:
-  issues: write
-
-concurrency:
-  group: issue-autolabel-${{ github.event.issue.number }}
-  cancel-in-progress: true
-
-jobs:
-  classify:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
-        env:
-          DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
-        with:
-          script: |
-            const AREA = ['agent','mcp','config','updater','provider','desktop','tui','skills','rendering'];
-            const PLATFORM = ['windows','macos','linux'];
-            const SEVERITY = ['crash','data-loss','security'];
-            const ALLOWED = new Set([...AREA, ...PLATFORM, ...SEVERITY]);
-
-            const issue = context.payload.issue;
-            const title = issue.title || '';
-            const body = (issue.body || '').slice(0, 4000);
-
-            const system = [
-              'You categorize GitHub issues for Reasonix, a Go-based AI coding agent with an Electron desktop app and a terminal UI.',
-              'Pick labels ONLY from these fixed sets. Never invent labels.',
-              'area (0-2, the affected subsystem):',
-              '  agent: core agent loop / tool-calling / reasoning',
-              '  mcp: MCP servers, plugins, codegraph',
-              '  config: configuration, setup wizard, .toml/.env',
-              '  updater: auto-update, installer, release packaging',
-              '  provider: model providers, model selection/switching',
-              '  desktop: Electron desktop GUI',
-              '  tui: terminal UI / CLI',
-              '  skills: skills system',
-              '  rendering: terminal rendering / flicker / repaint',
-              'platform (only if clearly specific to one OS): windows, macos, linux',
-              'severity (only if clearly applicable):',
-              '  crash: app crashes, hangs, or freezes',
-              '  data-loss: loss of sessions, config, or history',
-              '  security: credential/secret exposure or a security flaw',
-              'Be conservative: omit a label when unsure. The issue may be in Chinese.',
-              'Reply with JSON only: {"area":[],"platform":[],"severity":[]}',
-            ].join('\n');
-
-            let labels = [];
-            try {
-              const res = await fetch('https://api.deepseek.com/chat/completions', {
-                method: 'POST',
-                headers: {
-                  'Authorization': `Bearer ${process.env.DEEPSEEK_API_KEY}`,
-                  'Content-Type': 'application/json',
-                },
-                body: JSON.stringify({
-                  model: 'deepseek-chat',
-                  temperature: 0,
-                  response_format: { type: 'json_object' },
-                  messages: [
-                    { role: 'system', content: system },
-                    { role: 'user', content: `Title: ${title}\n\nBody:\n${body}` },
-                  ],
-                }),
-              });
-              if (!res.ok) {
-                core.warning(`DeepSeek API ${res.status}: ${await res.text()}`);
-                return;
-              }
-              const data = await res.json();
-              const parsed = JSON.parse(data.choices[0].message.content);
-              labels = [...(parsed.area || []), ...(parsed.platform || []), ...(parsed.severity || [])]
-                .filter(l => ALLOWED.has(l));
-            } catch (e) {
-              core.warning(`Classification failed: ${e.message}`);
-              return;
-            }
-
-            if (!labels.some(l => AREA.includes(l))) labels.push('needs-triage');
-
-            if (labels.length) {
-              await github.rest.issues.addLabels({
-                ...context.repo,
-                issue_number: issue.number,
-                labels,
-              });
-              core.info(`Applied: ${labels.join(', ')}`);
-            }
@@ -1,116 +0,0 @@
-name: Issue replies
-
-# Posts maintainer replies as github-actions[bot], so a batch of triage answers
-# spends the repository's quota instead of a person's content-creation limit.
-on:
-  workflow_dispatch:
-    inputs:
-      replies:
-        description: 'JSON array of {"issue": 123, "body": "...", "close": true | "not_planned"} or {"discussion": 123, "body": "...", "close": "resolved" | "outdated" | "duplicate"}'
-        required: true
-        type: string
-      interval:
-        description: Seconds between entries
-        required: false
-        default: '20'
-        type: string
-
-permissions:
-  issues: write
-  pull-requests: write
-  discussions: write
-
-concurrency:
-  group: issue-replies
-  cancel-in-progress: false
-
-jobs:
-  reply:
-    runs-on: win-gpu
-    timeout-minutes: 180
-    steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
-        env:
-          REPLIES: ${{ inputs.replies }}
-          INTERVAL: ${{ inputs.interval }}
-        with:
-          script: |
-            const replies = JSON.parse(process.env.REPLIES);
-            if (!Array.isArray(replies)) throw new Error('replies must be a JSON array');
-            const { owner, repo } = context.repo;
-            const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-            const failed = [];
-            // Only a rate limit is worth waiting out; any other refusal is final.
-            const rateLimited = (error) => {
-              const headers = error.response?.headers ?? {};
-              return error.status === 429 ||
-                (error.status === 403 && (headers['retry-after'] !== undefined || headers['x-ratelimit-remaining'] === '0'));
-            };
-            // Discussions have no REST comment API; they are addressed by node id.
-            const replyToDiscussion = async (number, body) => {
-              const q = await github.graphql(
-                `query($owner:String!,$repo:String!,$n:Int!){repository(owner:$owner,name:$repo){discussion(number:$n){id comments(last:100){nodes{body author{login}}}}}}`,
-                { owner, repo, n: number });
-              const d = q.repository.discussion;
-              if (!d) throw new Error('no such discussion');
-              if (d.comments.nodes.some((c) => c.author?.login === 'github-actions' && c.body === body)) return false;
-              await github.graphql(`mutation($id:ID!,$body:String!){addDiscussionComment(input:{discussionId:$id,body:$body}){comment{id}}}`, { id: d.id, body });
-              return true;
-            };
-            const closeReasons = { resolved: 'RESOLVED', outdated: 'OUTDATED', duplicate: 'DUPLICATE' };
-            const closeDiscussion = async (number, reason) => {
-              const q = await github.graphql(
-                `query($owner:String!,$repo:String!,$n:Int!){repository(owner:$owner,name:$repo){discussion(number:$n){id closed}}}`,
-                { owner, repo, n: number });
-              const d = q.repository.discussion;
-              if (d.closed) return;
-              await github.graphql(`mutation($id:ID!,$r:DiscussionCloseReason!){closeDiscussion(input:{discussionId:$id,reason:$r}){discussion{id}}}`, { id: d.id, r: reason });
-            };
-            for (const { issue, discussion, body, close } of replies) {
-              if (Number.isInteger(discussion) && typeof body === 'string' && body.trim() !== '') {
-                try {
-                  const posted = await replyToDiscussion(discussion, body);
-                  if (close !== undefined && close !== false) {
-                    const reason = closeReasons[close];
-                    if (!reason) throw new Error(`unknown close reason ${close}`);
-                    await closeDiscussion(discussion, reason);
-                  }
-                  core.info(`discussion #${discussion}: ${posted ? 'replied' : 'already replied'}${close ? ', closed' : ''}`);
-                } catch (error) {
-                  failed.push(`discussion ${discussion}: ${error.message}`);
-                }
-                await sleep(Math.max(1, Number(process.env.INTERVAL) || 20) * 1000);
-                continue;
-              }
-              if (!Number.isInteger(issue) || typeof body !== 'string' || body.trim() === '') {
-                failed.push(`${issue}: malformed entry`);
-                continue;
-              }
-              try {
-                const comments = await github.paginate(github.rest.issues.listComments, { owner, repo, issue_number: issue, per_page: 100 });
-                const posted = comments.some((c) => c.user?.type === 'Bot' && c.body === body);
-                if (!posted) {
-                  for (let attempt = 0; ; attempt++) {
-                    try {
-                      await github.rest.issues.createComment({ owner, repo, issue_number: issue, body });
-                      break;
-                    } catch (error) {
-                      if (attempt >= 5 || !rateLimited(error)) throw error;
-                      core.warning(`#${issue}: ${error.message}; retrying in 2 minutes`);
-                      await sleep(120_000);
-                    }
-                  }
-                }
-                if (close === true || close === 'not_planned') {
-                  const { data } = await github.rest.issues.get({ owner, repo, issue_number: issue });
-                  if (data.state === 'open') {
-                    await github.rest.issues.update({ owner, repo, issue_number: issue, state: 'closed', state_reason: close === 'not_planned' ? 'not_planned' : 'completed' });
-                  }
-                }
-                core.info(`#${issue}: ${posted ? 'already replied' : 'replied'}${close ? ', closed' : ''}`);
-              } catch (error) {
-                failed.push(`${issue}: ${error.message}`);
-              }
-              await sleep(Math.max(1, Number(process.env.INTERVAL) || 20) * 1000);
-            }
-            if (failed.length) core.setFailed(`not done:\n${failed.join('\n')}`);
@@ -1,64 +0,0 @@
-name: Label issue version
-
-# Issue forms can't let a reporter set a label directly (that needs triage rights),
-# so the bug/feature forms carry a "Version line" dropdown and this workflow reads
-# the submitted value and applies the matching label on their behalf:
-# 0.x -> v1 (TypeScript), 1.x -> v2 (main-v2), 2.x -> v3 (studio).
-on:
-  issues:
-    types: [opened, edited]
-
-permissions:
-  issues: write
-
-concurrency:
-  group: issue-version-${{ github.event.issue.number }}
-  cancel-in-progress: true
-
-jobs:
-  label:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
-        with:
-          script: |
-            const body = context.payload.issue.body || '';
-            const sectionOf = (name) =>
-              body.split(/^###\s+/m).find((s) => new RegExp(`^${name}`, 'i').test(s)) || '';
-            const labelOf = (major) => ({ 0: 'v1', 1: 'v2', 2: 'v3' })[major];
-
-            const m = sectionOf('Version line').match(/\b([012])\.x\b/);
-            if (!m) {
-              core.info('No version line found; nothing to label.');
-              return;
-            }
-            let choice = labelOf(Number(m[1]));
-
-            // The dropdown is a choice, and its first entry gets picked by
-            // reporters who never looked. `Exact version` is pasted from
-            // `reasonix --version` or Studio, so when it parses it is the better
-            // evidence. Anything that does not parse (a commit sha, a branch
-            // name) or names no known line leaves the dropdown to decide.
-            const exact = sectionOf('Exact version').match(/\b(\d+)\.(\d+)\.(\d+)/);
-            const fromVersion = exact && labelOf(Number(exact[1]));
-            if (fromVersion && fromVersion !== choice) {
-              core.info(`Version line says ${choice} but ${exact[0]} says ${fromVersion}; trusting the version.`);
-              choice = fromVersion;
-            }
-            await github.rest.issues.addLabels({
-              ...context.repo,
-              issue_number: context.issue.number,
-              labels: [choice],
-            });
-            // Keep the line labels mutually exclusive in case an edit flipped the choice.
-            for (const other of ['v1', 'v2', 'v3'].filter((l) => l !== choice)) {
-              try {
-                await github.rest.issues.removeLabel({
-                  ...context.repo,
-                  issue_number: context.issue.number,
-                  name: other,
-                });
-              } catch (e) {
-                core.info(`No ${other} label to remove.`);
-              }
-            }
@@ -1,32 +0,0 @@
-name: Deploy website
-
-# GitHub requires workflow_dispatch to be registered on the default branch.
-# The production implementation is the same workflow path on website.
-on:
-  workflow_dispatch:
-    inputs:
-      release_version:
-        description: "Optional product release version associated with this publication"
-        required: false
-        default: ""
-        type: string
-      release_request:
-        description: "Optional release workflow correlation ID"
-        required: false
-        default: ""
-        type: string
-      studio_version:
-        description: "Studio version that must be present in the generated changelog"
-        required: false
-        default: ""
-        type: string
-
-permissions: {}
-
-jobs:
-  require-website:
-    runs-on: ubuntu-latest
-    steps:
-      - run: |
-          echo "::error::Deploy the website with --ref website; production is restricted to that branch."
-          exit 1
@@ -1,27 +0,0 @@
-name: PR author gate
-
-# Pull requests are limited to maintainers and the logins in .github/pr-authors.txt.
-# This runs in the base repository's context, checks out the base branch only, and
-# never executes pull-request code; the allowlist it reads is the base branch's.
-on:
-  pull_request_target:
-    types: [opened]
-
-permissions:
-  contents: read
-  pull-requests: write
-
-concurrency:
-  group: pr-author-gate-${{ github.event.pull_request.number }}
-  cancel-in-progress: false
-
-jobs:
-  gate:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-      - run: node scripts/pr-author-gate.mjs
-        env:
-          GH_TOKEN: ${{ github.token }}
@@ -1,28 +0,0 @@
-name: Auto-label PRs
-
-# Apply area labels to PRs based on changed paths (see .github/labeler.yml).
-# Complements the AI-based issue labeler (issue-auto-label.yml). Version (v1/v2)
-# labels are handled separately by pr-version-label.yml.
-#
-# pull_request_target runs in the base repo context so it has the write token
-# needed to label PRs from forks; actions/labeler only reads the diff file list
-# (it never checks out or runs PR code), so this is safe.
-on:
-  pull_request_target:
-    types: [opened, synchronize, reopened]
-
-permissions:
-  contents: read
-  pull-requests: write
-
-concurrency:
-  group: pr-autolabel-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-jobs:
-  label:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7
-        with:
-          sync-labels: false
@@ -1,49 +0,0 @@
-name: Label PR version
-
-# Contributors (especially from forks) can't set labels themselves — that needs
-# triage rights. A PR's version line is fully determined by its base branch, so
-# this reads base.ref and applies v1/v2 on their behalf. pull_request_target runs
-# in the base repo's context so it has write access even for fork PRs; it only
-# reads trusted metadata (the base ref) and never checks out or runs PR code.
-on:
-  pull_request_target:
-    types: [opened, reopened, edited]
-
-permissions:
-  pull-requests: write
-
-concurrency:
-  group: pr-version-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-jobs:
-  label:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
-        with:
-          script: |
-            const base = context.payload.pull_request.base.ref;
-            const label = base === 'v1' ? 'v1'
-                        : base === 'main-v2' ? 'v2'
-                        : null;
-            if (!label) {
-              core.info(`Base branch '${base}' isn't a release line; skipping.`);
-              return;
-            }
-            const other = label === 'v2' ? 'v1' : 'v2';
-            await github.rest.issues.addLabels({
-              ...context.repo,
-              issue_number: context.payload.pull_request.number,
-              labels: [label],
-            });
-            // Drop the other line's label if the base was changed after opening.
-            try {
-              await github.rest.issues.removeLabel({
-                ...context.repo,
-                issue_number: context.payload.pull_request.number,
-                name: other,
-              });
-            } catch (e) {
-              core.info(`No ${other} label to remove.`);
-            }
@@ -1,64 +0,0 @@
-name: Spam comment guard
-
-# Activity-farming bots post short emoji-padded template comments on whatever
-# issue is currently active. They are cheap to spot structurally: a recently
-# registered account with no history here, no followers, and a pile of forked
-# repos, posting a sub-50 character comment with emoji and no code/link/log.
-# Every signal must fire — on 7604 replayed comments that caught all 83 known
-# spam posts with no false positive. Loosening any one of them reintroduces
-# real users ("点赞", "同样的问题", a 2020 account posting "感谢各位❤").
-
-on:
-  issue_comment:
-    types: [created]
-
-permissions:
-  issues: write
-  pull-requests: write
-
-concurrency:
-  group: spam-guard-${{ github.event.comment.id }}
-
-jobs:
-  screen:
-    if: github.event.comment.user.type != 'Bot' && github.event.comment.author_association == 'NONE'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
-        with:
-          script: |
-            const EMOJI = /[\u{1F300}-\u{1FAFF}\u{2600}-\u{27BF}\u{2B00}-\u{2BFF}\u{FE0F}]/gu;
-            const comment = context.payload.comment;
-            const body = comment.body || '';
-
-            const hasSubstance = /```|https?:\/\/|!\[|^>/m.test(body);
-            const emojiCount = (body.match(EMOJI) || []).length;
-            const bare = body.replace(EMOJI, '').trim();
-
-            const { data: author } = await github.rest.users.getByUsername({
-              username: comment.user.login,
-            });
-
-            const ageDays = (Date.now() - Date.parse(author.created_at)) / 86400000;
-
-            const signals = {
-              newAccount: ageDays < 365,
-              noFollowers: author.followers === 0,
-              forkPadded: author.public_repos >= 15,
-              tooShort: bare.length <= 45,
-              emojiPadded: emojiCount >= 1,
-              noSubstance: !hasSubstance,
-            };
-            const failed = Object.entries(signals).filter(([, v]) => !v).map(([k]) => k);
-            core.info(`${comment.user.login}: ${failed.length ? `kept (${failed.join(',')})` : 'spam'}`);
-            if (failed.length) return;
-
-            await github.graphql(
-              `mutation($id: ID!) {
-                 minimizeComment(input: { subjectId: $id, classifier: SPAM }) {
-                   minimizedComment { isMinimized }
-                 }
-               }`,
-              { id: comment.node_id },
-            );
-            core.notice(`Minimized spam comment by ${comment.user.login}`);
@@ -1,68 +0,0 @@
-name: Sweep stale version reports
-
-# Reports filed many minors back cannot be confirmed against a current build,
-# and 65% of the open tracker has never had a reply. This asks, waits, then
-# closes — never closing anything that was not asked first.
-
-on:
-  workflow_dispatch:
-    inputs:
-      dry_run:
-        description: Print what would happen without commenting
-        required: false
-        default: true
-        type: boolean
-      limit:
-        description: Maximum issues to touch in this run
-        required: false
-        default: '40'
-        type: string
-  schedule:
-    - cron: '17 3 * * 1'
-  push:
-    branches:
-      - main-v2
-    paths:
-      - '.github/workflows/stale-report-sweep.yml'
-      - 'scripts/stale-report-sweep.mjs'
-      - 'scripts/stale-report-sweep.test.mjs'
-
-permissions:
-  contents: read
-  issues: write
-
-concurrency:
-  group: stale-report-sweep
-  cancel-in-progress: false
-
-jobs:
-  sweep:
-    if: github.repository == 'esengine/DeepSeek-Reasonix'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
-        with:
-          node-version: '22'
-      - name: Test sweeper
-        run: node --test scripts/stale-report-sweep.test.mjs
-      # A push that only touched the sweeper runs its tests and stops there.
-      - name: Sweep
-        if: github.event_name != 'push'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          LIMIT: ${{ github.event.inputs.limit || '40' }}
-          # Posting stays off until this repository variable is set to "true", so
-          # merging the sweeper cannot start commenting on its own.
-          ENABLED: ${{ vars.STALE_SWEEP_ENABLED }}
-          REQUESTED_DRY_RUN: ${{ github.event.inputs.dry_run || 'true' }}
-        run: |
-          set -euo pipefail
-          args=(--limit "$LIMIT")
-          if [ "$ENABLED" != "true" ] || [ "$REQUESTED_DRY_RUN" = "true" ]; then
-            args+=(--dry-run)
-            echo "::notice::dry run (STALE_SWEEP_ENABLED=${ENABLED:-unset})"
-          fi
-          node scripts/stale-report-sweep.mjs "${args[@]}"
@@ -1,117 +0,0 @@
-name: Studio Certum signing smoke test
-
-# Signs two throwaway probes with the certificate release-studio.yml would use,
-# and publishes nothing. It reports the signer's subject, which is the value
-# STUDIO_SIGNING_SUBJECT must hold.
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: certum-signing
-  cancel-in-progress: false
-
-jobs:
-  sign:
-    if: github.repository == 'esengine/DeepSeek-Reasonix' && github.ref == 'refs/heads/studio'
-    runs-on: windows-2022
-    environment: studio-release
-    timeout-minutes: 20
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        with:
-          go-version-file: go.mod
-          cache: false
-
-      - name: Check signing configuration
-        shell: pwsh
-        env:
-          CERTUM_USERNAME: ${{ secrets.CERTUM_USERNAME }}
-          CERTUM_OTP_URI: ${{ secrets.CERTUM_OTP_URI }}
-          CERTUM_KEY_ID: ${{ secrets.CERTUM_KEY_ID }}
-        run: |
-          $ErrorActionPreference = 'Stop'
-          if ([string]::IsNullOrWhiteSpace($env:CERTUM_USERNAME)) { throw 'Missing secret CERTUM_USERNAME' }
-          if ($env:CERTUM_OTP_URI -notmatch '^otpauth://totp/') { throw 'Secret CERTUM_OTP_URI must be a complete TOTP URI' }
-          if ($env:CERTUM_KEY_ID -notmatch '^[0-9a-fA-F]{40}$') { throw 'Secret CERTUM_KEY_ID must be the 40-character SHA-1 certificate thumbprint' }
-
-      - name: Build open-source signing probes
-        shell: pwsh
-        run: |
-          $ErrorActionPreference = 'Stop'
-          # This minimal probe is covered by the repository's MIT license.
-          New-Item -ItemType Directory payload | Out-Null
-          'package main; func main() { println("Reasonix Studio Certum signing probe") }' | Set-Content probe.go
-          $env:GOOS = 'windows'
-          $env:GOARCH = 'amd64'
-          $env:CGO_ENABLED = '0'
-          go build -trimpath -o payload/probe.exe probe.go
-          if ($LASTEXITCODE -ne 0) { throw 'Probe compilation failed' }
-          'probe.exe' | Set-Content payload/signing-files.txt
-          Copy-Item payload/probe.exe installer-probe.exe
-
-      - name: Connect to SimplySign cloud certificate
-        uses: ./.github/actions/setup-certum
-        with:
-          username: ${{ secrets.CERTUM_USERNAME }}
-          otp-uri: ${{ secrets.CERTUM_OTP_URI }}
-          thumbprint: ${{ secrets.CERTUM_KEY_ID }}
-
-      - name: Sign and verify payload and installer probes
-        shell: pwsh
-        env:
-          CERTUM_KEY_ID: ${{ secrets.CERTUM_KEY_ID }}
-        run: |
-          ./scripts/sign-certum.ps1 -PayloadDirectory payload
-          ./scripts/sign-certum.ps1 -FilePath installer-probe.exe
-
-      # The session signs for any process on the runner while it is up.
-      - name: Disconnect from Certum
-        if: always()
-        shell: pwsh
-        run: Get-Process -Name '*SimplySign*' -ErrorAction SilentlyContinue | Stop-Process -Force
-
-      # With the switch on, an unset subject fails here as it would in a
-      # release; with it off, the value is reported so it can be recorded.
-      - name: Report and check the signer
-        shell: pwsh
-        env:
-          SIGNING_ENABLED: ${{ vars.STUDIO_SIGNING_ENABLED }}
-          EXPECTED_SUBJECT: ${{ vars.STUDIO_SIGNING_SUBJECT }}
-        run: |
-          $ErrorActionPreference = 'Stop'
-          $failed = $false
-          foreach ($file in @('payload/probe.exe', 'installer-probe.exe')) {
-            $signature = Get-AuthenticodeSignature -LiteralPath $file
-            $certificate = $signature.SignerCertificate
-            $stamp = if ($signature.TimeStamperCertificate) { $signature.TimeStamperCertificate.Subject } else { '(none)' }
-            @("### $file", '', "- subject: ``$($certificate.Subject)``", "- issuer: ``$($certificate.Issuer)``",
-              "- thumbprint: ``$($certificate.Thumbprint)``", "- timestamp: ``$stamp``", '') >> $env:GITHUB_STEP_SUMMARY
-            if (-not $signature.TimeStamperCertificate) {
-              Write-Output "::error title=studio-signing.timestamp-missing::$file carries no timestamp"
-              $failed = $true
-            }
-            if ([string]::IsNullOrWhiteSpace($certificate.Issuer)) {
-              Write-Output "::error title=studio-signing.issuer-missing::$file has a signer certificate without an issuer"
-              $failed = $true
-            }
-            if ([string]::IsNullOrWhiteSpace($env:EXPECTED_SUBJECT)) {
-              if ($env:SIGNING_ENABLED -eq 'true') {
-                Write-Output "::error title=studio-signing.subject-unset::STUDIO_SIGNING_SUBJECT is empty while STUDIO_SIGNING_ENABLED=true"
-                $failed = $true
-              } else {
-                Write-Output "::warning::STUDIO_SIGNING_SUBJECT is not set; record '$($certificate.Subject)'"
-              }
-            } elseif ($certificate.Subject -cne $env:EXPECTED_SUBJECT) {
-              Write-Output "::error title=studio-signing.unexpected-signer::STUDIO_SIGNING_SUBJECT is '$($env:EXPECTED_SUBJECT)' but $file is signed by '$($certificate.Subject)'"
-              $failed = $true
-            }
-          }
-          if ($failed) { exit 1 }
-          'Certum payload and installer signing, signer, trust and timestamps passed.' >> $env:GITHUB_STEP_SUMMARY
@@ -1,107 +0,0 @@
-name: Studio Windows self-test
-
-# An unsigned Windows installer for trying a branch on a real machine before it
-# is released. It runs on the intranet runner, so it is dispatch-only: the
-# repository is public, and nothing a pull request writes may run there.
-on:
-  workflow_dispatch:
-    inputs:
-      ref:
-        description: Branch, tag or commit to build
-        required: false
-        default: studio
-        type: string
-
-permissions:
-  contents: read
-
-concurrency:
-  group: studio-selftest-windows
-  cancel-in-progress: true
-
-jobs:
-  build:
-    runs-on: win-gpu
-    timeout-minutes: 90
-    steps:
-      # The machine's PATH finds WSL's bash before Git's, and a bash step run in
-      # WSL sees neither this checkout's toolchain nor Windows paths. cmd, since
-      # the machine's execution policy refuses the script a powershell step is.
-      - name: Put Git Bash first on PATH
-        shell: cmd
-        run: '>>"%GITHUB_PATH%" echo C:\Program Files\Git\bin'
-
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ inputs.ref }}
-
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        with:
-          go-version-file: go.mod
-          cache: true
-          cache-dependency-path: go.sum
-
-      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
-        with:
-          version: 10
-          run_install: false
-
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
-        with:
-          node-version: "24"
-          cache: pnpm
-          cache-dependency-path: |
-            desktop/frontend-next/pnpm-lock.yaml
-            desktop/electron/pnpm-lock.yaml
-
-      # A patch above the newest release, as a prerelease: it ranks ahead of
-      # what is published, so the build does not offer itself that release as
-      # an update, and behind the next one, which it does offer.
-      - name: Choose the version
-        id: version
-        shell: bash
-        run: |
-          latest="$(git ls-remote --tags origin 'refs/tags/studio-v*' | sed -n 's#.*refs/tags/studio-v\([0-9.]*\)$#\1#p' | sort -V | tail -1)"
-          test -n "$latest" || { echo "::error::no studio-v* release tag"; exit 1; }
-          IFS=. read -r major minor patch <<< "$latest"
-          version="$major.$minor.$((patch + 1))-selftest.${{ github.run_number }}"
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-          echo "Version: \`$version\` from \`$(git rev-parse --short HEAD)\`" >> "$GITHUB_STEP_SUMMARY"
-
-      # The intranet's route to the module proxy drops connections now and then.
-      # What arrives stays in this machine's module cache, so a retry resumes.
-      - name: Fetch Go modules
-        shell: bash
-        run: for i in 1 2 3 4 5; do go mod download && exit 0; sleep 10; done; exit 1
-
-      - name: Build the SPA
-        working-directory: desktop/frontend-next
-        shell: bash
-        run: pnpm install --frozen-lockfile && pnpm build
-
-      - name: Build the kernel
-        working-directory: desktop/electron
-        shell: bash
-        env:
-          REASONIX_VERSION: v${{ steps.version.outputs.version }}
-        run: pnpm install --frozen-lockfile && pnpm run build:host
-
-      - name: Build the bundle
-        working-directory: desktop/electron
-        shell: bash
-        run: pnpm exec electron-builder --dir -c.extraMetadata.version="${{ steps.version.outputs.version }}"
-
-      - name: Package the installer
-        working-directory: desktop/electron
-        shell: bash
-        run: |
-          pnpm exec electron-builder --prepackaged ../../dist/win-unpacked --win nsis \
-            -c.extraMetadata.version="${{ steps.version.outputs.version }}"
-          sha256sum ../../dist/ReasonixStudio-windows-amd64-installer.exe | tee -a "$GITHUB_STEP_SUMMARY"
-
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
-        with:
-          name: studio-selftest-windows-${{ steps.version.outputs.version }}
-          path: dist/ReasonixStudio-windows-amd64-installer.exe
-          if-no-files-found: error
-          retention-days: 7
@@ -1,688 +0,0 @@
-name: Studio
-
-# Studio's own surface — desktop/frontend-next (the SPA) and the Electron shell
-# that serves it — exists only on the studio branch, so it cannot live in ci.yml
-# without failing on main-v2 where neither directory is present. ci.yml covers
-# the kernel; this file covers the frontend build, the desktop module's Go side,
-# and the packaging contract on real artifacts.
-on:
-  push:
-    branches: [studio]
-  pull_request:
-    branches: [studio]
-
-permissions:
-  contents: read
-
-concurrency:
-  group: studio-${{ github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || github.ref == 'refs/heads/studio' }}
-
-jobs:
-  frontend:
-    name: frontend-next
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: desktop/frontend-next
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-
-      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
-        with:
-          version: 10
-          run_install: false
-
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
-        with:
-          node-version: "24"
-          cache: pnpm
-          cache-dependency-path: desktop/frontend-next/pnpm-lock.yaml
-
-      - name: Install
-        run: pnpm install --frozen-lockfile
-
-      - name: typecheck
-        run: pnpm typecheck
-
-      # The reducer and the event port carry the two pieces of logic a type
-      # error cannot reach: what a card means when a turn is interrupted, and
-      # what the client does about a frame that never arrived.
-      - name: test
-        run: pnpm test
-
-      # What the UI census holds. The gate reads structure — which inputs reach
-      # a mutating endpoint, and which of those the product names an action for
-      # — so UNDECLARED_MUTATION == 0 is a fact about the tree, not a lint over
-      # how anything is spelled.
-      - name: census invariants
-        run: pnpm census > /dev/null
-
-      # And that the analyzer still judges the way it did. _fx is a corpus
-      # written to exercise the rules, so its reports move only when a judgement
-      # moves; the product's name every root by file and line and are stale the
-      # moment a button moves, which is why they are not frozen.
-      - name: census fixture reports have not drifted
-        run: pnpm census:verify
-
-      # `build` runs tsc -b before vite, so this also proves the project
-      # references resolve — typecheck alone uses --noEmit and does not.
-      - name: build
-        run: pnpm build
-
-      # The published bundle must not carry MockPort's scripted fixtures: a
-      # release that cannot reach the kernel has to say so, not act out a fake
-      # session. main.tsx guards the import behind import.meta.env.DEV, and this
-      # is what proves the guard still holds.
-      - name: no fixtures in the bundle
-        run: |
-          if grep -rl 网关瞬时态 dist/ 2>/dev/null; then
-            echo "::error::MockPort fixtures reached the production bundle - check the import.meta.env.DEV guard in main.tsx"
-            exit 1
-          fi
-
-  # Real-Chromium guards that run without a kernel. Only the ones that passed
-  # three consecutive local runs are wired; the rest stay manual (see
-  # desktop/frontend-next/perf/README.md). Skipped unless the SPA changed.
-  browser-guards:
-    name: browser guards
-    runs-on: ubuntu-latest
-    timeout-minutes: 25
-    defaults:
-      run:
-        working-directory: desktop/frontend-next
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-
-      - name: SPA changed?
-        id: spa
-        working-directory: .
-        run: |
-          if [ "${{ github.event_name }}" = "pull_request" ] &&
-             git diff --quiet "origin/${{ github.base_ref }}...HEAD" -- desktop/frontend-next; then
-            echo "run=false" >> "$GITHUB_OUTPUT"
-          else
-            echo "run=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      - if: steps.spa.outputs.run == 'true'
-        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
-        with:
-          version: 10
-          run_install: false
-
-      - if: steps.spa.outputs.run == 'true'
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
-        with:
-          node-version: "24"
-          cache: pnpm
-          cache-dependency-path: desktop/frontend-next/pnpm-lock.yaml
-
-      - if: steps.spa.outputs.run == 'true'
-        name: Install
-        run: pnpm install --frozen-lockfile
-
-      - if: steps.spa.outputs.run == 'true'
-        name: Build the perf harness and install Chromium
-        run: |
-          pnpm exec vite build --config vite.perf.config.ts
-          pnpm exec playwright install --with-deps chromium
-
-      - if: steps.spa.outputs.run == 'true'
-        name: Guards
-        run: |
-          python3 -m http.server 4399 --directory dist-perf >/dev/null 2>&1 &
-          for _ in $(seq 30); do curl -sf http://localhost:4399/perf.html >/dev/null && break; sleep 1; done
-          node perf/intrinsic.mjs
-          node perf/firstscreen-fonts.mjs
-          node perf/contrast.mjs
-          node perf/stickyfold.mjs
-          node perf/crumb.mjs
-          node perf/hoverradius.mjs
-          node perf/jump-ends.mjs
-          node perf/modelrows.mjs
-          node perf/explorersize.mjs
-          node perf/git-panel.mjs
-          node perf/session-move-to.mjs
-          node perf/shell-refused.mjs
-          node perf/external-origin.mjs
-          node perf/rail-search-hold.mjs
-          node perf/rail-toggle-panes.mjs
-          node perf/session-move.mjs
-          node perf/session-ref.mjs
-          node perf/browser-full.mjs
-          node perf/mod-ui.mjs
-          node perf/codeeditor-size.mjs
-          node perf/composer-reflow.mjs
-          node perf/composer-toolbar-row.mjs
-          node perf/action-icons.mjs
-          node perf/rowhit.mjs
-          node perf/prefs-wide-centered.mjs
-          node perf/tab-pip.mjs
-          node perf/syntax-tokens.mjs
-          node perf/tab-close-inside.mjs
-          node perf/context-card-hover.mjs
-          node perf/sessquick.mjs
-          node perf/sessionrows.mjs
-          node perf/session-row-marker.mjs
-          node perf/session-selected-row.mjs
-          node perf/wheel.mjs
-          node perf/branch-tooltip.mjs
-          node perf/branch-alignment.mjs
-          node perf/branch-menu.mjs
-          node perf/image-preview.mjs
-          node perf/user-images.mjs
-          node perf/toast-anchor.mjs
-          node perf/addfolder-rest.mjs
-          node perf/scroll-jump.mjs
-          node perf/add-project-selects.mjs
-          node perf/project-header.mjs
-          node perf/setup-defer.mjs
-          node perf/narrow.mjs
-          node perf/settings-rows.mjs
-          node perf/narrow-steps.mjs
-          node perf/job-names.mjs
-          node perf/mcp-actions.mjs
-          node perf/web-access.mjs
-          node perf/peers-settings.mjs
-          node perf/output-cap.mjs
-          node perf/tool-output-clip.mjs
-          node perf/agent-run-tab.mjs
-          node perf/changes-cap.mjs
-          node perf/session-menu-fit.mjs
-          node perf/rail-rows-typography.mjs
-          node perf/settings-nav-fit.mjs
-          node perf/rail-rows-align.mjs
-          node perf/progress-tail.mjs
-          node perf/trust-wait.mjs
-          node perf/nest-nodes.mjs
-          node perf/provider-ports.mjs
-          node perf/peer-threads.mjs
-          node perf/text-size.mjs
-          node perf/fs-scale.mjs
-          node perf/composer-feel.mjs
-          node perf/side-panel.mjs
-          node perf/card-shell.mjs
-          node perf/line-cards.mjs
-          node perf/detail-panel.mjs
-          node perf/brand-lockup.mjs
-          node perf/notice-line.mjs
-          node perf/brought-line.mjs
-          node perf/modal-focus.mjs
-          node perf/focus-ring.mjs
-          node perf/narrow-forms.mjs
-          node perf/i18n-rendered.mjs
-          node perf/narrow-rail.mjs
-          node perf/selfcheck.mjs branch-tooltip
-
-  # What a hosted page does over the relay, end to end: the production bundle,
-  # the real Studio host and kernel, a real Chromium; only the accounts API and
-  # the relay are stand-ins (tools/relayfake). Event-transport changes are
-  # judged here, because a unit test of one side cannot see the other.
-  relay-harness:
-    name: relay harness
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-
-      - name: Transport changed?
-        id: scope
-        env:
-          BASE_REF: ${{ github.base_ref }}
-        run: |
-          paths="desktop/frontend-next internal/frontend/serve internal/platform/remotecloud internal/platform/account tools/relayfake cmd/reasonix-studio-host"
-          if [ "$GITHUB_EVENT_NAME" = "pull_request" ] &&
-             git diff --quiet "origin/$BASE_REF...HEAD" -- $paths; then
-            echo "run=false" >> "$GITHUB_OUTPUT"
-          else
-            echo "run=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      - if: steps.scope.outputs.run == 'true'
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        with:
-          go-version-file: go.mod
-          cache: true
-
-      - if: steps.scope.outputs.run == 'true'
-        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
-        with:
-          version: 10
-          run_install: false
-
-      - if: steps.scope.outputs.run == 'true'
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
-        with:
-          node-version: "24"
-          cache: pnpm
-          cache-dependency-path: desktop/frontend-next/pnpm-lock.yaml
-
-      - if: steps.scope.outputs.run == 'true'
-        name: Build the host, the stand-ins and the page
-        run: |
-          go build -o desktop/frontend-next/relay/bin/studio-host ./cmd/reasonix-studio-host
-          go build -o desktop/frontend-next/relay/bin/relayfake ./tools/relayfake
-          cd desktop/frontend-next
-          pnpm install --frozen-lockfile
-          pnpm exec vite build --outDir dist-relay --emptyOutDir
-          pnpm exec playwright install --with-deps chromium
-
-      - if: steps.scope.outputs.run == 'true'
-        name: Scenarios (hosted page over the relay; local page on a flapping network)
-        working-directory: desktop/frontend-next
-        env:
-          RELAY_HOST_BIN: ${{ github.workspace }}/desktop/frontend-next/relay/bin/studio-host
-          RELAY_FAKE_BIN: ${{ github.workspace }}/desktop/frontend-next/relay/bin/relayfake
-          RELAY_DIST: ${{ github.workspace }}/desktop/frontend-next/dist-relay
-        run: |
-          node relay/live.mjs
-          node relay/storm.mjs
-
-  # A pull request with no platform-relevant change (scripts/ci-platform-scope.sh)
-  # moves the Windows and macOS legs onto an ubuntu runner with every step
-  # skipped, so the check names still report without a scarce runner. A push to
-  # studio, or a failed `scope`, runs all three.
-  desktop:
-    name: desktop (${{ matrix.os }})
-    needs: scope
-    if: always()
-    runs-on: ${{ github.event_name == 'pull_request' && needs.scope.outputs.platform == 'false' && matrix.os != 'ubuntu-22.04' && 'ubuntu-latest' || matrix.os }}
-    env:
-      RUN_STEPS: ${{ github.event_name != 'pull_request' || needs.scope.outputs.platform != 'false' || matrix.os == 'ubuntu-22.04' }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-22.04, windows-latest, macos-latest]
-    defaults:
-      run:
-        working-directory: desktop
-    steps:
-      - if: env.RUN_STEPS == 'true'
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-
-      - if: env.RUN_STEPS == 'true'
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        with:
-          go-version-file: desktop/go.mod
-          cache: true
-          cache-dependency-path: desktop/go.sum
-
-      # The desktop module's Go tests: the elevated update helper, the
-      # release-side tools and the Windows uninstall planner. The code this
-      # gate covers is what replaces a running application on a user's disk.
-      # The module is CGO-free since the Wails shell retired, so no platform
-      # carries build dependencies of its own.
-      # Same command as `make studio-test`; this job is already in desktop/.
-      - name: go test
-        if: env.RUN_STEPS == 'true'
-        run: go test ./...
-
-      - if: env.RUN_STEPS == 'true'
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
-        with:
-          node-version: "24"
-
-      - name: CUA process and packaging contracts
-        if: env.RUN_STEPS == 'true'
-        timeout-minutes: 2
-        run: node --test --test-name-pattern=CUA electron/test/unit.mjs
-
-      - name: Install Linux native CUA fixture dependencies
-        if: env.RUN_STEPS == 'true' && runner.os == 'Linux'
-        run: sudo apt-get update && sudo apt-get install -y xvfb openbox dbus-x11 libgtk-3-dev at-spi2-core
-
-      - name: Native CUA application acceptance
-        if: env.RUN_STEPS == 'true'
-        timeout-minutes: 6
-        shell: bash
-        run: |
-          if [ "$RUNNER_OS" = Linux ]; then
-            dbus-run-session -- xvfb-run -a sh -c 'openbox >/tmp/reasonix-openbox.log 2>&1 & export NO_AT_BRIDGE=0 GTK_MODULES=gail:atk-bridge; node electron/test/cua-native.mjs'
-          else
-            node electron/test/cua-native.mjs
-          fi
-
-      # The host sits in the main module and nothing else builds it, so its
-      # dependency closure is checked here: it must stay CGO-free and
-      # platform-neutral or the Electron bundle cannot ship it. Cross-compiling
-      # is host-independent, so once is enough.
-      - name: host stays pure Go and platform-neutral
-        if: env.RUN_STEPS == 'true' && runner.os == 'Linux'
-        working-directory: .
-        run: |
-          for os in windows linux darwin; do
-            for arch in amd64 arm64; do
-              CGO_ENABLED=0 GOOS=$os GOARCH=$arch go build -o /dev/null ./cmd/reasonix-studio-host
-            done
-          done
-
-  # The ARM64 leg queues on a scarcer runner pool, so a pull request runs it
-  # only when it touches what the leg verifies; a push to studio always does.
-  # The macOS and Windows package legs follow `platform`, the same rule as the
-  # desktop matrix above.
-  scope:
-    name: package matrix
-    runs-on: ubuntu-latest
-    outputs:
-      matrix: ${{ steps.pick.outputs.matrix }}
-      arm64: ${{ steps.pick.outputs.arm64 }}
-      platform: ${{ steps.pick.outputs.platform }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-
-      - id: pick
-        env:
-          EVENT: ${{ github.event_name }}
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-        run: |
-          arm64=true
-          platform=true
-          if [ "$EVENT" = pull_request ]; then
-            arm64=false
-            platform=$(git diff -z --name-only --no-renames "$BASE_SHA" HEAD | bash scripts/ci-platform-scope.sh)
-            if git diff --name-only --no-renames "$BASE_SHA" HEAD |
-              grep -qE '^(desktop/electron/|desktop/packaging/|desktop/cmd/update-helper/|desktop/cmd/studio-manifest/|desktop/go\.(mod|sum)$|cmd/reasonix-studio-host/|internal/platform/(update|appupdate)/|go\.(mod|sum)$|scripts/(linux-install-smoke|verify-linux-package|verify-linux-appimage|verify-studio-artifacts)\.sh$|scripts/(windows-signing-lib|verify-windows-package|verify-windows-authenticode|install-smoke)\.ps1$|\.github/workflows/(studio|release-studio)\.yml$)'; then
-              arm64=true
-            fi
-          fi
-          legs='[
-            {"os":"macos-latest","arch":"arm64","platform":"darwin"},
-            {"os":"ubuntu-22.04","arch":"amd64","platform":"linux"},
-            {"os":"windows-latest","arch":"amd64","platform":"windows","ebarch":"x64"}
-          ]'
-          if [ "$platform" = false ]; then
-            legs="$(jq -c 'map(select(.platform == "linux"))' <<<"$legs")"
-          elif [ "$arm64" = true ]; then
-            legs="$(jq -c '. + [{"os":"windows-11-arm","arch":"arm64","platform":"windows","ebarch":"arm64"},{"os":"ubuntu-22.04-arm","arch":"arm64","platform":"linux"}]' <<<"$legs")"
-          else
-            legs="$(jq -c . <<<"$legs")"
-          fi
-          {
-            echo "arm64=$arm64"
-            echo "platform=$platform"
-            echo "matrix={\"include\":$legs}"
-          } >> "$GITHUB_OUTPUT"
-
-  # The packaging contract, on real artifacts rather than on the config that
-  # describes them. Unsigned on purpose: signing and notarization are a
-  # distribution concern and belong to the release workflow, and treating their
-  # absence as "packaging unverified" is what left macOS and Linux resting on a
-  # cross-compile while only Windows had ever produced a package.
-  package:
-    name: package (${{ matrix.os }})
-    needs: scope
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 45
-    strategy:
-      fail-fast: false
-      matrix: ${{ fromJSON(needs.scope.outputs.matrix) }}
-    defaults:
-      run:
-        shell: bash
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        with:
-          go-version-file: desktop/go.mod
-          cache: true
-          cache-dependency-path: desktop/go.sum
-
-      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
-        with:
-          version: 10
-          run_install: false
-
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
-        with:
-          node-version: "24"
-          cache: pnpm
-          cache-dependency-path: desktop/electron/pnpm-lock.yaml
-
-      # electron-builder shells out to dpkg-deb through fakeroot for the .deb and
-      # to rpmbuild for the .rpm.
-      - name: Install Linux packaging deps
-        if: runner.os == 'Linux'
-        run: sudo apt-get update && sudo apt-get install -y fakeroot rpm cpio xvfb xauth policykit-1
-
-      # The fpm electron-builder carries is an x86_64 program, so on an ARM64
-      # runner the .deb and .rpm are built with one installed from RubyGems.
-      - name: Use a native fpm on ARM64 Linux
-        if: runner.os == 'Linux' && runner.arch == 'ARM64'
-        run: |
-          sudo apt-get install -y ruby ruby-dev build-essential
-          sudo gem install --no-document fpm -v 1.16.0
-          echo "USE_SYSTEM_FPM=true" >> "$GITHUB_ENV"
-
-      - name: Build the SPA
-        working-directory: desktop/frontend-next
-        run: pnpm install --frozen-lockfile && pnpm build
-
-      # The Windows legs name their architecture instead of taking the
-      # toolchain's, so a runner whose Go or Node is the other architecture
-      # fails here rather than shipping a mislabelled package.
-      - name: Build the kernel the shell speaks to
-        working-directory: desktop/electron
-        env:
-          REASONIX_GOARCH: ${{ matrix.platform == 'windows' && matrix.arch || '' }}
-          REASONIX_VERSION: v0.0.0-ci
-        run: pnpm install --frozen-lockfile && pnpm test && pnpm run build:host
-
-      # The .deb's absolute-path payload. A no-op off Linux, so it is not
-      # guarded here: the one place it must not be forgotten is the one place
-      # it does anything.
-      - name: Stage the Linux package payload
-        working-directory: desktop/electron
-        run: pnpm run build:linux-payload
-
-      # No identity on a runner, and none wanted here: auto-discovery would make
-      # this job fail for the one reason it is not testing.
-      - name: Package
-        working-directory: desktop/electron
-        env:
-          CSC_IDENTITY_AUTO_DISCOVERY: "false"
-          ELECTRON_BUILDER_7Z_FILTER: ${{ matrix.platform == 'windows' && matrix.arch == 'arm64' && 'BCJ' || '' }}
-        run: pnpm run build:dist ${{ matrix.ebarch && format('--{0}', matrix.ebarch) || '' }} -c.extraMetadata.version=0.0.0-ci
-
-      # The release vocabulary is GOARCH. electron-builder's own is not, and the
-      # rename that reconciles them runs here rather than in the manifest.
-      - name: Artifacts carry the release architecture
-        run: |
-          ls -la dist
-          if ls dist | grep -q -- '-x64'; then
-            echo "::error::an artifact still names x64; studio-manifest reads names as GOARCH"
-            exit 1
-          fi
-          if ! ls dist | grep -q -- "-${{ matrix.platform }}-${{ matrix.arch }}"; then
-            echo "::error::no artifact named for ${{ matrix.platform }}-${{ matrix.arch }}"
-            exit 1
-          fi
-
-      # An emulated x64 program runs on ARM64 Windows, so a package that merely
-      # starts proves nothing about its architecture: every PE image in the
-      # bundle has to be built for the one the package is named for.
-      - name: Every PE image is built for the package's architecture
-        if: matrix.platform == 'windows'
-        run: |
-          dir=$(find dist -maxdepth 1 -type d -name 'win*-unpacked' | head -1)
-          test -n "$dir"
-          node desktop/electron/packaging/pe.js "$dir" "${{ matrix.arch }}"
-
-      # An update starts the installer with --updated, and that is what keeps the
-      # shortcuts (and the taskbar pin hanging off them) from being deleted and
-      # recreated. Installed twice over itself the way an update does it, the
-      # desktop shortcut has to still be the same file, pointing at a path with
-      # no version in it, or every update costs the user their pin.
-      - name: An update keeps the shortcuts and they name no version
-        if: matrix.platform == 'windows'
-        shell: pwsh
-        run: |
-          $installer = (Get-ChildItem dist -Filter 'ReasonixStudio-windows-*-installer.exe' | Select-Object -First 1).FullName
-          $dir = Join-Path $env:RUNNER_TEMP 'rx-update-guard'
-          Start-Process $installer -ArgumentList '/S', "/D=$dir" -Wait
-          $lnk = Join-Path ([Environment]::GetFolderPath('Desktop')) 'Reasonix Studio.lnk'
-          $target = (New-Object -ComObject WScript.Shell).CreateShortcut($lnk).TargetPath
-          if ($target -ne (Join-Path $dir 'Reasonix Studio.exe')) { throw "the desktop shortcut targets $target, not the stable executable" }
-          $mark = [datetime]'2020-01-01'
-          (Get-Item $lnk).LastWriteTime = $mark
-          Start-Process $installer -ArgumentList '/S', '--updated', "/D=$dir" -Wait
-          if ((Get-Item $lnk).LastWriteTime -ne $mark) { throw 'an update rewrote the desktop shortcut' }
-          Start-Process (Join-Path $dir 'Uninstall Reasonix Studio.exe') -ArgumentList '/S', '/currentuser' -Wait
-
-      # The release packages a signed copy of the bundle and then reads both
-      # packages back against it. The same recipe on an unsigned copy, so the
-      # packaging contract (the installer's one application archive, the pinned
-      # elevate.exe, every PE image's architecture) is exercised on pull
-      # requests and not first by a release.
-      - name: The packages read back against the bundle they were made from
-        if: matrix.platform == 'windows'
-        shell: bash
-        env:
-          ELECTRON_BUILDER_7Z_FILTER: ${{ matrix.arch == 'arm64' && 'BCJ' || '' }}
-        run: |
-          rm -rf payload nsis-src packed zip-src
-          cp -r "$(find dist -maxdepth 1 -type d -name 'win*-unpacked' | head -1)" payload
-          rm -f payload/resources/elevate.exe
-          # The NSIS run writes elevate.exe into the tree it packs, so each
-          # packager gets a copy and payload stays what was signed.
-          cp -r payload zip-src
-          cp -r payload nsis-src
-          cd desktop/electron
-          pnpm exec electron-builder --prepackaged ../../zip-src --win zip --${{ matrix.ebarch }} \
-            -c.extraMetadata.version=0.0.0-ci -c.directories.output=../../packed-zip
-          pnpm exec electron-builder --prepackaged ../../nsis-src --win nsis --${{ matrix.ebarch }} \
-            -c.extraMetadata.version=0.0.0-ci -c.directories.output=../../packed
-          mv ../../packed-zip/ReasonixStudio-windows-${{ matrix.arch }}.zip ../../packed/
-          ls -la ../../packed
-
-      - name: verify-windows-package.ps1 accepts them
-        if: matrix.platform == 'windows'
-        shell: pwsh
-        run: |
-          $ErrorActionPreference = 'Stop'
-          . ./scripts/windows-signing-lib.ps1
-          $digest = Get-ManifestDigest -Manifest @(Get-TreeManifest -Root payload)
-          ./scripts/verify-windows-package.ps1 `
-            -PayloadDirectory payload `
-            -ExpectedPayloadDigest $digest `
-            -InstallerPath "packed/ReasonixStudio-windows-${{ matrix.arch }}-installer.exe" `
-            -PortableArchivePath "packed/ReasonixStudio-windows-${{ matrix.arch }}.zip" `
-            -OutputPath "$env:RUNNER_TEMP/verify-output.txt" `
-            -Architecture ${{ matrix.arch }}
-          Get-Content "$env:RUNNER_TEMP/verify-output.txt"
-
-      # The release's own install smoke, against the unsigned installer: the
-      # package is installed where it is meant to run, its tree checked, and
-      # removed.
-      - name: The package installs, runs and uninstalls
-        if: matrix.platform == 'windows'
-        shell: pwsh
-        run: |
-          ./scripts/install-smoke.ps1 `
-            -Installer "dist/ReasonixStudio-windows-${{ matrix.arch }}-installer.exe" `
-            -Architecture ${{ matrix.arch }}
-
-      - name: Keep the arm64 installer for the x64 refusal check
-        if: matrix.platform == 'windows' && matrix.arch == 'arm64'
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
-        with:
-          name: studio-arm64-installer-ci
-          path: dist/ReasonixStudio-windows-arm64-installer.exe
-          if-no-files-found: error
-          retention-days: 1
-
-      # The update channel is the signed manifest. A second answer to which
-      # version is current is not a convenience. The .blockmap is the same
-      # channel's differential index and carries the release prefix, so it also
-      # inflates the count the release uses to refuse a partial publish.
-      - name: No electron-updater metadata
-        run: |
-          if ls dist | grep -qiE '^(latest|beta|alpha).*\.yml$'; then
-            echo "::error::electron-updater metadata was published beside the manifest channel"
-            exit 1
-          fi
-          if ls dist | grep -q '\.blockmap$'; then
-            echo "::error::a .blockmap ships under the release prefix; set differentialPackage: false"
-            exit 1
-          fi
-
-      # A binary inside app.asar cannot be spawned and the kernel serves the SPA
-      # off disk, so both have to be resources. Found rather than asserted at a
-      # path, because the unpacked directory is named by the builder.
-      - name: The kernel and the page are resources, not archive members
-        run: |
-          host=$(find dist -type f -path '*/bin/reasonix-studio-host*' ! -path '*app.asar*' | head -1)
-          page=$(find dist -type f -path '*/frontend-next/dist/index.html' ! -path '*app.asar*' | head -1)
-          echo "kernel: ${host:-<missing>}"
-          echo "page:   ${page:-<missing>}"
-          test -n "$host" -a -n "$page"
-
-      - name: Linux packages carry their declared architecture and update payload
-        if: runner.os == 'Linux'
-        run: bash scripts/verify-linux-package.sh "dist/ReasonixStudio-linux-${{ matrix.arch }}.deb" "dist/ReasonixStudio-linux-${{ matrix.arch }}.rpm" "${{ matrix.arch }}"
-
-      - name: The Linux package installs, runs, reinstalls and uninstalls
-        if: runner.os == 'Linux'
-        run: bash scripts/linux-install-smoke.sh "dist/ReasonixStudio-linux-${{ matrix.arch }}.deb" "${{ matrix.arch }}" 0.0.0-ci
-
-      - name: The AppImage carries its architecture, the kernel and the page
-        if: runner.os == 'Linux'
-        run: bash scripts/verify-linux-appimage.sh "dist/ReasonixStudio-linux-${{ matrix.arch }}.AppImage" "${{ matrix.arch }}"
-
-      # Recorded, not asserted: the real bundle layout, so later work argues
-      # from what electron-builder produced rather than from its documentation.
-      - name: Record the macOS bundle layout
-        if: runner.os == 'macOS'
-        run: |
-          app=$(find dist -maxdepth 2 -name '*.app' | head -1)
-          echo "app: $app"
-          ls "$app/Contents"
-          ls "$app/Contents/Resources" | head -20
-          ls "$app/Contents/Frameworks" | head -20
-
-      # The end of the contract: not that the name parses, but that the manifest
-      # keys the artifact under the platform this runner actually is. The tool
-      # writes latest.json into the directory and logs to stdout, so the check
-      # reads the file -- captured output would match its own progress line.
-      - name: studio-manifest resolves the platform this runner is
-        working-directory: desktop
-        env:
-          GITHUB_REPOSITORY: ${{ github.repository }}
-        run: |
-          go run ./cmd/studio-manifest ../dist v0.0.0-ci v0.0.0-ci
-          cat ../dist/latest.json
-          if ! grep -q '"${{ matrix.platform }}-${{ matrix.arch }}"' ../dist/latest.json; then
-            echo "::error::the manifest has no entry for ${{ matrix.platform }}-${{ matrix.arch }}"
-            exit 1
-          fi
-
-  # The arm64 installer carries one application and no other. Run anywhere but
-  # ARM64 Windows it has to say so and stop, instead of exiting 0 with nothing
-  # installed.
-  arm64-installer-refuses-x64:
-    name: arm64 installer refuses an x64 machine
-    needs: [scope, package]
-    if: needs.scope.outputs.arm64 == 'true'
-    runs-on: windows-latest
-    steps:
-      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
-        with:
-          name: studio-arm64-installer-ci
-          path: installer
-
-      - name: Run it silently
-        shell: pwsh
-        run: |
-          $ErrorActionPreference = 'Stop'
-          $target = Join-Path $env:RUNNER_TEMP 'rx-refused'
-          $run = Start-Process -FilePath installer/ReasonixStudio-windows-arm64-installer.exe -ArgumentList '/S', "/D=$target" -Wait -PassThru
-          Write-Host "exit code $($run.ExitCode)"
-          if ($run.ExitCode -eq 0) { throw 'the arm64 installer exited 0 on an x64 machine' }
-          if (@(Get-ChildItem -Recurse -Force $target -ErrorAction SilentlyContinue).Count -ne 0) { throw 'the arm64 installer wrote into the target on an x64 machine' }
@@ -1,38 +0,0 @@
-name: Update acknowledgments
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: '17 3 * * 1'
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  update:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
-        with:
-          node-version: '22'
-      - name: Update README contributor tables
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: node scripts/update-acknowledgments.mjs
-      - name: Open pull request
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
-        with:
-          # GITHUB_TOKEN-authored pull requests never trigger CI, so required checks would never report.
-          token: ${{ secrets.ACKNOWLEDGMENTS_TOKEN || secrets.GITHUB_TOKEN }}
-          branch: chore/update-acknowledgments
-          delete-branch: true
-          title: 'Update acknowledgments contributors / 更新致谢贡献者'
-          commit-message: 'docs: update acknowledgments contributors'
-          body: |
-            Refreshes the README acknowledgments tables from the GitHub contributors API.
-
-            - Source: `repos/esengine/DeepSeek-Reasonix/contributors?per_page=50&anon=1`
-            - The repository owner, declared aliases, tool identities, bots and entries without a GitHub login are left out (`scripts/credit-identities.json`).
-          labels: documentation
@@ -1,74 +0,0 @@
-name: Update Star History chart
-
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - main-v2
-    paths:
-      - '.github/workflows/update-star-history.yml'
-      - 'scripts/update-star-history.mjs'
-      - 'scripts/update-star-history.test.mjs'
-  schedule:
-    - cron: '23 */3 * * *'
-
-permissions:
-  contents: write
-
-concurrency:
-  group: update-star-history
-  cancel-in-progress: false
-
-jobs:
-  update:
-    if: github.repository == 'esengine/DeepSeek-Reasonix'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
-        with:
-          node-version: '22'
-      - name: Test chart generator
-        run: node --test scripts/update-star-history.test.mjs
-      - name: Generate chart assets
-        env:
-          STAR_HISTORY_GITHUB_TOKEN: ${{ secrets.STAR_HISTORY_GITHUB_TOKEN }}
-          STAR_HISTORY_OUTPUT_DIR: ${{ runner.temp }}/star-history
-        run: node scripts/update-star-history.mjs
-      - name: Publish chart assets
-        env:
-          OUTPUT_DIR: ${{ runner.temp }}/star-history
-          TARGET_BRANCH: star-history
-        run: |
-          set -euo pipefail
-
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-
-          if git fetch origin "$TARGET_BRANCH"; then
-            git switch --force-create "$TARGET_BRANCH" "origin/$TARGET_BRANCH"
-          else
-            git switch --create "$TARGET_BRANCH"
-          fi
-
-          mkdir -p assets/star-history
-          cp "$OUTPUT_DIR/star-history-light.svg" assets/star-history/star-history-light.svg
-          cp "$OUTPUT_DIR/star-history-dark.svg" assets/star-history/star-history-dark.svg
-          git add assets/star-history
-
-          if git diff --cached --quiet; then
-            echo "Star History chart is already current."
-            exit 0
-          fi
-
-          git commit \
-            -m "docs: update Star History chart" \
-            -m "Automated update:
-          Refresh the repository-hosted light and dark Star History SVGs from the authenticated GitHub stargazers API.
-
-          Verification:
-          - chart generator tests passed
-          - both SVG assets were rendered from timestamped stargazer data"
-          git push origin HEAD:"$TARGET_BRANCH"
@@ -1,29 +0,0 @@
-name: 1.x nightly monitoring
-
-# A schedule runs only from the default branch. These monitors measure the 1.x
-# desktop app, which lives on main-v2 alone, so their nightly runs are started
-# from here on that branch. Their push and pull_request gates run on main-v2 as
-# before.
-on:
-  schedule:
-    - cron: "17 3 * * *"
-    - cron: "43 4 * * *"
-  workflow_dispatch:
-
-permissions:
-  actions: write
-
-jobs:
-  dispatch:
-    runs-on: ubuntu-latest
-    steps:
-      - name: App memory screening
-        if: github.event_name == 'workflow_dispatch' || github.event.schedule == '17 3 * * *'
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: gh workflow run app-memory.yml --repo "$GITHUB_REPOSITORY" --ref main-v2
-      - name: Diagnostic overhead monitoring
-        if: github.event_name == 'workflow_dispatch' || github.event.schedule == '43 4 * * *'
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: gh workflow run diagnostic-overhead.yml --repo "$GITHUB_REPOSITORY" --ref main-v2
@@ -1,84 +0,0 @@
-name: Withdraw a Studio version
-
-# Pulls a published Studio release out of the update catalog (or puts it back),
-# so installs stop being offered it without waiting for a new release. Only the
-# catalog changes: the release's files stay where they are, and a withdrawn
-# release can be restored with the same run.
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Version to withdraw or restore, for example 2.36.0"
-        required: true
-        type: string
-      reason:
-        description: "Why it is withdrawn (shown to users on that version); ignored when restoring"
-        required: false
-        type: string
-      restore:
-        description: "Put a withdrawn version back instead of withdrawing it"
-        required: false
-        type: boolean
-        default: false
-
-concurrency:
-  group: studio-catalog
-  cancel-in-progress: false
-
-jobs:
-  withdraw:
-    name: ${{ inputs.restore && 'restore' || 'withdraw' }} ${{ inputs.version }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    environment: studio-release
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: studio
-          persist-credentials: false
-
-      - name: Update the Studio catalog
-        env:
-          VERSION: ${{ inputs.version }}
-          REASON: ${{ inputs.reason }}
-          RESTORE: ${{ inputs.restore }}
-          R2_BUCKET: ${{ secrets.R2_BUCKET }}
-          HAS_R2: ${{ secrets.R2_ACCESS_KEY_ID != '' && secrets.R2_SECRET_ACCESS_KEY != '' && secrets.R2_ACCOUNT_ID != '' && secrets.R2_BUCKET != '' }}
-        run: |
-          if [ "$HAS_R2" != "true" ]; then
-            echo "::error::R2 credentials are not configured, so the catalog cannot be changed"
-            exit 1
-          fi
-          if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.]+)?$ ]]; then
-            echo "::error::version must look like 2.36.0"
-            exit 1
-          fi
-          aws configure set aws_access_key_id "${{ secrets.R2_ACCESS_KEY_ID }}"
-          aws configure set aws_secret_access_key "${{ secrets.R2_SECRET_ACCESS_KEY }}"
-          aws configure set default.region auto
-          endpoint="https://${{ secrets.R2_ACCOUNT_ID }}.r2.cloudflarestorage.com"
-          at="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-          current=/tmp/studio-versions-current.json
-          next=/tmp/studio-versions-next.json
-          aws s3 cp "s3://${R2_BUCKET}/studio/versions.json" "$current" --endpoint-url "$endpoint"
-          if [ "$RESTORE" = "true" ]; then
-            bash scripts/withdraw-version.sh "$current" --restore "$VERSION" "$at" > "$next"
-            jq -e --arg v "$VERSION" '.versions | map(select((.version | ltrimstr("v")) == $v)) | length == 1' "$next" >/dev/null
-          else
-            bash scripts/withdraw-version.sh "$current" "$VERSION" "$REASON" "$at" > "$next"
-            jq -e --arg v "$VERSION" '(.versions | map(select((.version | ltrimstr("v")) == $v)) | length == 0) and (.withdrawn | map(select((.version | ltrimstr("v")) == $v)) | length == 1)' "$next" >/dev/null
-          fi
-          aws s3 cp "$next" "s3://${R2_BUCKET}/studio/versions.json" \
-            --endpoint-url "$endpoint" \
-            --content-type "application/json; charset=utf-8" \
-            --cache-control "public, max-age=300, stale-if-error=86400"
-          echo "Studio catalog updated for $VERSION (restore=$RESTORE)"
-
-      - name: Keep the GitHub release off the latest slot
-        if: ${{ !inputs.restore }}
-        env:
-          GH_TOKEN: ${{ github.token }}
-          VERSION: ${{ inputs.version }}
-        run: gh release edit "studio-v${VERSION}" --prerelease --latest=false --repo "$GITHUB_REPOSITORY"
@@ -1,98 +1,26 @@
-# Build artifacts. A `go build` of one command writes its binary into the
-# working directory, so every main package in the root module can drop its own
-# name here; repolint's build-artifact rule holds the two lists together.
-/bin/
-/dist/
-/stage/
-/npm/.stage/
-/reasonix
-/reasonix.exe
-/e2ebench
-/e2ebench.exe
-/context-retrieval
-/compaction
-/context-maintenance-e2e
-/runtime-resume
-/extension-protocol-gen
-/reasonix-plugin-example
-/mcp-line-counter-kit
-/reasonix-studio-host
-/signpath-contract
-/studio-delta
-/covergate
-/pricecheck
-/repolint
-/workgroupassay
-/write_heartbeat
-/catalog-detector
-/tool-surface-cache
-
-# Go test/build scratch
-*.test
-*.out
-*.coverprofile
-coverage.out
-cpu.prof
-mem.prof
-
-# Wails desktop artifacts
-/desktop/build/*
-!/desktop/build/appicon.png
-!/desktop/build/appicon.svg
-/desktop/desktop
-/desktop/frontend/dist/*
-!/desktop/frontend/dist/.gitkeep
-/desktop/frontend/sourcemaps/
-/desktop/frontend/wailsjs/
-/desktop/frontend/package.json.md5
-
-# Environment / local config (reasonix.example.toml is the shared template)
+node_modules/
+dist/
+coverage/
 .env
 .env.local
-*.local
-/reasonix.toml
-/desktop/.env
-/desktop/reasonix.toml
-
-# Node / frontend dependencies and caches
-node_modules/
-.pnpm-store/
-.npm/
-
-# Project-local Reasonix state; keep the checked-in review command.
-/.reasonix/*
-!/.reasonix/commands/
-!/.reasonix/commands/review.md
-
-# Stray Reasonix state written under a package dir by a test whose RealPath
-# resolves to CWD (e.g. remote bootstrap EnsureServe). Never commit these.
-internal/**/.reasonix/
-desktop/**/.reasonix/
-
-# CodeGraph per-project index (rebuilt locally; never committed)
-.codegraph/
-
-# Editor / OS
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+.pnpm-debug.log*
 .DS_Store
 Thumbs.db
 .idea/
 .vscode/
-
-benchmarks/context-maintenance-e2e/run/
-
-# Local scratch
-temp/
-
-# Official theme art intermediate outputs / caches
-scripts/official-theme-art/out/
-scripts/official-theme-art/__pycache__/
-
-# Committed pointer at REASONIX.md; overrides a global CLAUDE.md ignore rule.
-!/CLAUDE.md
-
-# Go build output left in the tree by `go build ./tools/...`. The ~ form is
-# what a linker leaves behind when it cannot replace a binary that is still
-# running, which on Windows is every rebuild while Studio is open.
-*.exe
-*.exe~
-/relayfake
+*.tsbuildinfo
+transcripts/
+sessions/
+*.jsonl
+!tests/**/*.jsonl
+# Committed reference transcripts so readers can reasonix replay / diff
+# the v0.1 bench results without an API key.
+!benchmarks/tau-bench/transcripts/
+!benchmarks/tau-bench/transcripts/*.jsonl
+.turbo/
+# Local-only Claude Code settings — personal overrides, never committed.
+.claude/settings.local.json
@@ -1 +0,0 @@
-v2.12.2
@@ -1,64 +0,0 @@
-version: "2"
-
-linters:
-  enable:
-    - copyloopvar
-    - errcheck
-    - errorlint
-    - govet
-    - ineffassign
-    - intrange
-    - modernize
-    - staticcheck
-    - unused
-    - usestdlibvars
-  settings:
-    modernize:
-      # omitempty -> omitzero changes which fields are written for nested
-      # structs. That is a wire-format change to session files and the
-      # extension protocol, not a refactor, so it lands on its own.
-      disable:
-        - omitzero
-    errcheck:
-      check-type-assertions: false
-      exclude-functions:
-        - (*os.File).Close
-        - (io.Closer).Close
-        - (*net/http.Response).Body.Close
-        - golang.org/x/term.Restore
-        # Win32: CloseHandle in a defer mirrors the Close exclusions above, and
-        # LazyProc.Call always returns a non-nil errno — the caller reads r1.
-        - golang.org/x/sys/windows.CloseHandle
-        - (*syscall.LazyProc).Call
-        - (*golang.org/x/sys/windows.LazyProc).Call
-    staticcheck:
-      checks:
-        - all
-        - -ST1005 # error strings ending with punctuation — too strict for initial adoption
-        - -ST1018 # Unicode format characters — intentional in TUI code
-        - -QF1001 # De Morgan's law — readability preference
-  exclusions:
-    generated: lax
-    presets:
-      - comments
-      - common-false-positives
-      - legacy
-      - std-error-handling
-    rules:
-      # Setup/teardown in tests routinely ignores cleanup errors.
-      - path: _test\.go
-        linters:
-          - errcheck
-      # The pinned golangci-lint binary's staticcheck reports SA5011 false
-      # positives on `if x == nil { t.Fatal(...) }`-guarded derefs in tests (it
-      # doesn't treat t.Fatal as terminating); the same code is clean under a
-      # locally-built golangci-lint. Scope the suppression to tests so SA5011
-      # still guards production code.
-      - path: _test\.go
-        linters:
-          - staticcheck
-        text: SA5011
-
-issues:
-  max-issues-per-linter: 0
-  max-same-issues: 0
@@ -1,65 +0,0 @@
-version: 2
-project_name: reasonix
-
-before:
-  hooks:
-    - go mod download
-
-builds:
-  - id: reasonix
-    main: ./cmd/reasonix
-    binary: reasonix
-    env:
-      - CGO_ENABLED=0
-    flags:
-      - -trimpath
-    ldflags:
-      # Inject version identity for `reasonix version --verbose/--json` (Integration D/E).
-      # buildTimeUTC is the goreleaser run time (UTC), not vcs.time.
-      - -s -w -X main.version={{ .Tag }} -X main.gitCommit={{ .ShortCommit }} -X main.buildTimeUTC={{ .Date }} -X reasonix/internal/tools/productdocs.linkedVersion={{ .Tag }} -X reasonix/internal/tools/productdocs.linkedRevision={{ .Commit }}
-    goos: [darwin, linux, windows]
-    goarch: [amd64, arm64]
-
-archives:
-  - id: reasonix
-    ids: [reasonix]
-    name_template: "reasonix-{{ .Os }}-{{ .Arch }}"
-    formats: [tar.gz]
-    format_overrides:
-      - goos: windows
-        formats: [zip]
-
-checksum:
-  name_template: SHA256SUMS
-  algorithm: sha256
-
-homebrew_casks:
-  - name: reasonix
-    ids: [reasonix]
-    # Prereleases (including v*-preview.* and v*-rc*) must not update the stable
-    # tap; brew has no separate prerelease channel, so uploading either cask
-    # would make it the default `brew install`.
-    # npm is a separate line (release-npm.yml, `npm-v*`), so an npm prerelease no
-    # longer drags brew along — a stable `v*` cask can ship while npm stays on rc.
-    skip_upload: "auto"
-    repository:
-      owner: esengine
-      name: homebrew-reasonix
-      branch: main
-      token: "{{ .Env.HOMEBREW_TAP_TOKEN }}"
-    homepage: "https://github.com/esengine/DeepSeek-Reasonix"
-    description: "Cache-first DeepSeek coding agent for the terminal."
-    commit_author:
-      name: reasonix
-      email: [email protected]
-    hooks:
-      post:
-        install: |
-          if OS.mac?
-            system_command "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "#{staged_path}/reasonix"]
-          end
-
-release:
-  prerelease: auto
-  make_latest: false
-  name_template: "Reasonix CLI {{ .Tag }}"
@@ -1,5 +0,0 @@
---
-description: Review a file for bugs
-argument-hint: [path]
---
-Read $1 and list any correctness bugs or risky patterns, with file:line references, most important first. Focus: $ARGUMENTS.
@@ -1,20 +0,0 @@
-version: 1
-project_slug: DeepSeek-Reasonix
-signing_policy_slug: release-signing
-repository_url: https://github.com/esengine/DeepSeek-Reasonix.git
-allowed_branch_names:
-  - studio
-allowed_build_definitions:
-  - .github/workflows/release-studio.yml
-  - .github/workflows/studio-certum-signing-smoke.yml
-fingerprint_files:
-  - .github/workflows/release-studio.yml
-  - .github/workflows/studio-certum-signing-smoke.yml
-  - .github/actions/setup-certum/action.yml
-  - scripts/install-smoke.ps1
-  - scripts/sign-certum.ps1
-  - scripts/verify-windows-authenticode.ps1
-  - scripts/verify-windows-package.ps1
-  - scripts/windows-signing-lib.ps1
-  - desktop/electron/electron-builder.yml
-  - cmd/signpath-contract/main.go
@@ -1,6 +0,0 @@
-# Reasonix
-
-The project's standing instructions live in `REASONIX.md` — one file, read by
-both Reasonix and Codex. Add rules there, never here.
-
-@REASONIX.md
@@ -1,6 +0,0 @@
-# Reasonix
-
-The project's standing instructions live in `REASONIX.md` — one file, read by
-both Reasonix and Claude Code. Add rules there, never here.
-
-@REASONIX.md
@@ -1,241 +0,0 @@
-# Contributing to Reasonix
-
-Thank you for your interest in contributing to Reasonix! This guide covers
-everything you need to get started.
-
-## Prerequisites
-
- **Go 1.26+** — the version `go.mod` requires
- **Git** — for version control
- **Node.js 24+ and pnpm 10** (optional) — only if you work on Studio
-  (`desktop/`)
-
-## Getting started
-
-```bash
-git clone https://github.com/esengine/DeepSeek-Reasonix.git
-cd DeepSeek-Reasonix
-go build ./cmd/reasonix    # builds the CLI binary
-go test ./...              # runs the full test suite
-```
-
-## Project structure
-
-| Directory | Purpose |
-|-----------|---------|
-| `cmd/reasonix` | CLI entry point |
-| `internal/runtime/agent` | Agent loop, session, coordinator |
-| `internal/frontend/cli` | TUI, subcommands, setup wizard |
-| `internal/session/control` | Transport-agnostic controller |
-| `internal/contract/config` | TOML configuration loading |
-| `internal/tools/builtin` | Built-in tools (bash, read_file, …) |
-| `internal/contract/provider` | Model-backend abstraction |
-| `internal/model/openai` | OpenAI-compatible provider |
-| `internal/ext/plugin` | MCP client (stdio + HTTP) |
-| `internal/contract/event` | Typed event stream |
-| `internal/ext/hook` | Shell hooks (PreToolUse, …) |
-| `internal/state/memory` | REASONIX.md hierarchy + auto-memory |
-| `internal/ext/skill` | Skill discovery from Markdown |
-| `internal/safety/sandbox` | OS-level sandboxing |
-| `internal/frontend/serve` | HTTP/SSE server frontend |
-| `internal/state/checkpoint` | Snapshot-based rewind |
-| `desktop/` | Studio: the Electron shell, the SPA it serves (separate Go module) |
-| `docs/` | Engineering spec, migration guide |
-
-### Dependency direction
-
-```
-cli → {agent, plugin, config} → {tool, provider}
-```
-
-Built-in subpackages import their parent to self-register via `init()`.
-Parents never import children.
-
-## Development workflow
-
-### Building
-
-```bash
-make build          # go build ./...
-make test           # go test ./...
-make vet            # go vet ./...
-make fmt            # gofmt -w .
-make hooks          # install git hooks (pre-push: go vet)
-make cross          # cross-compile for all 6 targets
-```
-
-### Isolated development environment
-
-A source-built binary shares no on-disk state with a stable release when launched
-with `REASONIX_HOME` set. This gives each build its own self-contained directory
-tree — config, credentials, sessions, cache, skills, commands, hooks, and
-desktop tab state — so the two builds never interfere:
-
-**CLI**
-
-```bash
-REASONIX_HOME=/tmp/reasonix-dev go run ./cmd/reasonix
-# or after building:
-#   REASONIX_HOME=/tmp/reasonix-dev ./bin/reasonix
-```
-
-**Studio**
-
-```bash
-REASONIX_HOME=/tmp/reasonix-dev-isolated make studio
-```
-
-On Windows, use `$env:REASONIX_HOME` in PowerShell or `set REASONIX_HOME=` in
-Command Prompt; the binary extension is `.exe`.
-
-The directory is empty on first launch; the app behaves exactly like a fresh
-install. Every subsequent write — config saves, credential storage, session
-logs — stays under `REASONIX_HOME`. Legacy migration, OS-home convention
-directory scanning, and all other fallback paths are skipped so no production
-data leaks in or out.
-
-### Cache-first review gate
-
-Reasonix treats high prompt-cache hit rate as product behavior. Changes that
-touch provider-visible system prompt construction, memory prefix, output styles,
-skill index behavior, default tool surfaces, tool schemas, provider request
-serialization, compaction, or MCP/tool registration need explicit cache review.
-
-For these changes:
-
- Keep system prompt changes low-frequency and require explicit review.
- Say in the PR what the change does to the provider-visible prefix, and why
-  that cost is worth paying.
- Prefer focused guard tests near the changed surface; `scripts/cache-guard.sh`
-  remains the broader release-level cache-hit check.
-
-### Running tests
-
-```bash
-go test ./...                           # all tests
-go test ./internal/runtime/agent/ -v            # verbose, one package
-go test ./internal/tools/builtin/ -run TestGrep  # one test
-```
-
-`testenv.IsolateUserState` installs a disposable user home and config-edit lock
-scope. Default-path tests can clear `REASONIX_HOME` without losing the test
-registry, while explicitly isolated Reasonix homes retain their own locks.
-
-`REASONIX_TEST_HOME` carries the scope to helper subprocesses. A helper that
-skips the isolation guard must install the inherited home with
-`testscope.InstallHome` before running tests.
-
-The environment variable alone cannot activate a test scope. Production
-executables still use the OS account's home for shared config locks.
-
-The guard removes its scratch home on normal completion. Scratch homes are
-created under the original home, so an interrupted run can still leave
-`.reasonix-test-home-*` directories; this is separate from persistent
-config-edit locks in the real `.reasonix/locks` directory.
-
-### Code style
-
- `gofmt` is enforced by CI — format before committing
- Follow existing patterns: wrap errors with `fmt.Errorf("...: %w", err)`
- Library code never calls `os.Exit` or prints to stdout/stderr
- Only `cli/` and `main/` decide exit codes and user-facing messages
- Exported identifiers must have doc comments
-
-### Commit messages
-
-Follow [Conventional Commits](https://www.conventionalcommits.org/):
-
-```
-feat(glob): add ** recursive pattern support
-fix: replace silent error discards with structured logging
-test(event): add comprehensive unit tests for event package
-docs: add CONTRIBUTING.md
-ci: add golangci-lint and govulncheck
-```
-
-## Adding a new built-in tool
-
-1. Create `internal/tools/builtin/mytool.go`
-2. Implement the `tool.Tool` interface: `Name()`, `Description()`, `Schema()`, `ReadOnly()`, `Execute()`
-3. Register via `func init() { tool.RegisterBuiltin(myTool{}) }`
-4. Add tests in `internal/tools/builtin/builtin_test.go` or a separate `mytool_test.go`
-5. The tool is automatically available — `main` blank-imports `builtin`
-
-## Adding a new model provider
-
-(For MCP tool servers see `internal/ext/plugin` instead — that's a different layer.)
-
-1. Create `internal/contract/provider/myprovider/`
-2. Implement `provider.Provider`: `Name()`, `Stream()`
-3. Register via `func init() { provider.Register("mykind", New) }`
-4. The provider is available from config with `kind = "mykind"`
-
-## Adding i18n strings
-
-1. Add the field to `internal/base/i18n/i18n.go` (`Messages` struct)
-2. Add the value in `internal/base/i18n/messages_en.go` and `messages_zh.go`
-3. The `TestCatalogsComplete` test will fail if you miss a locale
-
-## Submitting changes
-
-Reasonix ships on two lines (see the
-[version roadmap](https://github.com/esengine/DeepSeek-Reasonix/discussions/10748)),
-and each takes different changes:
-
-| Line | Branch | Takes |
-| --- | --- | --- |
-| 2.x | `studio` | Features and fixes: active development |
-| 1.x | `main-v2` | Bug fixes, provider/API compatibility, release/updater, security, platform stability |
-
-A fix that matters on both lines lands on `main-v2` and is reviewed for
-porting to `studio`; do not open the same PR against both.
-
-1. Fork the repository
-2. Create a feature branch from the branch your change targets
-3. Make your changes with tests
-4. Ensure `go test ./...` passes
-5. Ensure `gofmt -l .` shows no changes
-6. Submit a pull request to that same branch
-
-## Pull request policy
-
-**Related changes.** If you have several related changes of one pattern, a
-tracking issue plus one pull request is easiest to review.
-
-**Issue first for features.** A change that adds behaviour rather than fixing a
-defect should link an issue the maintainers have agreed to before the work
-starts. A fix for a reproducible defect may open directly, with the failing test
-in the PR. Documentation-only and test-only PRs are reviewed at lower priority.
-
-**Review tiers.**
-
- Changes under the `sensitive:` paths declared in `REASONIX.md` get a full
-  review plus a security review, regardless of author.
- Every PR carries the four sections of the PR template: Cause, Blast radius,
-  Neighbouring behaviours tested, Why this layer.
- The new test must fail without the change.
- A UI change (`desktop/frontend-next/src` or the website pages) fills the
-  template's UI section: screenshots before and after, light and dark, wide
-  and phone width.
- The same section carries the line "Entries moved, hidden or removed".
- Hiding or removing a visible control needs a linked issue and a release-notes
-  line naming it, and updates `docs/STUDIO_PARITY.md` for a 1.x feature.
- Review holds these; no check reads them.
-
-**Transparency.** The PR template has an optional checkbox for disclosing AI
-assistance. It is for transparency only and does not change how a change is
-reviewed.
-
-## Reporting issues
-
-Open an issue on GitHub with:
- Which line (1.x or 2.x) and the exact version
- Steps to reproduce
- Expected vs actual behavior
- Go version and OS
- Relevant logs or error messages
-
-## License
-
-By contributing, you agree that your contributions will be licensed under the
-same license as the project.
@@ -1,120 +0,0 @@
-VERSION := $(shell git describe --tags --always 2>/dev/null | sed 's/^studio-//' || echo dev)
-BUILD_TIME_UTC := $(shell date -u +%Y-%m-%dT%H:%M:%SZ)
-GIT_COMMIT := $(shell git rev-parse --short=12 HEAD 2>/dev/null || echo unknown)
-LDFLAGS := -s -w \
-	-X main.version=$(VERSION) \
-	-X main.gitCommit=$(GIT_COMMIT) \
-	-X main.buildTimeUTC=$(BUILD_TIME_UTC)
-GOEXE := $(shell go env GOEXE)
-# One pin for the Makefile and the CI lint job; see .github/workflows/ci.yml.
-GOLANGCI_VERSION := $(shell cat .golangci-version)
-
-.PHONY: build vet fmt lint lint-go lint-install lint-cross lint-update coverage-gate coverage-gate-update pricecheck acp-conformance check test studio-test sdk-test sdk-test-race hooks cross clean studio
-
-build:
-	CGO_ENABLED=0 go build -ldflags "$(LDFLAGS)" -o bin/reasonix$(GOEXE) ./cmd/reasonix
-	CGO_ENABLED=0 go build -ldflags "$(LDFLAGS)" -o bin/reasonix-plugin-example$(GOEXE) ./cmd/reasonix-plugin-example
-
-vet:
-	go vet ./...
-
-# Build Studio and launch it. The Electron shell is the one this runs: it is a
-# real GUI app on every platform without being bundled first, so there is one
-# launch path rather than a macOS one and an everywhere-else one.
-studio:
-	bash desktop/electron/run-studio.sh
-
-
-fmt:
-	gofmt -w .
-
-# Both gates CI runs, at the version CI pins. Skipping golangci-lint locally
-# trades a second here for a ten-minute CI round trip: `modernize` findings in
-# particular never surface in `go vet`.
-lint: lint-go
-	go run ./tools/repolint
-
-lint-go:
-	@command -v golangci-lint >/dev/null || { echo "golangci-lint not installed; run: make lint-install"; exit 1; }
-	@have=$$(golangci-lint version --short 2>/dev/null); want=$$(echo "$(GOLANGCI_VERSION)" | sed 's/^v//'); \
-		[ "$$have" = "$$want" ] || echo "warning: local golangci-lint $$have, CI pins $$want (make lint-install)"
-	golangci-lint run --timeout=5m ./...
-
-# CGO_ENABLED=0 keeps the install working where a stray clang on PATH shadows
-# the toolchain and breaks runtime/cgo.
-lint-install:
-	CGO_ENABLED=0 go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(GOLANGCI_VERSION)
-
-# repolint over what the working tree changed. It exists as a target rather than
-# a command to paste because the host recognizes `make check` as a verification
-# it can read the result of, while an arbitrary `go run ./tools/...` is an
-# unknown program it must assume writes — so only this form can be cited as
-# evidence that the standards gate passed.
-check:
-	go run ./tools/repolint -changed
-
-lint-update:
-	go run ./tools/repolint -update
-
-# The paths the project declared sensitive, held to the coverage they already
-# have. It runs their tests, so it is its own target rather than part of the
-# fast `make lint`. -update records the current numbers; lowering one needs
-# -allow-drop, the way widening a repolint budget does.
-coverage-gate:
-	go run ./tools/covergate
-
-coverage-gate-update:
-	go run ./tools/covergate -update
-
-# The vendors publish their rates on pages this reads and compares the table
-# against. It reaches the network, so it stays out of lint and out of CI: run it
-# before touching a rate and when a vendor announces a change. A page it cannot
-# read exits non-zero — unread never counts as agreement.
-pricecheck:
-	go run ./tools/pricecheck
-
-# Linting one GOOS leaves every //go:build windows and darwin file unchecked.
-lint-cross:
-	@for t in "linux ." "darwin ." "windows ." "linux desktop" "windows desktop"; do \
-		set -- $$t; \
-		echo "== golangci-lint GOOS=$$1 ($$2)"; \
-		(cd $$2 && GOOS=$$1 golangci-lint run --timeout=5m ./...) || exit 1; \
-	done
-
-# Every module, because a nested one is where a red test hides longest: the
-# shell's route allowlist sat broken through a release, and `go test ./...` from
-# the root cannot see it.
-test: studio-test sdk-test
-	go test ./...
-
-# Drives `reasonix acp` with the official ACP TypeScript SDK and holds every
-# message it writes to the schema that SDK ships. Needs node and network for
-# `npm ci`, which runs without install scripts against a lockfile.
-acp-conformance: build
-	cd tools/acp-conformance && npm ci --ignore-scripts --no-audit --no-fund
-	cd tools/acp-conformance && REASONIX_BIN=$(CURDIR)/bin/reasonix$(GOEXE) npm test
-
-# The shell is a nested module, so the root `test` target never reaches it.
-studio-test:
-	cd desktop && go test ./...
-
-sdk-test:
-	cd sdk/go && go test ./...
-
-sdk-test-race:
-	cd sdk/go && go test -race ./...
-
-hooks:
-	@git config core.hooksPath .githooks
-	@echo "installed: core.hooksPath -> .githooks (pre-push runs go vet)"
-
-cross:
-	@mkdir -p dist
-	@for p in darwin/amd64 darwin/arm64 linux/amd64 linux/arm64 windows/amd64 windows/arm64; do \
-		os=$${p%/*}; arch=$${p#*/}; ext=; [ $$os = windows ] && ext=.exe; \
-		echo "build $$os/$$arch"; \
-		CGO_ENABLED=0 GOOS=$$os GOARCH=$$arch go build -ldflags "$(LDFLAGS)" -o dist/reasonix-$$os-$$arch$$ext ./cmd/reasonix; \
-	done
-
-clean:
-	rm -rf bin dist
@@ -1,319 +0,0 @@
-<p align="center">
-  <img src="docs/logo-ghost-wave-effect.svg" alt="Reasonix" width="360"/>
-</p>
-
-<p align="center">
-  <a href="./README.md">English</a>
-  &nbsp;·&nbsp;
-  <strong>简体中文</strong>
-  &nbsp;·&nbsp;
-  <a href="./docs/GUIDE.zh-CN.md">指南</a>
-  &nbsp;·&nbsp;
-  <a href="./docs/ACP.md">ACP</a>
-  &nbsp;·&nbsp;
-  <a href="./docs/EXTENSIONS.md">扩展开发</a>
-  &nbsp;·&nbsp;
-  <a href="./docs/SPEC.md">规格</a>
-  &nbsp;·&nbsp;
-  <a href="https://esengine.github.io/DeepSeek-Reasonix/">官方网站</a>
-  &nbsp;·&nbsp;
-  <strong><a href="https://discord.gg/XF78rEME2D">Discord</a></strong>
-  &nbsp;·&nbsp;
-  <strong><a href="https://qm.qq.com/q/i59b0z2R8s">QQ</a></strong>
-</p>
-
-<p align="center">
-  <a href="https://github.com/esengine/DeepSeek-Reasonix/releases?q=studio-v&expanded=true"><img src="https://img.shields.io/github/v/release/esengine/DeepSeek-Reasonix.svg?filter=studio-v*&include_prereleases&style=flat-square&color=8250df&labelColor=161b22&label=studio%202.x" alt="Reasonix Studio 2.x"/></a>
-  <a href="https://www.npmjs.com/package/reasonix"><img src="https://img.shields.io/npm/v/reasonix.svg?style=flat-square&color=cb3837&labelColor=161b22&logo=npm&logoColor=white" alt="npm version"/></a>
-  <a href="https://github.com/esengine/DeepSeek-Reasonix/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/esengine/DeepSeek-Reasonix/ci.yml?style=flat-square&label=ci&labelColor=161b22&logo=githubactions&logoColor=white" alt="CI"/></a>
-  <a href="./LICENSE"><img src="https://img.shields.io/npm/l/reasonix.svg?style=flat-square&color=8b949e&labelColor=161b22" alt="license"/></a>
-  <a href="https://www.npmjs.com/package/reasonix"><img src="https://img.shields.io/npm/dm/reasonix.svg?style=flat-square&color=3fb950&labelColor=161b22&label=downloads" alt="downloads"/></a>
-  <a href="https://github.com/esengine/DeepSeek-Reasonix/stargazers"><img src="https://img.shields.io/github/stars/esengine/DeepSeek-Reasonix.svg?style=flat-square&color=dbab09&labelColor=161b22&logo=github&logoColor=white" alt="GitHub stars"/></a>
-  <a href="https://atomgit.com/esengine/DeepSeek-Reasonix"><img src="https://atomgit.com/esengine/DeepSeek-Reasonix/star/badge.svg" alt="AtomGit stars"/></a>
-  <a href="https://github.com/esengine/DeepSeek-Reasonix/graphs/contributors"><img src="https://img.shields.io/github/contributors/esengine/DeepSeek-Reasonix.svg?style=flat-square&color=bc8cff&labelColor=161b22&logo=github&logoColor=white" alt="contributors"/></a>
-  <a href="https://github.com/esengine/DeepSeek-Reasonix/discussions"><img src="https://img.shields.io/github/discussions/esengine/DeepSeek-Reasonix.svg?style=flat-square&color=58a6ff&labelColor=161b22&logo=github&logoColor=white" alt="Discussions"/></a>
-  <a href="https://discord.gg/XF78rEME2D"><img src="https://img.shields.io/badge/discord-join-5865F2.svg?style=flat-square&labelColor=161b22&logo=discord&logoColor=white" alt="Discord"/></a>
-  <a href="https://qm.qq.com/q/i59b0z2R8s"><img src="https://img.shields.io/badge/QQ%20group-1093562660-12B7F5.svg?style=flat-square&labelColor=161b22&logo=tencentqq&logoColor=white" alt="QQ group 1093562660"/></a>
-</p>
-
-<p align="center">
-  <a href="https://trendshift.io/repositories/27020?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-27020" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/27020/monthly?language=Go" alt="esengine/DeepSeek-Reasonix | Trendshift" width="250" height="55"/></a>
-  <a href="https://trendshift.io/repositories/27020?utm_source=repository-badge&amp;utm_medium=badge&amp;utm_campaign=badge-repository-27020" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/repositories/27020" alt="esengine/DeepSeek-Reasonix | Trendshift" width="250" height="55"/></a>
-</p>
-
-<br/>
-
-<p align="center"><strong>开源 · MIT · 程序跑在你电脑上，模型自选</strong></p>
-<h3 align="center">终端、桌面、浏览器、编辑器里都能用的 AI 编程助手。</h3>
-<p align="center">它会读你的项目、改文件、跑命令和测试。每一步先问你，或在你划定的范围内自己做，由你选；它用编辑工具改过的文件可以退回去。第一次用，从桌面应用 Studio 开始。</p>
-<p align="center">维护者：<strong>Huahui Yu</strong>。</p>
-
-> [!IMPORTANT]
-> **加入社区 · Community** — 双语 Discord，提供安装答疑（`#help` / `#求助`）、工作流展示与功能想法。→ **<https://discord.gg/XF78rEME2D>**
->
-> QQ 群 **DeepSeek-Reasonix官方群**（群号 `1093562660`）→ **<https://qm.qq.com/q/i59b0z2R8s>**（[二维码](./docs/assets/qq-group.svg)）
-
-> 抖音：**做游戏的小鱼**（抖音号 `22703872788`）· [二维码](./docs/assets/douyin.png)
-
-## ❤️赞助商
-
-<table><tr><td width="180" align="center" valign="middle"><a href="https://www.rightapi.ai/register?aff=e083bf73" target="_blank" rel="sponsored noopener noreferrer"><img src="./.github/sponsor/rightcode.png" alt="Right Code" width="64"></a></td><td valign="middle">感谢 Right Code 赞助了本项目！Right Code 稳定提供 Claude Code、Codex、Gemini 等模型的中转服务，并可选按量、包月两种计费模式。充值即可开票，企业、团队用户一对一对接。通过<a href="https://www.rightapi.ai/register?aff=e083bf73" target="_blank" rel="sponsored noopener noreferrer">此链接</a>注册。</td></tr><tr><td width="180" align="center" valign="middle"><a href="https://www.packyapi.ai/register?aff=rIbQ" target="_blank" rel="sponsored noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="./.github/sponsor/packycode-dark.svg"><img src="./.github/sponsor/packycode-light.svg" alt="PackyCode" width="80"></picture></a></td><td valign="middle">感谢 PackyCode 赞助了本项目！PackyCode 是一家稳定、高效的 API 中转服务商，统一域名、统一密钥、智能容灾切换。通过<a href="https://www.packyapi.ai/register?aff=rIbQ" target="_blank" rel="sponsored noopener noreferrer">此链接</a>注册。</td></tr></table>
-
-## 它是什么
-
-Reasonix 是一个开源的 AI 编程助手。程序跑在你的电脑上；AI 模型是你自己配置的服务，它读到的内容会发给这个服务。你用大白话描述任务，它在你选的项目文件夹里读代码、改文件、跑命令和测试，每一步都摆给你看。
-
-模型你自己选：内置 DeepSeek 预设，其他兼容 OpenAI 接口的服务填一条配置就行，费用直接付给模型服务商。
-
-## 你能得到什么
-
- **读、改、跑**：读你的项目、改文件、跑测试和命令，都在你选的项目文件夹里。
- **权限分档**：每次都问你，或让日常操作自动放行；你设的禁止规则始终有效。想先看方案，就开计划模式，批准后它才动手。
- **可回退**：改文件前先存快照，按对话轮次回退，不碰 git 历史。只覆盖编辑工具改的文件，命令行命令造成的改动不在内。
-
-## 30 秒上手
-
-下载、填模型密钥、打开项目。第一次用，从桌面应用 Studio 开始。
-
-1. 从[发布页](https://github.com/esengine/DeepSeek-Reasonix/releases?q=studio-v&expanded=true)下载并安装桌面应用 Reasonix Studio。
-2. 打开应用，按提示填入模型服务商和密钥。
-3. 打开你的项目文件夹，写下想做的事，例如“给 http 客户端加上失败重试”。
-4. 按你选的档位，该问你的操作它会先停下来问；同意就继续，不同意就拒绝。
-
-更喜欢终端的话，下载 `reasonix` 命令行后运行 `reasonix setup` 配好模型，再运行 `reasonix` 即可。详见[安装](#安装)和[快速开始](#快速开始)。
-
-## 四种用法
-
- **桌面应用（Studio）**：图形界面，适合第一次使用。
- **终端**：全屏文字界面，也能用 `reasonix run "任务"` 在脚本里运行。
- **浏览器**：`reasonix web` 在本机打开网页界面。
- **编辑器**：VS Code 安装扩展即可；其他支持 ACP（Agent Client Protocol，编辑器接入某个 AI 助手的通用约定）的编辑器，可连接 `reasonix acp`。
-
-四种用法背后是同一套程序。下面的内容写给进阶用户和贡献者。
-
-## 在 DeepSeek Harness 里使用
-
-DeepSeek Harness（`dsh`）可以通过 ACP 把任务交给 Reasonix 作为子智能体去做。本仓库为此发布了一个插件索引：
-
-1. 在运行 `dsh` 的机器上先运行 `reasonix setup`。在 DSH 网页界面打开“自定义插件市场”（插件，更多），再到 Discover 页添加这个索引：`https://raw.githubusercontent.com/esengine/DeepSeek-Reasonix/studio/integrations/dsh-plugin/market-index.json`
-2. 从中安装“Reasonix subagent”。
-3. 打开这个插件的页面，把它的开关打开。关着的时候模型没有 `reasonix` 工具，可能改在自己的 shell 里直接运行 `reasonix -p`，看起来像委派，其实不是。
-
-配置细节、权限策略和限制见 [在 DeepSeek Harness 中使用 Reasonix](./docs/DSH.md)。
-
-## 版本
-
-Reasonix 分为两条版本线，调整的原因见[版本路线公告](https://github.com/esengine/DeepSeek-Reasonix/discussions/10748)。
-
-| 版本线 | 分支 | 状态 | 获取方式 |
-| --- | --- | --- | --- |
-| **Reasonix 2.x** | `studio`（当前分支） | 活跃开发 | [Studio 发布页](https://github.com/esengine/DeepSeek-Reasonix/releases?q=studio-v&expanded=true) |
-| **Reasonix 1.x** | [`main-v2`](https://github.com/esengine/DeepSeek-Reasonix/tree/main-v2) | 维护 / 稳定 | `npm i -g reasonix` · [桌面端下载](https://reasonix.io/?download=desktop#start) |
-
- **想要稳定**：继续使用 1.x。它会持续收到 Bug 修复、Provider / API 兼容、
-  更新器和安全修复，但不再扩展核心架构。
- **想体验新架构**：使用 2.x Reasonix Studio。它仍在快速迭代，欢迎反馈问题。
-
-1.x 中有价值的修复、测试和行为会逐项 review，适合新架构的会迁移或重新实现到 2.x。
-
- [从 1.x 迁移到 2.x](./docs/MIGRATING.md)（英文）：两条线共用哪些数据，以及如何在同一台
-  机器上同时使用而不丢会话。
- [2.x 路线图](./docs/ROADMAP.md)（英文）：2.x 还要交付什么、如何发布、哪些决定尚未做出。
-
-## 特性
-
-以下是写给进阶用户的技术要点。
-
- **配置驱动**：provider、agent、启用的工具、插件全部在 `reasonix.toml` 中声明，
-  内核无硬编码模型。
- **多模型 · 可组合**：DeepSeek 作为预设内置；任何 OpenAI 兼容
-  端点都只是一条配置。可选让两个模型协同（执行器 + 规划器），各自独立、缓存稳定的 session。
- **插件驱动**：MCP server 提供工具、提示词和资源；Extension Protocol v1
-  Sidecar 还可以拦截运行时事件、提供 Provider 与结构化 UI，并通过版本化插件包分发。
- **缓存友好的上下文维护**：启动时注入稳定的环境摘要；旧工具输出会先 snip/prune，
-  再进入摘要 compaction；内置工具 schema 合约有文档和回归测试保护。
- **零摩擦分发**：`CGO_ENABLED=0` 单二进制；一条命令交叉编译到六个目标平台。
-  产物是完全自包含的静态二进制——目标机器上除二进制本身外无需安装任何东西。
-
-## 安装
-
-当前分支是 **Reasonix 2.x**，桌面端是 Reasonix Studio；CLI、Studio 和编辑器集成
-都运行同一套本地 Reasonix 引擎。
-
-### Reasonix Studio（2.x）
-
-从最新的 [Studio 发布](https://github.com/esengine/DeepSeek-Reasonix/releases?q=studio-v&expanded=true)
-下载对应平台的安装包（标签为 `studio-v2.*`；`-rc.N` 等候选版本标为预发布）：
-
-| 平台 | 安装包 | 架构 |
-| --- | --- | --- |
-| macOS | `.dmg` 或 `.zip` | Apple Silicon（`arm64`）/ Intel（`amd64`） |
-| Windows | 安装器 `-installer.exe` 或便携 `.zip` | x64 |
-| Linux | `.deb`、`.rpm` 或 `.AppImage`（只提供下载） | x64（`amd64`）/ ARM64（`arm64`，aarch64） |
-
-每个安装包都附带 `.minisig` 签名，发布页另有 `SHA256SUMS`。安装后 Studio 会在
-应用内自行更新。
-
-同一个发布页也提供 2.x 的 `reasonix` CLI 归档（`darwin|linux|windows × amd64|arm64`）。
-
-安卓版在同一个发布页上，文件名是 `ReasonixMobile-<版本>.apk`（`arm64`，Android 8.0 及以上）。
-
-这个 APK 用 Android 发布密钥签名，不走 minisign，因此只有一个 `.sha256`，没有 `.minisig`。
-
-该密钥缺失时产物名为 `ReasonixMobile-<版本>-unsigned.apk`。Android 不接受未签名的包，
-这类构建只留作 workflow 产物供自行签名，发布页上不会挂 APK。
-
-内核与界面都跑在手机上，Agent 通过 SSH 连接你自己的服务器；与电脑配对时扫它显示的二维码。
-
-### Reasonix 1.x（稳定版）
-
-1.x CLI 在任意支持的平台上都可以通过 npm 安装，macOS 也可以使用 Homebrew：
-
-```sh
-npm i -g reasonix                  # 任意系统;自动拉取对应平台的原生二进制
-brew install esengine/reasonix/reasonix   # macOS
-```
-
-1.x 桌面端请前往[官方下载页](https://reasonix.io/?download=desktop#start)。
-Windows 安装器使用 Certum 代码签名证书签名。
-
-### VS Code 扩展
-
-扩展不内置 CLI，而是启动本机的 `reasonix acp` 后端，并提供原生聊天、编辑器
-上下文、工具调用审批、模型选择和工作区会话。请先安装 1.x CLI。
-
- **VS Code：** [从 Visual Studio Marketplace 安装](https://marketplace.visualstudio.com/items?itemName=SivanLiu.reasonix-agent)
- **VSCodium / Eclipse Theia：** [从 Open VSX Registry 安装](https://open-vsx.org/extension/SivanLiu/reasonix-agent)
- **扩展 ID：** `SivanLiu.reasonix-agent` · [源码与使用说明](https://github.com/SivanCola/reasonix-vscode)
-
-### 从源码构建
-
-克隆仓库；`studio` 构建 2.x，`main-v2` 构建 1.x：
-
-```sh
-git clone https://github.com/esengine/DeepSeek-Reasonix.git
-cd DeepSeek-Reasonix
-git switch studio
-```
-
-#### CLI
-
-CLI 构建需要 **Go 1.25+**。模块固定了 `toolchain`，保持 `GOTOOLCHAIN=auto`
-即可让 Go 自动下载对应工具链，也可以手动安装。
-
-```sh
-make build      # -> bin/reasonix(.exe)
-make cross      # -> dist/（darwin|linux|windows × amd64|arm64）
-```
-
-#### Studio
-
-Studio 的前端还需要 **Node 24+ 与 pnpm 10**（`npm install -g pnpm@10`）。
-
-```sh
-make studio
-```
-
-各平台的 webview 依赖和 Linux 构建标签见 [Studio 构建指南](desktop/README.md#prerequisites)。
-
-## 快速开始
-
-### Reasonix Studio
-
-安装并启动 Studio，然后在应用内连接 provider 和模型即可使用，无需配置 CLI。
-
-### CLI / TUI
-
-```sh
-reasonix setup                      # 配置 provider 和模型
-reasonix                            # 启动交互式会话
-reasonix run "把 main.go 里的 TODO 实现掉"
-```
-
-需要项目指令时，可在交互式会话中运行 `/init`。
-
-CLI 进阶用法和详细配置见 **[CLI 命令参考](./docs/CLI.zh-CN.md)**、
-**[指南](./docs/GUIDE.zh-CN.md)** 和
-**[配置路径](./docs/CONFIG_PATHS.md)**。
-
-## 文档
-
- **开始使用：** [指南](./docs/GUIDE.zh-CN.md) ·
-  [CLI 命令参考](./docs/CLI.zh-CN.md) · [配置路径](./docs/CONFIG_PATHS.md) ·
-  [ACP 编辑器接入](./docs/ACP.md) · [在 DeepSeek Harness 中使用](./docs/DSH.md)
- **功能与排障：** [子智能体 Profile](./docs/SUBAGENT_PROFILES.md) ·
-  [Context Engine v2](./docs/SESSION_MEMORY_RETRIEVAL.md) ·
-  [能力诊断](./docs/CAPABILITY_DIAGNOSTICS.md) ·
-  [恢复与安全模式](./docs/RECOVERY.md) ·
-  [Checkpoints 与 rewind](./docs/CHECKPOINTS.md)
- **Agent 预设：** [会话级组合](./docs/AGENT_COMPOSITIONS.zh.md)
- **工程与迁移：** [规格](./docs/SPEC.md) ·
-  [任务合约与暂停策略](./docs/TASK_CONTRACT.md) ·
-  [工具合约](./docs/TOOL_CONTRACT.md) ·
-  [从 1.x 迁移到 2.x](./docs/MIGRATING.md) ·
-  [2.x 路线图](./docs/ROADMAP.md)
- **扩展开发：** [扩展概览](./docs/EXTENSIONS.md) ·
-  [插件包与 Manifest v1](./docs/PLUGIN_PACKAGES.md) ·
-  [Extension Protocol](./docs/EXTENSION_PROTOCOL.md) ·
-  [Go SDK 与 starter](./sdk/go/README.md)
-
-## Star 趋势
-
-<a href="https://www.star-history.com/?repos=esengine%2FDeepSeek-Reasonix&type=date&legend=top-left">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/esengine/DeepSeek-Reasonix/star-history/assets/star-history/star-history-dark.svg" />
-   <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/esengine/DeepSeek-Reasonix/star-history/assets/star-history/star-history-light.svg" />
-   <img alt="Star History Chart" src="https://raw.githubusercontent.com/esengine/DeepSeek-Reasonix/star-history/assets/star-history/star-history-light.svg" />
- </picture>
-</a>
-
-<br/>
-
-## 致谢
-
-下面这些朋友的工作塑造了 Reasonix 今天的样子 —— 当前按 commit 数统计的前 20 名贡献者。
-完整贡献者列表在
-[GitHub](https://github.com/esengine/DeepSeek-Reasonix/graphs/contributors?all=1)。
-
-<!-- reasonix-top-contributors:start -->
-| Contributor | Contributor | Contributor | Contributor |
-| --- | --- | --- | --- |
-| [**SivanCola**](https://github.com/SivanCola) | [**KHG420**](https://github.com/KHG420) | [**ttmouse**](https://github.com/ttmouse) | [**chuiwenwei**](https://github.com/chuiwenwei) |
-| [**lifu963**](https://github.com/lifu963) | [**XTLine**](https://github.com/XTLine) | [**HUQIANTAO**](https://github.com/HUQIANTAO) | [**xxoingr**](https://github.com/xxoingr) |
-| [**Harbor404**](https://github.com/Harbor404) | [**GTC2080**](https://github.com/GTC2080) | [**mchenziyi**](https://github.com/mchenziyi) | [**Li-Charles-One**](https://github.com/Li-Charles-One) |
-| [**light-front-theory**](https://github.com/light-front-theory) | [**imcreazy**](https://github.com/imcreazy) | [**eghrhegpe**](https://github.com/eghrhegpe) | [**noreply**](https://github.com/noreply) |
-| [**par73e**](https://github.com/par73e) | [**Bernardxu123**](https://github.com/Bernardxu123) | [**lancy69**](https://github.com/lancy69) | [**Guan0923**](https://github.com/Guan0923) |
-<!-- reasonix-top-contributors:end -->
-
-特别感谢 [**Bernardxu123**](https://github.com/Bernardxu123) 设计的项目 logo和开场视频。
-
-<p align="center">
-  <a href="https://github.com/esengine/DeepSeek-Reasonix/graphs/contributors">
-    <img src="https://contrib.rocks/image?repo=esengine/DeepSeek-Reasonix&max=100&columns=12" alt="esengine/DeepSeek-Reasonix 贡献者" width="860"/>
-  </a>
-</p>
-
-<br/>
-
---
-
-<p align="center">
-  <sub>MIT —— 见 <a href="./LICENSE">LICENSE</a></sub>
-  <br/>
-  <sub>由 <a href="https://github.com/esengine/DeepSeek-Reasonix/graphs/contributors">esengine/DeepSeek-Reasonix</a> 社区共建</sub>
-</p>
-
---
-
-<p align="center"><sub><strong>支持本项目</strong></sub></p>
-
-如果 Reasonix 帮你省了时间或 token，欢迎请杯咖啡。捐助不会换来 feature
-优先级，也不会影响 issue 的处理顺序——就是「谢谢」。
-
- **国内** — 微信支付 / 支付宝（扫下方二维码）
- **海外** — PayPal: [paypal.me/yuhuahui](https://paypal.me/yuhuahui)
-
-<p align="center">
-  <img src=".github/sponsor/wechat-pay.jpg" alt="微信支付收款码" width="180"/>
-  <img src=".github/sponsor/alipay.jpg" alt="支付宝收款码" width="180"/>
-</p>
@@ -1,480 +0,0 @@
-# Reasonix project memory
-
-This file is loaded into every session's system prompt (the cache-stable prefix),
-so keep it concise and durable — it is the project's standing instructions to the
-agent. It is the Reasonix analog of Claude Code's CLAUDE.md.
-
-## Conventions
-
- Go kernel under `internal/`; each package owns one concern. A package's long
-  explanation belongs in its `doc.go`, not spread across implementation files.
- One transport-agnostic `control.Controller` sits behind every frontend (chat
-  TUI, HTTP/SSE serve, Electron desktop). Add behavior to the controller, not a
-  frontend, so all three inherit it.
- Layering (enforced): utility packages import nothing under `reasonix/` except
-  one another — that layer is closed, so a leaf reaching a leaf drags no graph
-  along, while refusing it leaves one judgement copied into several of them; only
-  the frontends `cli`, `serve`, `acp`, `boot` and the hosts `cmd/`, `desktop/`
-  may import `control`; nothing below a frontend may import one. The declared
-  sets live in `tools/repolint/layers.go`.
- Subagent delegation keeps five concepts apart: a profile says how a worker
-  thinks, `TaskSpec` what this call wants, `CapabilityGrant` what it may touch,
-  `ContextRequest` what it starts from, `SchedulerPolicy` when it runs. Put a
-  field in whichever member decides its value — profiles carry ceilings, never
-  per-call values. `internal/runtime/delegation/profile_boundary_test.go` enforces it.
- Cache-first: the system-prompt prefix (base prompt, tools, declared prefix
-  configuration) must stay byte-stable across turns so DeepSeek's automatic
-  prefix cache stays warm. Never mutate it mid-session — ride the turn tail
-  instead (see `control.Compose`), under the rules in *Context projection*.
- Performance features land with an effect test at their final boundary
-  (`internal/assembly/boot/effect_test.go` pattern): assert what actually reaches the
-  provider request, frontend sink, or trajectory through the real `boot.Build`
-  assembly. Component correctness is not system effectiveness.
- A mutex- or atomic-guarded struct is ratcheted on its **scalar** field count
-  (`struct-state`), not its total: independent flags multiply into states no
-  type records as legal. Fixing a boundary case by adding one more `bool` is
-  the move this blocks — group by lifetime into a named sub-state instead
-  (`agent.perTurnState` is the pattern), which costs one field and removes the
-  whole product.
- The context window (projection, compaction, estimation) owns `windowState`;
-  the loop reaches it via `a.window()`, it reaches the loop via `windowHost`.
-  `window-state` fails any other read of `sess.win`.
- Judgements read structure, never wording: shell ASTs (`shellparse`), types,
-  contracts, tool schemas. Phrase tables and message sniffing have been retired
-  in batches (task-policy prose, the planner's approval phrases, the executor
-  handoff tables) because each one misfires on real input, and a misfiring
-  judgement inside a gate is worse than no gate. Security allow-lists are the
-  exception and stay. Something that can only be built by matching words does
-  not get built — say what is missing instead of guessing at it.
- The other half of that rule: an error a caller must tell apart **carries an
-  identity** — a sentinel, a typed code — never a sentence. Only the producer
-  knows a deadline expired rather than a socket closed, and a message is where
-  that knowledge goes to die: the reader is left matching words, or with
-  nothing. Across HTTP the identity is a dotted code through `refuse`;
-  `refusal-path` fails a new `http.Error` in `internal/frontend/serve`, and the parity
-  test fails a code the frontend cannot say. Inside Go it is `errors.Is` on a
-  sentinel the wrapping preserves; `error-text` fails a new match against an
-  error message, following it one hop into a local because storing the text
-  first is what the direct form turns into.
- **Whoever first knows why an operation failed owns its class.** A transport
-  status is not a domain identity, and a display string is not a classification;
-  past that boundary a layer may project the class, never re-derive it. Both
-  directions were live: `catalog.go` answered 400 for a name nobody declared and
-  for a disk that would not write, so a failed store told the user their request
-  was wrong; `ServerRow` decided a connection was an authorisation problem by
-  matching `/401|403|unauthorized/` against prose an external MCP server wrote,
-  which the host had sanitised and truncated on the way through. Domain,
-  internal and dependency are three answers with three different things to do
-  next, and a caller that cannot tell them apart reports the last two as the
-  first.
- Failure attribution is host-owned state. When the host can determine why an
-  operation failed or stopped — truncation, timeout, unavailable context,
-  dependency skipping, policy refusal, output spill, argument parsing — that
-  cause goes to the model. Surfacing only the downstream symptom leaves it to
-  invent one, and the invented rule outlives the incident: a response cut at the
-  output limit reaches the model as "invalid arguments", and the session learns
-  to stop batching calls that were never the problem.
- A host-owned identity has to cross the model-visible boundary. Stable step
-  ids, typed error codes, boundary causes — anything the host expects the model
-  to cite must appear wherever that state is rendered for it. Telling the model
-  in a schema to prefer X while every concrete rendering shows only Y trains it
-  to use Y; `complete_step` said `step_id` PREFERRED while all four todo
-  renderers printed bare ordinals. Canonical dynamic state still stays out of
-  the cache-stable prefix — project the identities needed to act on it at the
-  turn tail.
- A metric is its definition, not its name. Before a number becomes a finding,
-  state what it counts, from which anchor, over which population, and what it
-  excludes. Three readings in one study died in that gap: a command of unknown
-  extent read as a proven write, the latest report's adjudication read as every
-  report's, and a syntactically accepted call read as a closed one. Each time a
-  convenient proxy had been left standing in for the state it was named after,
-  and each time the mechanism story built on it was wrong. A number without
-  those four lines is an observation, not a result.
- A constructed state is not a reachable one. Before a destructive test or a
-  counterfactual is reported as a defect, say who in production produces that
-  state, through which transitions, across which persistence boundary, under
-  whose authority, and whether a real run has been seen reaching it. A test that
-  assigns a private field proves the mechanism *given* the state and must be
-  reported as exactly that: `a.projectChecks` is written once at boot and never
-  again, so reassigning it stood in for a resume rather than demonstrating one,
-  and the bypass built on it was never shown to be production-reachable.
-  Severity is reachability times frequency times authority, not "can be
-  bypassed".
- A wire type the desktop re-declares by hand is held to the kernel's by
-  `wire-parity`, both directions: a field one side sends and the other cannot
-  read fails, and so does one it reads that nothing sends. The two are compiled
-  by different toolchains and meet only over JSON, so nothing else in the tree
-  notices when one of them grows a field. The pairs are declared in
-  `tools/repolint/wireparity.go`, never inferred — no spelling tells a mirrored
-  contract from a struct that merely carries json tags.
- "Add behavior to the controller so every frontend inherits it" is held by
-  `frontend-parity`: a capability one frontend already drives, a frontend whose
-  declared port carries it, and no call, is a missing edge, and the ratchet
-  counts edges. Which port each frontend drives is declared in
-  `tools/repolint/frontendparity.go`; a deliberate exception goes in the scope
-  table there with an issue and a reason, and costs what the edge cost, so the
-  table cannot become where debt disappears. The matrix is read from
-  `go/types` at one pinned build target, never from selector names — `Close`
-  and `Status` are capabilities and also stdlib methods, and a name match
-  records `os.File.Close` as a frontend driving `Lifecycle.Close`, a false
-  "wired" that hides real debt. How a verb is spelled — `/branch`,
-  `POST /branches` — is presentation and stays out of it.
- The desktop's presentation layer answers to canonical state and never
-  redefines it. Six rules, each held by a gate rather than by memory:
-  presentation reorders and reweights what the kernel owns but never restates
-  it; **mount is not a motion cause** — a fact enters once, and replay or
-  virtualization bringing its element back is not that fact happening again;
-  a search alias buys discoverability and never becomes a thing's identity;
-  when a setting takes effect is declared per block, from what its endpoint
-  does, never inferred from wording or handler names; ordering panels by
-  lifecycle moves them and must not remount them; and a control's identity
-  survives a change of where it is drawn — the settings sheet and the composer
-  render `chrome.preset` because that is one intent, not two.
-
-## Comments
-
-Default is none — the code is the truth. Write one only when the **why** is
-non-obvious: a hidden constraint, a workaround anchored to something verifiable,
-an invariant the type system cannot express, or an external-protocol quirk.
-
-A comment states the constraint that holds now. It does not narrate how the code
-got here: a reader who has never seen an earlier version must lose nothing, and
-past tense about this code's own behaviour is the tell — an external protocol's
-history is not. "Ids alone do not answer it" is the rule; "ids alone were the
-wrong question, so the list went on reading as the model wrote it" is the
-incident behind the rule, and the incident belongs in the commit message. This
-outranks the surrounding style: much of the tree reads as prose and none of it
-is the standard. No gate reads register — telling narrative from a statement of
-constraint needs a phrase table, which is the one thing this repo does not
-build — so this rule is held by review.
-
- **Stylesheets carry none.** A rule's selector and its declarations are the
-  whole statement. What a `.css` comment would have said goes to whichever of
-  two places can act on it: a constraint a component has to honour belongs in
-  that component, and a decision about the medium itself — a measured colour, a
-  layout mechanic, why the obvious rule is the wrong one — belongs in the
-  stylesheet's companion document (`src/styles/TOKENS.md`, `LAYOUT.md`), which
-  is read end to end rather than met 600 times as an aside.
- **English, always** — every comment, in every other language the tree is
-  written in. A codebase whose commentary is half one language reads as two
-  codebases, and the half a given reader cannot read is the half that rots.
- Declaration doc: ≤5 lines. Package comment: ≤8 lines, or ≤40 in a `doc.go`.
- Every other comment: ≤3 lines. Struct-field and trailing `//`: 1 line.
- Never: restatements of the code, phase/stage narrative, incident or
-  conversation history, section banners, commented-out code, `@param` lists.
- `TODO(#nnn):` and `HACK(#nnn):` need the issue anchor. `FIXME` is banned.
- One responsibility per file; 800 lines is the ceiling. Test files are exempt:
-  their length tracks how many cases they cover, not how many concerns they
-  carry, so splitting one only scatters a subject's table across files.
-
-`go run ./tools/repolint` enforces the budgets above against a ratchet baseline:
-recorded debt is tolerated, anything new fails CI. Never widen the baseline to
-land a change — fix the code. `-update` lowers budgets freely and refuses to
-raise one without `-allow-widen`, so carrying debt through a rename or an
-extraction is asked for in the command and justified in the PR. A clean run also
-reports budget the tree stopped using: it is only reclaimed by an `-update`, and
-until then it is room a file can grow back into.
-
-## Context projection
-
-Canonical dynamic state — the skill registry, the memory store — lives in its own
-owner, and what the model sees is a projection of it onto each request. The
-prefix was never where these belonged wrongly; freshness ownership was missing.
-
- **Prefix ownership.** Only declared prefix configuration may move the
-  cache-stable prefix; ordinary memory writes, skill writes and runtime facts
-  ride the turn. Pinned memory bodies are the one declared exception, because
-  pinning is a request to pay one cold start.
- **Projection freshness.** When canonical state changes, the next eligible turn
-  carries the new projection or can say why it is not owed. "Right after a fold,
-  or in the next session" is not an answer.
- **Projection ownership.** Whoever owns a dynamic fact owns the invalidation
-  that makes its projection owed again. A projection kept fresh because every
-  writer remembered to announce itself is one forgotten call from stale —
-  `skillSet.owedCatalog` asks the registry rather than waiting to be told.
- **Determinism.** The same canonical state and the same projection state
-  produce byte-identical model-visible bytes.
- **Detection is semantic.** Freshness may not rest on writer notification, on
-  mtime, or on which call path made the change. The registry answers from
-  canonical state, so a switch flipped and a file edited past every API are the
-  same question, and a change no projection renders is not a change.
-
-`internal/assembly/boot/context_projection_test.go` holds all five at the provider
-boundary, with the skills listing and the standing instructions as the two
-worked examples. A block is settled only once the turn carrying it reaches the
-runner: a turn blocked by a hook or refused by an extension after composing put
-those bytes nowhere, and clearing the debt there would leave the model holding
-state nobody sent it. A projection that has become empty is still owed once —
-otherwise the block the model already has goes on reading as current.
-
-## Memory
-
- Standing instructions are hierarchical: committed/shared `REASONIX.md`,
-  `AGENTS.md`, and `CLAUDE.md`; personal `*.local.md` variants; matching files in
-  ancestor directories; and user-global files under the memory state root
-  (`REASONIX_STATE_HOME`, otherwise `REASONIX_HOME`, otherwise `~/.reasonix` on
-  macOS/Linux or `%APPDATA%\reasonix` on Windows). All distinct supported files
-  in a directory load; `AGENTS.md` is not merely a fallback.
- `@path` on its own line imports another file's contents.
- `#<note>` in chat quick-adds an always-on instruction. The `remember` tool
-  instead saves a fallible background fact (frontmatter file + `MEMORY.md`
-  index). Fact `type` classifies content; independent `scope` controls whether it
-  is project-only (the default) or explicitly global.
- The saved-fact index stays out of the stable prefix and is reached through the
-  `memory` tool; pinned bodies and global user/feedback bodies load into it, the
-  latter as lower-priority compatibility guidance. The current turn receives a
-  tail note.
-
-## Notes
-
-One tool call costs one model round trip, so calls that do not depend on each
-other belong in the same round: several reads, edits to different files, a check
-after the edit that enables it. Several edits to the *same* file are one
-`multi_edit` — it applies them against each other in memory and rewrites the
-file only if all of them land, so a failure midway leaves nothing half-edited.
-
-## Vendor rates
-
-Official list prices live in one place: `officialRates` in
-`internal/contract/pricing/rates.go`, oldest generation first, the last being what a
-model charges today. A price change is an **append, never an edit** — the
-superseded rate is what lets an installed config be recognised as holding one
-of ours and brought forward, instead of quoting a retired rate for the rest of
-its life. `config` reads these through `pricing.CurrentRate` and
-`SupersededRates` and restates none of them; a table written twice is one that
-drifts, which is how a vendor's USD rate ended up published on one side only.
-
-`make pricecheck` reads each vendor's own page and compares it against that
-table, and reports how long ago a person last confirmed each one. It reaches
-the network, so it stays out of `make lint` and out of CI: run it before
-touching a rate and when a vendor announces a change. A page it cannot read
-exits non-zero — unread is its own verdict and never counts as agreement.
-
-## Curated presets
-
-A preset changing shape reaches the installs that already have the old one
-through `shippedPresets` in `internal/contract/config/preset_upgrade.go`: one declared
-shape per generation, and one upgrade that brings a matching entry forward. The
-guard is the whole shape — catalog, window, default — because an entry holding
-what we shipped is ours to move and anything else its user curated.
-
-A preset is also what settles which of its models read images. Probing an
-address a preset covers answers from that declaration, because reading a name
-misses every Kimi, Qwen, MiniMax and Claude model they declare and `deepseek-
-flash` spells nothing at all; the spelling is the last resort for an address
-nothing has declared, and stays a correctable suggestion rather than a claim.
-
-Three distinctions are load-bearing, and each was a separate migration function
-before they were written down. A window the shape did not name is the user's,
-so only a shape identified by its window moves one. `vision_models` **narrows**,
-so an upgrade marks only the models it adds and only where the preset says they
-read images. And an explicitly empty list is a choice — nothing here reads
-images — which is not the same as the nil that means nobody has said.
-
-## Pre-push CI simulation
-
-Run these **before every commit** to catch the fastest CI failures locally:
-
-```bash
-gofmt -w .                          # catches gofmt (saves ~13s CI)
-go vet ./...                        # catches vet warnings (saves ~52s CI/lint)
-make lint                           # golangci-lint at CI's pin + repolint
-go test ./internal/tools/builtin/ ./internal/assembly/boot/  # catches tool/boot test breaks
-```
-
-`make lint` runs both gates CI runs, at the version in `.golangci-version`;
-`make lint-install` installs it. Do not skip it: a `modernize` finding never
-shows up in `go vet`, and the CI round trip that catches it instead costs ten
-minutes.
-
-A full repolint run reports every file over budget, including debt your change
-never touched. To see only what your own edits owe:
-
-```bash
-make check
-```
-
-Repo-wide ceilings still report under a narrowed run, because a file can push
-the tree past one without exceeding its own budget.
-
-`make check` owns the evidence-bearing changed-file universe — everything the
-worktree altered *and* everything it added that git has not been told about.
-Never substitute a direct `go run ./tools/repolint` invocation for it when
-recording verification evidence: the host recognizes a `make` target as a check
-whose result it can read, while an arbitrary `go run ./tools/...` is a program
-it has to assume writes, and the flags behind the target are its implementation
-rather than the contract. Building that universe from `git diff` alone once let
-a new file reach the gate unopened and be reported clean.
-
-## Import cycle rule
-
-Before importing a new internal package from a non-test file, verify the target package's **test files** aren't already importing back to you:
-
-```
-# BAD: agent(_test.go) → tool/builtin(sessions.go) → agent  → setup failed
-```
-
-Use `go test ./path/to/target/` to detect cycles **before** pushing. A `[setup failed]` message means a cycle exists.
-
-## PR hygiene
-
- **One force-push per round of review feedback.** Multiple force-pushes destroy review history and confuse reviewers.
- **Keep the PR diff minimal.** Only the files relevant to the PR's purpose — no stray changes from other branches.
- **Amend, don't add commits, for review feedback** — keeps the commit history clean.
-
-## Change discipline
-
-**Assess before editing.** For every change, humans and agents list callers,
-consumers of the same state, sibling features, reload/replay/restart paths,
-error and edge states, TUI/CLI and desktop equivalents, and wire mirrors.
-
-A fix that breaks a neighbouring behaviour is a failed fix.
-
-**Test the neighbourhood.** UI changes add or extend interaction tests for
-adjacent functions of the same component or flow (composer: submit, clear,
-queue, withdraw, restore, steer, failure, replay after reload) and run the whole
-affected suite.
-
-Write tests first; they must fail without the change.
-
-**Fix at the owning layer.** Use the existing unified pattern: no special-case
-flags, duplicated paths, or workarounds at the symptom site.
-
-If the design is duplicated or wrong, make the smallest unifying change:
-one path instead of two, deleting what becomes dead. Use current language and
-framework idioms; do not add a new pattern where one exists.
-
-**PR evidence.** Every PR description carries: Cause, Blast radius,
-Neighbouring behaviours tested, and Why this layer.
-
-## Reasonix host checks
-
-The paths below decide what the agent is allowed to do — a wrong change here
-is not a bug in a feature, it is a hole in a boundary. Declaring them makes
-every change under them demand `review` plus `security_review` before a turn
-can finish. Sensitivity is declared, never inferred: the host does not read it
-out of how a path is spelled, which cannot tell `internal/auth` from
-`session_write_authority.go`, or a trace file from a data race.
-
- sensitive: internal/safety/permission/**
- sensitive: internal/safety/sandbox/**
- sensitive: internal/safety/shellsafe/**
- sensitive: internal/base/shellparse/**
- sensitive: internal/session/control/approval.go
- sensitive: internal/session/control/approval_bridge.go
- sensitive: internal/session/control/approval_orchestration.go
- sensitive: internal/model/providerbroker/**
- sensitive: internal/ext/installsource/**
- sensitive: internal/ext/plugin/**
- sensitive: internal/ext/pluginpkg/**
- sensitive: internal/base/netclient/**
- sensitive: internal/safety/redirectguard/**
- sensitive: internal/safety/endpointclient/**
- sensitive: internal/safety/egress/**
- sensitive: internal/platform/browser/**
- sensitive: internal/platform/computer/**
- sensitive: internal/platform/gitpush/**
- sensitive: internal/session/control/git_push.go
- sensitive: internal/frontend/serve/git_push.go
- sensitive: internal/frontend/serve/host_routes.go
-
-One declaration, two effects: the same list is also the coverage gate's subject.
-`make coverage-gate` holds each path to the coverage it already has, because
-when this was written these paths sat *below* the tree's median rather than
-above it — the code deciding what the agent may execute was its least-tested
-part. Floors ratchet like repolint's budgets: raising one is free, lowering one
-needs `-allow-drop` and a reason in the PR. Adding a `sensitive:` path gets both
-effects; there is no second list to keep in sync.
-
-## Trust domain
-
-Three sets, kept apart because conflating them turns a performance number into a
-security claim: **VerificationRelevant** (state that can change whether a
-delivery claim holds), **Observable** (state the host can reconcile after an
-action, so it can say what that action did), **HostProtected** (state a
-capability/sandbox boundary makes unwritable). The invariant is
-`Writable ∩ VerificationRelevant ⊆ Observable ∪ HostProtected`:
-
-> Any state that can both be modified by an action and influence the delivery
-> claim must either be observable by the host or protected from modification by
-> host-enforced boundaries. An incomplete observation never establishes scope.
-
-Effects and state answer different questions and never stand in for each other —
-observation proves what an action did, verification proves what the resulting
-state satisfies — which is why `unproven_mutation` is settled only by
-observation, never by a check that ran afterwards.
-
-What follows bounds Observable today. It is not a restatement of the invariant:
-moving a number here must not move the promise.
-
- `scanWorkspace` walks the workspace and every granted extra root recursively,
-  skips VCS store dirs, and is `complete` only below 50k files in total. Over that, or past a walk error, it
-  establishes nothing and the mutation stays unproven.
- Symlinks are recorded by `Lstat`, so a write through one lands outside what
-  the walk compares. Confining the resolved target is the sandbox's job.
- `internal/safety/sandbox` confines writes to the workspace, configured extras, temp
-  and toolchain caches on macOS and Linux.
- On Windows a user-enabled write-restricted token bounds the *creation* of files
-  (create, append, overwrite, `mkdir`, HKCU writes, global git config, writes through links).
- There, deleting or renaming away an existing file is not bounded, and with the
-  setting off nothing the host enforces bounds `Writable`.
- The caches a command may write can be poisoned for the user's later unsandboxed
-  builds, on every platform.
- The governed host authorities are a *named* set — ssh-agent, docker, podman.
-  DBus, Wayland, X11, gpg-agent, keyrings and arbitrary sockets stay reachable,
-  so the claim is "these endpoints are governed", never "host IPC is isolated".
-
-`stateEpoch` tracks host-observed mutations, not an exact filesystem snapshot;
-unobserved external writers are a gap shared by the whole verification model. Go
-baseline test criteria use the toolchain's build overlay and therefore share
-ordinary verification's epoch semantics; the overlay is not a general filesystem
-view.
-
-A captured criterion may be superseded only by authority outside
-execution-mutable state; the current workspace, its tests, and the agent itself
-cannot authorize supersession.
-
-Two gaps follow and are open, not decided: a build that reads `.git` makes VCS
-state VerificationRelevant while the scan skips it, and on Windows a symlink out
-of the workspace is neither observed nor protected. Closing either means
-widening observation or narrowing writability — never widening what a check is
-taken to prove.
-
-## Sandbox dimensions
-
-`HostProtected` above is the delivery-level abstraction. Sandbox policy refines
-it into three independent protection dimensions. Their separation is empirical:
-measured bypasses showed that protection on one dimension cannot be assumed to
-imply protection on another.
-
- **Integrity** — what host state may be mutated. Expressed by write roots.
- **Confidentiality** — what host information may be observed. Expressed by
-  `ForbidReadRoots`.
- **Authority** — what host capabilities may be exercised *without* possessing
-  their secrets. Expressed by `HostAuthorities`.
-
-`ReadOnly` is therefore an Integrity property only; it makes no Confidentiality
-or Authority claim.
-
-Network transport and host authority are independent even when a backend
-primitive conflates them: on macOS, `(deny network*)` also cut ssh-agent, so one
-flag could not express "no internet, still sign".
-
-Filesystem visibility is not authority: denying `file-read*` on a socket did not
-stop a connect. Possession is not authority: the key can be unreadable while an
-agent still signs with it.
-
-A protection claim exists only where a backend has a demonstrated enforcement
-primitive for that dimension. Unsupported dimensions stay explicitly unsupported,
-because a claim that outruns its enforcement is worse than an absent one: it is
-believed.
-
-Windows enforces Integrity on file creation only, when the user turns it on.
-Deletion and rename, Confidentiality and Authority (the named pipes of ssh-agent
-and docker, COM and RPC services) are not enforced there.
-
-**Known unmeasured surface — macOS host-mediated delegation:** Apple Events and
-Mach-service lookup are not denied by the current allow-default profile. Prior
-`osascript` and `launchctl submit` probes were inconclusive; no delegation
-effect has been demonstrated. This surface is outside the currently governed
-host-authority endpoint set.
@@ -1,188 +0,0 @@
-# Security Policy
-
-## Supported Versions
-
-Reasonix security fixes are prioritized for the currently developed Go rewrite
-and the current 1.x release line.
-
-| Version or branch | Security support |
-| --- | --- |
-| `main-v2` / 1.x releases | Supported |
-| `v1` / 0.x legacy branch | Critical fixes only, where practical |
-| Older releases, forks, or modified builds | Not covered unless the issue is reproducible upstream |
-
-If you are unsure whether a version is affected, report against the newest
-released 1.x version and include the exact version or commit you tested.
-
-## Reporting a Vulnerability
-
-Please report security issues privately. Do not open a public issue with exploit
-details, secrets, crash dumps, or proof-of-concept payloads.
-
-Preferred reporting path:
-
-1. Use GitHub private vulnerability reporting for this repository, if available.
-2. If private reporting is not available to you, open a minimal public issue
-   asking for a private maintainer contact path. Do not include exploit details
-   in that issue.
-
-Please include:
-
- Affected Reasonix version, commit, operating system, and installation method.
- The feature or surface involved, such as CLI, desktop app, HTTP `serve`, bot
-  gateway, MCP plugin, built-in tool, updater, or configuration loading.
- Clear reproduction steps using dummy credentials and non-sensitive files.
- The expected impact, such as secret disclosure, arbitrary file access,
-  command execution, sandbox escape, authentication bypass, or supply-chain risk.
- Any relevant logs with API keys, tokens, local paths, and personal data
-  redacted.
-
-Do not send real provider API keys, bot credentials, OAuth tokens, private
-workspace files, or third-party user data.
-
-## Security Boundaries
-
-Reasonix is a local coding agent. Many features intentionally operate on the
-user's local machine and workspace, including file reads, file writes, shell
-commands, MCP plugins, language servers, bot sessions, and model-provider
-requests. A finding is security-relevant when it crosses a supported boundary or
-bypasses an explicit guard.
-
-Supported boundaries include:
-
- Workspace confinement for file operations that are documented or implemented
-  as workspace-scoped.
- Permission checks for tool calls, shell commands, file writes, and approvals.
- Sandbox behavior for built-in shell execution where the platform supports it.
- Secret handling for provider keys, bot credentials, OAuth tokens, plugin
-  headers, and credential-store fallback files.
- HTTP `serve` protections, including the default per-launch token, the launch
-  token every state-changing request requires when authentication is opted
-  out, localhost binding assumptions, JSON-only state-changing requests, and
-  CORS restrictions.
- Desktop and bot session isolation, including per-workspace session metadata
-  and configured bot allowlists.
- Updater, install, and release verification paths.
-
-The following are normally treated as trusted local/operator-controlled inputs
-unless another bug lets an untrusted actor supply them:
-
- CLI arguments and text typed directly by the local user.
- The user's own configuration under the Reasonix home directory.
- Explicit `@path` references supplied by the local user to attach local files.
- MCP servers, language servers, hooks, and slash commands installed, enabled,
-  or approved by the local user.
- Provider base URLs and model names configured by the local user.
-
-The following can be security issues when reachable by an untrusted actor or
-when they bypass the intended boundary:
-
- Reading or writing files outside the configured workspace without explicit
-  local-user intent.
- Following symlinks or path traversal to escape workspace confinement.
- Running shell commands or external tools without the required permission gate.
- Leaking credentials, environment variables, prompt history, local files, or bot
-  messages to logs, model providers, MCP servers, crash reports, or telemetry.
- Allowing a website to drive the local HTTP server through CSRF, CORS, or
-  content-type bypasses.
- Letting a bot user outside the configured allowlist submit prompts, approve
-  tools, or access a project workspace.
- Trusting unverified update artifacts, plugin definitions, or downloaded
-  binaries.
-
-## Project Configuration
-
-Files that arrive with a workspace are untrusted input: `reasonix.toml`,
-`.reasonix/settings.json`, `.mcp.json` and the project `.env`. Cloning a
-repository is not a decision to trust its author, so these files may narrow
-what the user configured and never widen it.
-
-| Setting | What a workspace file may do |
-| --- | --- |
-| `sandbox.bash` | Move `off` to `enforce`, never back |
-| `sandbox.network` | Move `true` to `false`, never back |
-| `sandbox.forbid_read`, `sandbox.denied_domains` | Add to the user's lists |
-| `sandbox.allow_write`, `sandbox.workspace_root` | Apply only when they resolve inside the workspace, symlinks followed; `${VAR}` in any sandbox path expands from the process environment only |
-| `sandbox.host_authorities`, a user's `sandbox.allowed_domains` | Nothing |
-| `permissions.deny`, `permissions.ask` | Add to the user's rules |
-| `permissions.mode`, `permissions.allow`, `permissions.allow_dynamic_bash` | Nothing |
-| `desktop.default_tool_approval_mode` | Nothing |
-| `[network]` proxy settings | Nothing |
-| `[[providers]]`, `tools.system_one` endpoints | Declare them; they stay out of use until approved, and model settings naming them fall back to the user's |
-
-An "always allow" answer, or extra write access, granted in a workspace is
-stored under the Reasonix home, not in the workspace.
-
-Programs a workspace names for the host to run stay off until the user
-approves them for that workspace:
-
- Hooks, language server commands, `tools.search.rg_path`,
-  `tools.shell.path`, `[browser]` and `tools.system_one.laya.python` are
-  approved with `reasonix trust`, or for hooks by saving them from the hooks
-  editor.
- An approval is stored under the Reasonix home with a digest of the
-  declaration and of the workspace files it names; any change needs approval
-  again. Approvals and grants belong to one workspace folder.
- Hooks and language servers are checked against their approval again before
-  each start, and refused if a file they name changed, appeared or now
-  resolves elsewhere.
- A single program path (`tools.shell.path`, `tools.search.rg_path`,
-  `[browser]`, `laya.python`) may not point into the workspace, an
-  `allow_write` root, a temporary directory or a toolchain cache the bash jail
-  leaves writable, and may not climb with `..`; its approval covers the
-  program file's content.
- `tools.system_one.laya.local` is read from the user's configuration only.
- Without an interactive frontend they stay off.
- MCP servers a workspace declares stay off until the user enables them for
-  that workspace.
-
-A project value that is not applied is reported as a load warning with the
-reason. A way for workspace files to widen any of the above without the
-user's approval is a security issue.
-
-## `@` File References
-
-Reasonix supports `@path` references so users can include local files and images
-in a prompt. This is intentional local functionality, but implementations must
-preserve these invariants:
-
- In workspace-scoped sessions, relative and absolute paths must resolve under
-  the active workspace root before file content is read or attached.
- Path traversal such as `..` must not escape the workspace root.
- Symlinks must not be usable to bypass the intended workspace boundary.
- Unscoped local CLI compatibility must not be exposed to remote, bot, or
-  browser-controlled inputs unless an equivalent workspace boundary is applied.
- File content should be size-limited and binary content should not be dumped as
-  prompt text.
-
-Static analysis alerts about path expressions should be triaged against these
-rules: user-controlled path data is expected, but the access must either stay
-inside the configured workspace or be clearly limited to trusted local CLI use.
-
-## Out of Scope
-
-The following reports are usually out of scope unless they demonstrate a bypass
-of one of the boundaries above:
-
- A local user intentionally asks Reasonix to read, edit, or send their own
-  files to a configured model provider.
- A local user installs or enables a malicious MCP server, hook, slash command,
-  language server, or shell command and then grants it permission.
- A configured model provider, proxy, or MCP server receives data the user
-  intentionally sent to it.
- Denial-of-service issues that only affect the local user's own session and do
-  not corrupt files, leak secrets, or bypass permissions.
- Issues requiring administrator/root access on the user's machine before
-  interacting with Reasonix.
- Vulnerabilities in third-party services, models, proxies, or plugins that are
-  not caused by Reasonix behavior.
-
-## Coordinated Disclosure
-
-This is a community-maintained project. Maintainers will make a best-effort
-assessment, ask follow-up questions when needed, and coordinate fixes before
-public disclosure for confirmed vulnerabilities.
-
-Please give maintainers reasonable time to investigate and release a fix before
-publishing exploit details. If you plan to disclose on a timeline, include that
-timeline in your initial report.
@@ -1,22 +0,0 @@
-# Build output and local tooling state.
-build/
-.gradle/
-.kotlin/
-local.properties
-*.iml
-.idea/
-
-# The signing key and the file that names it.
-#
-# A key is not part of the project: it is the identity one person ships under,
-# and publishing it would let anyone else sign an APK that installs over
-# everyone's. Neither the keystore nor its password belongs in version control.
-# `app/build.gradle` reads both from here when present and falls back to the
-# debug key when they are not, so a fresh clone builds without them.
-keystore/
-
-# Build inputs, produced by scripts/ before Gradle runs.
-# jniLibs/ holds the cross-compiled kernel, assets/page/ the built
-# frontend. assets/LICENSE is hand-placed and stays tracked.
-app/src/main/jniLibs/
-app/src/main/assets/page/
@@ -1,216 +0,0 @@
---
-owner: @esengine
-backup: @SivanCola
-status: active
-reviewed: 2026-10-20
---
-
-# Reasonix Mobile — the Android shell
-
-Runs Reasonix as an Android app: the kernel ships inside the APK and starts on the
-device, the interface is the same `desktop/frontend-next` build the desktop Studio
-serves, and the agent reaches servers over SSH.
-
-This file is for people building it. What a person installing it needs — what it
-does, how to pair with a computer, what it cannot do — belongs in the release
-notes.
-
-## One command
-
-```bash
-./scripts/build.sh release     # or debug
-```
-
-Three steps, in this order:
-
-1. `build-kernel.sh` → `app/src/main/jniLibs/arm64-v8a/libreasonix.so`
-2. `sync-page.sh` → `app/src/main/assets/page/`
-3. `./gradlew assembleRelease`
-
-Output: `app/build/outputs/apk/release/app-release.apk`
-
-The kernel and the page are **inputs to packaging, not Gradle build steps**.
-Running `gradle assembleRelease` on its own fails on purpose and names the script
-that produces whichever input is missing (`requireBuildInputs` in
-`app/build.gradle`): an APK with no kernel in it should not be buildable by
-accident.
-
-## Requirements
-
-| Component | Version |
-| --- | --- |
-| JDK | 21 (17 also works) |
-| Android SDK | `platforms;android-35`, `build-tools;35.0.0`, `platform-tools` |
-| Gradle | the committed wrapper, 8.14.3 (for AGP 8.11.1) |
-| Go | 1.26+ |
-| Node / pnpm | Node 24+ / pnpm 10 |
-
-```bash
-export ANDROID_HOME="$HOME/Android/Sdk"
-export ANDROID_SDK_ROOT="$ANDROID_HOME"
-export JAVA_HOME="/path/to/jdk-21"
-export PATH="$PATH:$(go env GOPATH)/bin"
-```
-
-`ANDROID_HOME` is the one thing nothing sets for you.
-
-## Scripts
-
-| Script | What it does |
-| --- | --- |
-| `build.sh [debug\|release]` | The whole chain |
-| `build-kernel.sh` | Cross-compiles the kernel only (`GOOS=android GOARCH=arm64 CGO_ENABLED=0`) |
-| `sync-page.sh` | Builds the frontend, copies `dist/` into assets, copies `LICENSE` |
-| `verify-page.sh` | **No phone needed**: starts the real kernel against the packaged page |
-| `run.sh [debug\|release]` | `adb install`, launch, follow the log |
-
-`verify-page.sh` is the one to run after a change: it starts the kernel with the
-same arguments `Kernel.kt` uses (`--auth token`, `--token-file`, `--port-file`,
-`-page`) and checks that it binds a port and answers 200. Without a device, that
-is as deep as the chain can be verified.
-
-## Where the code is
-
-| File | Owns |
-| --- | --- |
-| `MainActivity.kt` | The WebView, the back gesture, downloads, external links, renderer restart |
-| `Kernel.kt` | Unpacking the page, starting and stopping the kernel, waiting for the port, health probes, logs, the workspace directory |
-| `KernelService.kt` | The foreground service that keeps a long turn alive |
-| `NativeBridge.kt` | `@JavascriptInterface`: what the page may ask the phone for |
-| `BrowserShellServer.kt` | Loopback HTTP server the kernel's browser tools drive the overlay WebView through |
-| `Downloader.kt` | Writing a kernel-produced file through the system document picker |
-
-The page reaches the shell through `window.reasonixHost` and `ReasonixNative`,
-defined in `desktop/frontend-next/src/port/host.ts` (`AndroidHost`).
-
-**Phone and desktop share one page build.** What differs only on a phone is
-decided at runtime, not by a second set of components. `phoneShell()` in
-`src/port/host.ts` and the `[data-shell="android"]` selector in `mobile.css` both
-read `<html data-shell="android">`, which `index.html` sets before the bundle
-loads.
-
-One attribute feeding both is what keeps style and components from disagreeing
-about what a phone is.
-
-## What the page may ask the phone for
-
-`NativeBridge` is reachable from whatever document the WebView holds, so every
-method that touches the device asks `trusted()` first.
-
-The activity answers by comparing the **main frame's** origin against the
-kernel's and against the one paired computer the person scanned a code for. A
-page that navigated elsewhere is not trusted, even though it may still hold the
-object.
-
-Five methods answer without the check — `version`, `systemTheme`, `safeArea`,
-`setLayerOpen`, `setRunning` — because they report back what the page already
-knows about its own window and grant nothing.
-
-`openInApp(url)` is the pairing decision, not a navigation one: it loads a URL in
-this window only for the origin the scanner just returned, and only once.
-Without that, any page holding the kernel origin could hand itself the bridge.
-
-External links leave through the browser. A non-web scheme is routed to the
-system only for `mailto:` and `tel:`; everything else is dropped, because an
-`intent://` URL can start an arbitrary exported activity with caller-supplied
-extras.
-
-## Permissions, and what they cost
-
-`MANAGE_EXTERNAL_STORAGE` — opening a folder on the phone as a workspace. The
-kernel is a Go binary: it opens real paths with `open(2)`, and SAF hands back a
-`content://` URI it cannot open.
-
-Requested from the folder-picker action, never at launch. Android shows no dialog
-for it and opens system settings instead.
-
-**There is no OS-level sandbox around this kernel.** The PR sets the sandbox to
-off on Android, so confining the agent to the chosen folder is Reasonix's own
-write-root check and nothing else. A shell tool with all-files access can reach
-all shared storage.
-
-`REQUEST_IGNORE_BATTERY_OPTIMIZATIONS` — Doze freezes the app group, which stops
-a turn that is still running. Asked once when a turn actually runs, never at
-launch, and the person can refuse. Refusing costs battery life during long turns
-and nothing else.
-
-**Google Play restricts this permission**: fine for a sideloaded build, a
-store-policy risk if this is ever listed.
-
-`FOREGROUND_SERVICE` / `FOREGROUND_SERVICE_DATA_SYNC` — keeping the kernel alive
-while the screen is off. `dataSync` is capped per 24 hours from Android 15. It is
-the closest honest description of "an agent is working".
-
-`CAMERA` — reading the pairing code a computer shows. Requested when the person
-asks to scan, never at launch. `ScanActivity` is not exported.
-
-`READ_EXTERNAL_STORAGE` / `WRITE_EXTERNAL_STORAGE` — the same folder walk below
-API 33. `maxSdkVersion`-gated; above 33 they are superseded by the permission
-above.
-
-`allowBackup=false` with explicit extraction rules, so a `keystore` or a token in
-app storage never leaves the device in a cloud backup.
-
-## Cleartext HTTP
-
-The kernel serves its page on `127.0.0.1:<port>`, and a paired computer serves
-the same page over its LAN address. Both are plain HTTP.
-
-Neither address can be written into a `network-security-config`: the port is
-chosen at start, the LAN address at scan time, and the format matches literals
-and domains, not subnets.
-
-So the config permits cleartext and the boundary is in the code instead.
-`shouldOverrideUrlLoading` sends every other http(s) origin to the browser, and
-the bridge answers only the kernel and the just-paired computer. A plaintext page
-on the LAN cannot become the document holding the bridge.
-
-## What goes into the APK
-
-| Content | Size | Why it is shaped this way |
-| --- | --- | --- |
-| `lib/arm64-v8a/libreasonix.so` | 45 MB | Go static binary, stripped. It is a `.so` rather than a file in `assets/` because only `nativeLibraryDir` is guaranteed executable — a binary copied to app storage fails on a device whose data partition is mounted `noexec`. |
-| `assets/page/` | 14 MB | The frontend build, including the Inter and Noto Sans SC fonts, `noCompress` |
-| `assets/LICENSE` | 1 KB | The repository's MIT licence, verbatim. MIT requires the notice and the licence text to accompany a binary distribution. |
-
-`assets/LICENSE` is generated by `sync-page.sh` from the repository's root
-`LICENSE`, not committed a second time: a checked-in copy drifts when the root
-file is updated.
-
-It sits in `assets/` rather than `assets/page/` because that directory is removed
-and rebuilt on every build.
-
-A release APK is about 31 MB.
-
-## Building
-
-**The Gradle wrapper is committed**, jar and all. `build.sh` refuses to run
-without `gradlew` rather than generating one from whatever `gradle` is on `PATH`:
-the dependency versions are part of the build.
-
-`gradle-wrapper.properties` pins `distributionSha256Sum`, so a mirror that serves
-a different distribution zip fails verification instead of being unpacked and
-run. Dependency repositories are the official ones only — a mirror belongs in a
-user-level init script.
-
-**Signing.** A release with no key configured comes out **unsigned**
-(`app-release-unsigned.apk`) with a warning. It used to fall back to the debug
-key, which produced an artifact that looked shippable and was signed by a
-per-machine key nobody chose: it could not install over the previous build.
-
-Point the build at a real key by writing `keystore/keystore.properties`
-(`storeFile`, `storePassword`, `keyAlias`, and optionally `keyPassword`) or by
-setting the matching `REASONIX_KEYSTORE*` environment variables. Key material
-stays out of the repository and out of build logs.
-
-Debug builds always use the debug key. Signing a debug build with the release key
-would let anyone who can read the keystore produce a build that installs over the
-shipped one under the same signature.
-
-**Non-ASCII checkout paths.** AGP refuses to build under a path with non-ASCII
-characters on Windows unless `android.overridePathCheck=true` is set. That is a
-property of one machine's disk layout, not of this project, so it is not in the
-repository's `gradle.properties`.
-
-Set it in a user-level `~/.gradle/gradle.properties` or pass
-`-Pandroid.overridePathCheck=true`.
@@ -1,263 +0,0 @@
-// The app module.
-//
-// Two things ship inside the APK and neither is fetched at runtime: the kernel
-// binary, and the built page it serves. Bundling the page is what makes the app
-// work offline and start instantly; bundling the kernel is what lets it run
-// `reasonix serve` on the phone itself, which is the whole point — the agent
-// starts locally and reaches the server over SSH, so the interface, the model
-// catalogue and the credentials all live on the phone.
-//
-// The kernel is placed as `jniLibs/arm64-v8a/libreasonix.so`, not under
-// `assets/`. That is not a trick for its own sake: Android permits executing a
-// file under `nativeLibraryDir` and nothing under `filesDir` has that
-// guarantee, so a binary shipped the ordinary way would have to be copied out
-// and made executable at runtime — which fails outright on a device mounted
-// noexec, and fails confusingly on the ones that are merely unusual. `scripts/
-// build-kernel.sh` writes it there; the name is fixed by the packaging rules.
-plugins {
-    id "com.android.application"
-    id "org.jetbrains.kotlin.android"
-}
-
-// One version, read by the About screen and the update check.
-//
-// A published build takes its version from the tag it was cut for, so the About
-// screen and the update check name that release rather than the number this file
-// was last edited to. Without the property — a local build — the numbers below
-// are the answer.
-def publishedVersion = findProperty("reasonixVersion") as String
-def versionMajor = 2
-def versionMinor = 0
-def versionPatch = 0
-def versionBuild = 1
-if (publishedVersion) {
-    def parsed = publishedVersion =~ /^(\d+)\.(\d+)\.(\d+)/
-    if (!parsed.find()) {
-        throw new GradleException("reasonixVersion must start with MAJOR.MINOR.PATCH, got: ${publishedVersion}")
-    }
-    versionMajor = parsed.group(1) as int
-    versionMinor = parsed.group(2) as int
-    versionPatch = parsed.group(3) as int
-}
-
-// Where the two build inputs are expected. Both are produced from the checkout
-// beside this module, by the scripts named in each message.
-def upstream = rootProject.file("..")
-def pageDir = new File(projectDir, "src/main/assets/page")
-def kernelSo = new File(projectDir, "src/main/jniLibs/arm64-v8a/libreasonix.so")
-
-android {
-    namespace "io.reasonix.mobile.app"
-    compileSdk 35
-
-    defaultConfig {
-        applicationId "io.reasonix.mobile.app"
-        minSdk 26
-        // 35: the API level this app is actually built and tested against.
-        //
-        // It was briefly lowered to 26 while chasing an install failure that
-        // turned out to be a package-name collision with an unrelated app on the
-        // user's phone — the signature error named the wrong cause. Nothing about
-        // the target level ever caused it, so it goes back to the level the code
-        // is really written for.
-        //
-        // One consequence to keep in mind: from 35, Android 15 forces the window
-        // edge-to-edge and ignores a request to lay out inside the safe area. The
-        // window therefore *is* drawn under the status bar and the home indicator,
-        // and the only correct answer is for the page to pad itself — which is
-        // what `MainActivity` feeds real inset values for, since a WebView does
-        // not implement `env(safe-area-inset-*)`.
-        targetSdk 35
-        // versionCode must strictly increase, because Android refuses an update
-        // whose versionCode is not higher. The build digit is a single decimal
-        // place, so the scheme collides once a patch reaches 10: 2.55.10 and
-        // 2.56.0 both come out as 25601. Patch releases above 9 are not expected
-        // on Studio, and widening the digit now would renumber every build, so
-        // the constraint is recorded rather than fixed.
-        versionCode versionMajor * 10000 + versionMinor * 100 + versionPatch * 10 + versionBuild
-        versionName "${versionMajor}.${versionMinor}.${versionPatch}"
-
-        // The kernel is built for arm64 only, so every other ABI would ship an
-        // APK that installs and then cannot start. Naming the one real ABI keeps
-        // the store listing and the installer honest.
-        ndk {
-            abiFilters "arm64-v8a"
-        }
-
-        resourceConfigurations += ["zh", "en"]
-    }
-
-    // Android identifies an app by package name *and* signing key: an APK signed
-    // with a different key is not an update, it is an impostor, and the
-    // installer refuses it with "the signature does not match the installed
-    // app". Gradle's default release key is the debug key in the user's home
-    // directory, which is per-machine, so a build made on a second computer
-    // could never be installed over one made on the first.
-    //
-    // Whoever ships a build therefore pins a key — and that key is theirs, not
-    // the project's. It lives beside the checkout, in `keystore/`, which is
-    // ignored; so does the file naming it. A checkout without either signs with
-    // the debug key instead, which is what a contributor building locally wants
-    // and is what the README tells them to expect. Point the build at a real key
-    // by writing `keystore/keystore.properties` (storeFile, storePassword,
-    // keyAlias) or by setting REASONIX_KEYSTORE / REASONIX_KEYSTORE_PASSWORD /
-    // REASONIX_KEY_ALIAS.
-    def keyProperties = new Properties()
-    def keyPropertiesFile = rootProject.file("keystore/keystore.properties")
-    if (keyPropertiesFile.exists()) {
-        keyPropertiesFile.withInputStream { keyProperties.load(it) }
-    }
-    def keyStorePath = keyProperties.getProperty("storeFile") ?: System.getenv("REASONIX_KEYSTORE")
-    def keyStorePassword = keyProperties.getProperty("storePassword") ?: System.getenv("REASONIX_KEYSTORE_PASSWORD")
-    // The key's own password is a separate fact from the store's. PKCS#12 keystores
-    // almost always use one password for both, so falling back to the store's
-    // password keeps those working — but assuming they are equal is how a keystore
-    // that separates them gets a build failure at signing time, after the work is
-    // done, with an error that does not say which of the two was wrong.
-    def keyPasswordValue = keyProperties.getProperty("keyPassword") ?: System.getenv("REASONIX_KEY_PASSWORD") ?: keyStorePassword
-    def keyAliasName = keyProperties.getProperty("keyAlias") ?: System.getenv("REASONIX_KEY_ALIAS")
-    def haveReleaseKey = keyStorePath && keyStorePassword && keyAliasName &&
-            rootProject.file(keyStorePath).exists()
-
-    signingConfigs {
-        if (haveReleaseKey) {
-            releaseKey {
-                storeFile rootProject.file(keyStorePath)
-                storePassword keyStorePassword
-                keyAlias keyAliasName
-                keyPassword keyPasswordValue
-                // v1 is not optional here. Android 7+ reads v2 and ignores v1, so
-                // a v2-only APK installs on a modern phone — and then fails on the
-                // compatibility layers older devices and HarmonyOS' 卓易通 run,
-                // which know only the JAR signature and report its absence as a
-                // signature *mismatch*. Signing both is what makes one APK install
-                // everywhere.
-                enableV1Signing = true
-                enableV2Signing = true
-                enableV3Signing = true
-            }
-        }
-    }
-
-    // Nothing native is compiled here — the one .so is a prebuilt the kernel
-    // script writes — so the external native build is left alone entirely.
-    buildTypes {
-        debug {
-            applicationIdSuffix ".debug"
-            versionNameSuffix "-debug"
-            // The debug key, always. Signing a debug build with the release key
-            // would mean anyone who can read the release keystore can produce a
-            // build that installs over the shipped one under the same signature,
-            // and it buys nothing: the debug package is suffixed `.debug`, so the
-            // two already install side by side.
-        }
-        release {
-            // The kernel is a stripped Go binary and the page is minified, but
-            // the Kotlin shell still benefits and shipping the shrunk build is
-            // how a size regression gets noticed.
-            minifyEnabled true
-            shrinkResources true
-            proguardFiles getDefaultProguardFile("proguard-android-optimize.txt"), "proguard-rules.pro"
-            // A release with no key of its own comes out *unsigned*
-            // (`app-release-unsigned.apk`). It used to fall back to the debug key
-            // so the artifact would install, which produced a release that looked
-            // shippable and was signed by a per-machine key nobody chose: it could
-            // not be installed over the previous build, and every machine made a
-            // different one. An unsigned artifact says what it is.
-            if (haveReleaseKey) {
-                signingConfig signingConfigs.releaseKey
-            } else {
-                logger.warn(
-                    "release build has no signing key: producing an unsigned APK. " +
-                        "Write keystore/keystore.properties (storeFile, storePassword, keyAlias) " +
-                        "or set REASONIX_KEYSTORE / REASONIX_KEYSTORE_PASSWORD / REASONIX_KEY_ALIAS."
-                )
-            }
-        }
-    }
-
-    compileOptions {
-        sourceCompatibility JavaVersion.VERSION_17
-        targetCompatibility JavaVersion.VERSION_17
-    }
-    kotlinOptions {
-        jvmTarget = "17"
-    }
-
-    buildFeatures {
-        // AGP 8 stops generating BuildConfig unless asked. `Kernel` reads the
-        // version name and code out of it to decide whether the bundled page
-        // needs unpacking, so it is asked for.
-        buildConfig = true
-    }
-
-    packaging {
-        jniLibs {
-            // `extractNativeLibs=true`: the kernel must exist as a real file on
-            // disk to be executed, and an uncompressed-and-mmap'd .so is not
-            // one. This is the only reason the flag is on.
-            useLegacyPackaging true
-        }
-        resources {
-            excludes += ["META-INF/*.version", "META-INF/*.kotlin_module", "kotlin/**", "DebugProbesKt.bin"]
-        }
-    }
-
-    // The page is read out of assets by `Kernel.publish`, not by the resource
-    // system, so it is not compressed — a page is already-compressed text and
-    // shrinking it again only costs startup time.
-    androidResources {
-        noCompress += ["json", "woff2", "ttf", "woff", "txt", "svg"]
-    }
-
-    lint {
-        abortOnError true
-        warningsAsErrors false
-        checkReleaseBuilds true
-    }
-}
-
-dependencies {
-    implementation "androidx.core:core-ktx:1.15.0"
-    implementation "androidx.appcompat:appcompat:1.7.0"
-    implementation "androidx.activity:activity-ktx:1.9.3"
-    implementation "androidx.webkit:webkit:1.12.1"
-    implementation "androidx.lifecycle:lifecycle-runtime-ktx:2.8.7"
-    implementation "org.jetbrains.kotlinx:kotlinx-coroutines-android:1.9.0"
-
-    // Scanning the pairing code a computer shows.
-    //
-    // CameraX for the preview and the frame stream, ZXing for the decode, and
-    // deliberately not ML Kit: this app installs on phones whose HarmonyOS
-    // compatibility layer has no Google Play Services, so a decoder that needs
-    // GMS would work on the developer's phone and fail on the user's. ZXing
-    // core is pure Java with no runtime dependency at all, which is what makes
-    // the scanner work on both.
-    implementation "androidx.camera:camera-core:1.4.1"
-    implementation "androidx.camera:camera-camera2:1.4.1"
-    implementation "androidx.camera:camera-lifecycle:1.4.1"
-    implementation "androidx.camera:camera-view:1.4.1"
-    implementation "com.google.zxing:core:3.5.3"
-}
-
-// Fail before the packaging step with something a person can act on, rather
-// than shipping an APK whose kernel is missing or whose page is a directory the
-// build never filled. The two messages name the script that produces each.
-tasks.register("requireBuildInputs") {
-    doFirst {
-        if (!kernelSo.exists()) {
-            throw new GradleException(
-                "内核二进制缺失：${kernelSo}\n先运行 ./scripts/build-kernel.sh（在 android/ 目录下）交叉编译内核。")
-        }
-        if (!pageDir.exists() || !new File(pageDir, "index.html").exists()) {
-            throw new GradleException(
-                "前端页面缺失：${pageDir}/index.html\n先运行 ./scripts/sync-page.sh（在 android/ 目录下）构建并同步页面。")
-        }
-    }
-}
-
-tasks.configureEach { task ->
-    if (task.name.startsWith("merge") && (task.name.contains("Assets") || task.name.contains("JniLibFolders"))) {
-        task.dependsOn("requireBuildInputs")
-    }
-}
@@ -1,32 +0,0 @@
-# R8 rules for the shell.
-#
-# There is very little to keep here, and that is the point: the app's own code
-# is reached from the manifest and from Android's own callbacks, both of which
-# R8 already traces, and nothing in it is loaded reflectively. What follows is
-# the two places where a name is looked up rather than called.
-
-# The WebView's JavaScript bridge, if one is ever added, is resolved by name on
-# the Java side and by the string the page uses. Keeping annotated members makes
-# that survive shrinking rather than failing at runtime with a method-not-found
-# that only shows up on a release build.
-keepclassmembers class * {
-    @android.webkit.JavascriptInterface <methods>;
-}
-
-# The Kernel's child process is started by absolute path, and its own log is
-# read as text; neither is reflective, so nothing else needs keeping.
-
-# Line numbers make a stack trace from a release build readable, which is the
-# only way a crash report from a phone can be acted on.
-keepattributes SourceFile,LineNumberTable
-renamesourcefileattribute SourceFile
-
-# Kotlin's `@Metadata` annotation is present on every class the compiler touched
-# and nothing in this app reflects over it. It is tempting to `-assumenosideeffects`
-# it away, and that was tried: any pattern broad enough to name its members also
-# matches the methods every class inherits from `Object` — `equals`, `hashCode`,
-# `toString` — and R8 then treats those as removable, which is a silent
-# behaviour change for a few kilobytes. Left as a warning suppression instead:
-# the annotation is dropped from the shrunk output anyway, because nothing reads
-# it.
-dontwarn kotlin.Metadata
@@ -1,112 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!--
-  The shell's manifest.
-
-  There is no INTERNET-adjacent permission beyond INTERNET itself: the page and
-  the kernel talk over loopback, and reaching a server is the kernel's job over
-  a socket it owns. Reading and writing files goes through the system's document
-  picker (SAF), which hands back a grant for one file at a time — so no
-  storage permission is declared and none is needed.
-
-  `usesCleartextTraffic` is off here, and cleartext is re-enabled in the network
-  security config only because the kernel serves its page on `127.0.0.1` and a
-  paired computer serves the same page over its LAN address — both plain HTTP.
-  The config says what that costs and what bounds it.
-->
-<manifest xmlns:android="http://schemas.android.com/apk/res/android"
-    xmlns:tools="http://schemas.android.com/tools">
-
-    <uses-permission android:name="android.permission.INTERNET" />
-    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
-    <!-- Only to tell the person the kernel is still running while the screen is
-         off; it is a foreground service with a dismissible notification, not a
-         background wake-up. -->
-    <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
-    <!-- From API 34 every foreground-service *type* needs its own permission as
-         well as the general one: naming dataSync in the manifest without asking
-         for it is a SecurityException at startForeground, on the one code path
-         that keeps a long task alive. -->
-    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_DATA_SYNC" />
-    <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
-    <!-- Only to read the pairing code a computer shows. Requested at the
-         moment the person asks to scan, never at launch. -->
-    <uses-permission android:name="android.permission.CAMERA" />
-    <!-- The kernel is a child process, and a task left running is one the person
-         expects to finish with the screen off. Android's own doze can freeze the
-         whole app group instead, which is what the shell asks to be exempt from
-         — once, when a turn is actually running, never at launch. It is a
-         request the person can refuse, and refusing it only costs battery life
-         during a long turn. -->
-    <uses-permission android:name="android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS" />
-    <!-- Every-file access, for opening a folder on this phone as a workspace.
-         The kernel is a plain Go binary: it opens paths with `open(2)`, and a
-         document URI is not a path it can open. SAF would hand back exactly
-         that unusable URI, so the one honest permission is the broad one —
-         granted by the person in system settings, which is the only place
-         Android offers it. Nothing here reads storage for any other purpose. -->
-    <uses-permission
-        android:name="android.permission.MANAGE_EXTERNAL_STORAGE"
-        tools:ignore="ScopedStorage" />
-    <!-- Below API 33 the same folder walk needs the older pair; from 33 they are
-         superseded by the permission above and asking for them would be a lie. -->
-    <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" android:maxSdkVersion="32" />
-    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" android:maxSdkVersion="29" />
-
-    <!-- A phone without a touchscreen cannot drive this interface; saying so
-         keeps the listing honest rather than letting it install on a TV. -->
-    <uses-feature android:name="android.hardware.touchscreen" android:required="true" />
-    <!-- The camera is optional: a phone without one is still a fine client for
-         a kernel it already knows, and it can still pair by opening the link the
-         computer shows. Requiring it would take the app off those devices. -->
-    <uses-feature android:name="android.hardware.camera" android:required="false" />
-    <uses-feature android:name="android.hardware.camera.autofocus" android:required="false" />
-
-    <application
-        android:name=".App"
-        android:allowBackup="false"
-        android:dataExtractionRules="@xml/data_extraction_rules"
-        android:fullBackupContent="false"
-        android:icon="@mipmap/ic_launcher"
-        android:label="@string/app_name"
-        android:networkSecurityConfig="@xml/network_security_config"
-        android:supportsRtl="true"
-        android:theme="@style/Theme.Reasonix"
-        android:usesCleartextTraffic="false"
-        tools:targetApi="35">
-
-        <activity
-            android:name=".MainActivity"
-            android:exported="true"
-            android:configChanges="orientation|screenSize|screenLayout|keyboardHidden|uiMode|density|fontScale|smallestScreenSize"
-            android:launchMode="singleTask"
-            android:windowSoftInputMode="adjustResize"
-            android:theme="@style/Theme.Reasonix">
-            <intent-filter>
-                <action android:name="android.intent.action.MAIN" />
-                <category android:name="android.intent.category.LAUNCHER" />
-            </intent-filter>
-        </activity>
-
-        <!-- The kernel outlives the screen: a turn that takes minutes would
-             otherwise be killed when the phone is pocketed. The service is
-             `stopWithTask="false"` so swiping the app away ends it deliberately
-             rather than silently, and `foregroundServiceType="dataSync"` is the
-             closest honest description of "an agent is working". -->
-        <service
-            android:name=".KernelService"
-            android:exported="false"
-            android:foregroundServiceType="dataSync"
-            android:stopWithTask="false" />
-
-        <!-- Reading the pairing code a computer shows. Its own activity rather
-             than a dialog, because the camera preview needs the whole screen to
-             be worth pointing at anything. Not exported: only this app starts
-             it, and a scanner another app could open is one that could be made
-             to read a code on someone else's behalf. -->
-        <activity
-            android:name=".ScanActivity"
-            android:exported="false"
-            android:screenOrientation="portrait"
-            android:theme="@style/Theme.Reasonix.Scan" />
-    </application>
-</manifest>
@@ -1,59 +0,0 @@
-package io.reasonix.mobile.app
-
-import android.app.Application
-import android.app.NotificationChannel
-import android.app.NotificationManager
-import android.content.Context
-
-/**
- * The process-wide facts this app needs.
- *
- * The kernel is one child process, so there is exactly one of it no matter how
- * many activities exist: it is held here, lazily, and the activity and the
- * service both reach the same instance. Nothing else is stored — the theme, the
- * language and every preference belong to the page and live in its localStorage.
- */
-class App : Application() {
-
-    /**
-     * The kernel, created on first use.
-     *
-     * Lazy rather than eager so that merely launching the process to answer a
-     * notification does not unpack a 15MB page.
-     */
-    val kernel: Kernel by lazy { Kernel(this) }
-
-    override fun onCreate() {
-        super.onCreate()
-        createChannel()
-    }
-
-    /**
-     * A channel the person can mute without muting the app, and one they can
-     * find: an agent that runs for minutes on a phone has to say so somewhere
-     * the system will not kill, and a notification is the only place Android
-     * offers. `IMPORTANCE_MIN` because the notification is a receipt, not an
-     * interruption — the work it reports is on another machine.
-     */
-    private fun createChannel() {
-        // No SDK_INT guard: minSdk is 26, which is the release NotificationChannel
-        // arrived in, so every device this app installs on has it.
-        val manager = getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager
-        if (manager.getNotificationChannel(CHANNEL_KERNEL) != null) return
-        val channel = NotificationChannel(
-            CHANNEL_KERNEL,
-            getString(R.string.channel_kernel),
-            NotificationManager.IMPORTANCE_MIN,
-        ).apply {
-            description = getString(R.string.channel_kernel_desc)
-            setShowBadge(false)
-            enableVibration(false)
-            setSound(null, null)
-        }
-        manager.createNotificationChannel(channel)
-    }
-
-    companion object {
-        const val CHANNEL_KERNEL = "reasonix-kernel"
-    }
-}
@@ -1,699 +0,0 @@
-package io.reasonix.mobile.app
-
-import android.graphics.Bitmap
-import android.graphics.Canvas
-import android.os.Handler
-import android.os.Looper
-import android.util.Base64
-import android.util.Log
-import android.webkit.WebView
-import org.json.JSONArray
-import org.json.JSONObject
-import java.io.BufferedInputStream
-import java.io.ByteArrayOutputStream
-import java.io.OutputStream
-import java.net.ServerSocket
-import java.net.Socket
-import java.net.SocketException
-import java.util.concurrent.CountDownLatch
-import java.util.concurrent.TimeUnit
-import java.util.concurrent.atomic.AtomicBoolean
-import java.util.concurrent.atomic.AtomicReference
-
-/**
- * The kernel's browser, as a loopback HTTP server.
- *
- * The Go kernel (`internal/platform/browser/shell.go`) drives a WebView by
- * POSTing JSON to a handful of paths on 127.0.0.1. This class is the other end
- * of that conversation: it accepts connections on a random port, parses the
- * minimal HTTP the kernel sends, and translates each path into an operation on
- * the overlay WebView.
- *
- * The server is deliberately tiny — no connection pooling, no keep-alive, no
- * chunked encoding — because the kernel is its only client and sends one
- * request per connection. A `ServerSocket` accept loop on a daemon thread is
- * the whole transport; each request is handled synchronously on its own thread.
- *
- * WebView operations must run on the UI thread. Each handler posts to the main
- * looper and waits on a latch, with a timeout that bounds the worst case (a
- * page that hangs the JS thread) to something the kernel's own 30-second client
- * timeout will not outlast.
- *
- * Memory note on `/screenshot`: a full-page `WebView.draw` into an ARGB_8888
- * bitmap at device resolution can reach tens of MB for a long page. The bitmap
- * is downsampled by a factor of 2 in each dimension before PNG encoding, which
- * keeps the peak allocation under ~10 MB for a typical 1080p viewport. The
- * original is recycled immediately after the downsample.
- */
-/** One thing a page asked the network for, as the WebView's request
- *  interceptor reports it. The interceptor is handed the method and the URL
- *  and nothing about the response, so a caller may show exactly this much and
- *  must not read it as a completed exchange. */
-data class BrowserRequest(val method: String, val url: String, val kind: String)
-
-class BrowserShellServer(
-    /** The overlay WebView, when one already exists. The routes that act on an
-     *  open page — back, forward, reload, close — use this: with no page there
-     *  is nothing to act on, and creating one to do nothing to it would start a
-     *  renderer nobody asked for. */
-    private val existingView: () -> WebView?,
-    /** The overlay WebView, created on first use. The routes that drive a page
-     *  use this, because the kernel can open one before the panel has ever been
-     *  shown: the page's own panel asks for the view when it is displayed, and
-     *  an agent's `browser_open` can arrive first. Requiring the view to exist
-     *  already answered every such call with "browser view not ready", which
-     *  reads as a broken engine rather than as a view that was not created yet.
-     *  Called on the UI thread. */
-    private val ensureView: () -> WebView,
-    /** Why the page in the view is the browser's own error page rather than a
-     *  site, as `(url, chromium error)`; null when the last load succeeded.
-     *  `/read` asks this, because extracting `innerText` from the error page
-     *  returns the browser's own "this page could not be loaded" notice, which
-     *  the kernel would hand to the model as though the site had said it. */
-    private val loadFailure: () -> Pair<String, String>? = { null },
-    /** Begin a navigation: forget the load failure recorded for the page being
-     *  left, drop its request list, and start the wait a following `/read`
-     *  joins. Called on the UI thread, before the new address is loaded, so the
-     *  wait is in place before any callback for the new page can fire. */
-    private val startNavigation: () -> Unit = {},
-    /** What the page currently in the view has asked the network for, oldest
-     *  first. The WebView reports a request's method and URL to its interceptor
-     *  but nothing about the response, so that is all a caller may show. */
-    private val requests: () -> List<BrowserRequest> = { emptyList() },
-    /** Wait for the navigation last asked for to settle — the page arrived, or
-     *  its load failed — up to the given milliseconds. Called on the request's
-     *  own thread, never the UI thread: the settle is signalled from the UI
-     *  thread, so waiting on it there would deadlock. `/load` starts a
-     *  navigation and returns before the page has been visited; without this a
-     *  `/read` right behind it still sees the URL of the page before, and a
-     *  failure recorded for that page was handed back as the new one's answer. */
-    private val awaitNavigation: (Long) -> Unit = {},
-) {
-
-    companion object {
-        private const val TAG = "BrowserShellServer"
-
-        /** How long a UI-thread operation may take before the handler gives up.
-         *  The kernel's client timeout is 30 s; staying under it means the kernel
-         *  sees a clean error rather than a dropped connection. */
-        private const val UI_TIMEOUT_MS = 25_000L
-
-        /** The maximum text `/read` returns. Matches the kernel's `maxReadText`
-         *  (400 << 10). The shell truncates here and says so, rather than letting
-         *  the kernel truncate silently. */
-        private const val MAX_READ_TEXT = 400 * 1024
-
-        /** Screenshot downsample factor. 2 means half width and half height. */
-        private const val SCREENSHOT_SCALE = 2
-
-        /** The address the kernel dials. Both ends must agree on the family:
-         *  see [start] for what goes wrong when they do not. */
-        private const val LOOPBACK_V4 = "127.0.0.1"
-
-        /** How long `/read` waits for a navigation it follows to settle before
-         *  reading whatever the view is on. A page that never finishes loading
-         *  must not hold the tool call open to the kernel's own timeout. */
-        private const val NAV_SETTLE_MS = 10_000L
-
-        /** How long `/read` then waits for the page's own script to answer.
-         *  `NAV_SETTLE_MS + READ_SCRIPT_MS` has to stay under [UI_TIMEOUT_MS],
-         *  and that under the kernel's 30-second client timeout: a read that
-         *  waited out both budgets would outlast the caller, which would see a
-         *  dropped connection instead of this shell's answer. 10 + 15 = 25 s. */
-        private const val READ_SCRIPT_MS = 15_000L
-    }
-
-    @Volatile
-    private var serverSocket: ServerSocket? = null
-
-    /** The port the server is listening on. Valid after [start] returns. */
-    @Volatile
-    var port: Int = 0
-        private set
-
-    /**
-     * The bearer credential every request must carry. Minted by the activity
-     * and handed to the kernel through the child's environment, so the server
-     * answers only the process this shell started.
-     *
-     * A phone's loopback is not a boundary: any other app may connect to
-     * 127.0.0.1, and the routes here run script in and read text out of
-     * whatever page is loaded. Binding to `getLoopbackAddress()` keeps other
-     * machines out but not other apps, so the credential is what makes "only
-     * the kernel this shell started" true.
-     */
-    @Volatile
-    var token: String = ""
-        private set
-
-    private val mainHandler = Handler(Looper.getMainLooper())
-
-    /**
-     * Start listening on 127.0.0.1 with an ephemeral port. The port is available
-     * via [port] immediately after this returns, and the credential the kernel
-     * must present via [token].
-     */
-    fun start() {
-        token = newToken()
-        // The loopback address is spelled out as IPv4, not taken from
-        // `InetAddress.getLoopbackAddress()`. That call is allowed to answer
-        // either family and Android's libcore answers IPv6 (`::1`), while the
-        // kernel's client is hardcoded to `http://127.0.0.1:<port>`
-        // (`internal/assembly/boot/browser.go`). A socket bound to `::1` does
-        // not answer a dial to `127.0.0.1`, so every browser call failed with
-        // "connection refused" while the port was bound and reported — the
-        // failure looked like a server that never started. Both ends have to
-        // name the same family, and IPv4 is the one the kernel names.
-        val ss = ServerSocket(0, 16, java.net.InetAddress.getByName(LOOPBACK_V4))
-        serverSocket = ss
-        port = ss.localPort
-        Log.i(TAG, "browser shell server listening on $LOOPBACK_V4:$port")
-
-        Thread({
-            while (!ss.isClosed) {
-                try {
-                    val client = ss.accept()
-                    Thread({ handleClient(client, token) }, "browser-shell-conn").apply { isDaemon = true }.start()
-                } catch (_: SocketException) {
-                    // Server was closed; exit the loop.
-                }
-            }
-        }, "browser-shell-accept").apply { isDaemon = true }.start()
-    }
-
-    fun stop() {
-        runCatching { serverSocket?.close() }
-        serverSocket = null
-    }
-
-    /** A fresh 256-bit credential, hex-encoded, for one launch of the server. */
-    private fun newToken(): String {
-        val bytes = ByteArray(32)
-        java.security.SecureRandom().nextBytes(bytes)
-        return bytes.joinToString("") { "%02x".format(it) }
-    }
-
-    // ---- HTTP plumbing --------------------------------------------------------
-
-    private fun handleClient(client: Socket, expected: String) {
-        try {
-            client.soTimeout = 30_000
-            val input = BufferedInputStream(client.getInputStream())
-            val output = client.getOutputStream()
-
-            // Parse the request line.
-            val requestLine = readLine(input) ?: return
-            val parts = requestLine.split(" ", limit = 3)
-            if (parts.size < 2) return
-            val method = parts[0]
-            val path = parts[1].substringBefore('?')
-
-            // Read headers.
-            var contentLength = 0
-            var bearer: String? = null
-            while (true) {
-                val header = readLine(input) ?: break
-                if (header.isEmpty()) break
-                val lower = header.lowercase()
-                if (lower.startsWith("content-length:")) {
-                    contentLength = header.substringAfter(':').trim().toIntOrNull() ?: 0
-                } else if (lower.startsWith("authorization:")) {
-                    bearer = header.substringAfter(':').trim().removePrefix("Bearer ").trim()
-                }
-            }
-
-            // Nothing behind this server is safe to hand out on the strength of
-            // an address: the port is on loopback, which any other app on the
-            // phone can dial, and the routes run script in and read text out of
-            // the loaded page. The credential the kernel was started with is the
-            // only thing that says a caller is that kernel. Every route is
-            // refused without it, /health included — a probe needs no exemption.
-            if (expected.isEmpty() || bearer != expected) {
-                writeResponse(output, 401, """{"error":"unauthorized"}""")
-                return
-            }
-
-            // Read body.
-            val body = if (contentLength > 0) {
-                val buf = ByteArray(contentLength)
-                var read = 0
-                while (read < contentLength) {
-                    val n = input.read(buf, read, contentLength - read)
-                    if (n == -1) break
-                    read += n
-                }
-                String(buf, 0, read, Charsets.UTF_8)
-            } else ""
-
-            // Route.
-            val (status, responseBody) = route(method, path, body)
-            writeResponse(output, status, responseBody)
-        } catch (e: Exception) {
-            Log.w(TAG, "connection error: ${e.message}")
-        } finally {
-            runCatching { client.close() }
-        }
-    }
-
-    private fun route(method: String, path: String, body: String): Pair<Int, String> {
-        return when {
-            method == "GET" && path == "/health" -> 200 to """{"ok":true}"""
-            method == "POST" && path == "/load" -> handleLoad(body)
-            method == "POST" && path == "/close" -> handleClose()
-            method == "POST" && path == "/read" -> handleRead()
-            method == "POST" && path == "/screenshot" -> handleScreenshot()
-            method == "POST" && path == "/click" -> handleClick(body)
-            method == "POST" && path == "/eval" -> handleEval(body)
-            method == "POST" && path == "/back" -> handleBack()
-            method == "POST" && path == "/forward" -> handleForward()
-            method == "POST" && path == "/reload" -> handleReload()
-            method == "POST" && path == "/requests" -> handleRequests()
-            else -> 404 to """{"error":"not found"}"""
-        }
-    }
-
-    private fun writeResponse(out: OutputStream, status: Int, body: String) {
-        val reason = when (status) {
-            200 -> "OK"
-            404 -> "Not Found"
-            500 -> "Internal Server Error"
-            else -> "Error"
-        }
-        val bytes = body.toByteArray(Charsets.UTF_8)
-        val header = "HTTP/1.1 $status $reason\r\n" +
-            "Content-Type: application/json\r\n" +
-            "Content-Length: ${bytes.size}\r\n" +
-            "Connection: close\r\n" +
-            "\r\n"
-        out.write(header.toByteArray(Charsets.UTF_8))
-        out.write(bytes)
-        out.flush()
-    }
-
-    private fun readLine(input: BufferedInputStream): String? {
-        val sb = StringBuilder()
-        while (true) {
-            val b = input.read()
-            if (b == -1) return if (sb.isEmpty()) null else sb.toString()
-            if (b == '\r'.code) {
-                val next = input.read()
-                if (next == '\n'.code) return sb.toString()
-                sb.append(b.toChar())
-                if (next != -1) sb.append(next.toChar())
-                continue
-            }
-            if (b == '\n'.code) return sb.toString()
-            sb.append(b.toChar())
-        }
-    }
-
-    // ---- endpoint handlers ----------------------------------------------------
-
-    /** POST /load {"url":"..."} → {"url":"...","title":"..."} */
-    private fun handleLoad(body: String): Pair<Int, String> {
-        val json = runCatching { JSONObject(body) }.getOrNull()
-            ?: return 500 to """{"error":"invalid request body"}"""
-        val url = json.optString("url", "")
-        if (url.isEmpty()) return 500 to """{"error":"missing url"}"""
-
-        val result = AtomicReference("")
-        val latch = CountDownLatch(1)
-        mainHandler.post {
-            val wv = ensureView()
-            // The failure recorded for the page being left stops being this
-            // tab's, and the wait a following `/read` joins is armed before the
-            // new address is loaded, so no callback for the new page can fire
-            // ahead of it. `/load` answers before the page arrives, which is
-            // what left the old failure to be read back as the new page's.
-            startNavigation()
-            wv.loadUrl(url)
-            // The title and final URL are not available synchronously after
-            // loadUrl; answer with what was requested. The kernel stores this
-            // as the tab's URL and reads the real one on the next /read.
-            result.set(JSONObject().apply {
-                put("url", url)
-                put("title", "")
-            }.toString())
-            latch.countDown()
-        }
-        if (!latch.await(UI_TIMEOUT_MS, TimeUnit.MILLISECONDS)) {
-            return 500 to """{"error":"timeout waiting for UI thread"}"""
-        }
-        return 200 to result.get()
-    }
-
-    /** POST /close {} → 200 */
-    private fun handleClose(): Pair<Int, String> {
-        val latch = CountDownLatch(1)
-        mainHandler.post {
-            val wv = existingView()
-            if (wv != null) {
-                wv.loadUrl("about:blank")
-                wv.clearHistory()
-            }
-            latch.countDown()
-        }
-        if (!latch.await(UI_TIMEOUT_MS, TimeUnit.MILLISECONDS)) {
-            return 500 to """{"error":"timeout"}"""
-        }
-        return 200 to "{}"
-    }
-
-    /**
-     * POST /read {} → {"title":"...","url":"...","text":"..."}
-     *
-     * Injects a script that extracts readable text from the page, preferring
-     * `<article>` or `<main>` and falling back to `body.innerText`. The result
-     * is truncated to 400 KB (matching the kernel's `maxReadText`); when
-     * truncated, a note is appended so the model knows the text was cut.
-     */
-    private fun handleRead(): Pair<Int, String> {
-        // The page the caller just asked for has not necessarily been visited
-        // yet: `/load` returns as soon as it has started the navigation. Waiting
-        // here, off the UI thread, is what makes this read answer about that
-        // page instead of the one before it.
-        awaitNavigation(NAV_SETTLE_MS)
-        val result = AtomicReference("")
-        val latch = CountDownLatch(1)
-        mainHandler.post {
-            val wv = ensureView()
-            // A page that did not load is not content. Whether the view is on
-            // the browser's own error page is read from the view itself rather
-            // than from a remembered failure: a failure recorded for the page
-            // before a new navigation would otherwise be handed back as this
-            // page's answer, long after the page the caller asked for had
-            // loaded. The remembered failure is still what names the address
-            // that failed and why, since the error page's own URL does not.
-            if ((wv.url ?: "").startsWith("chrome-error:")) {
-                val (url, reason) = loadFailure() ?: ((wv.url ?: "") to "ERR_FAILED")
-                result.set(JSONObject().apply {
-                    put("url", url)
-                    put("title", "")
-                    put("reason", reason)
-                    put("text", "")
-                }.toString())
-                latch.countDown()
-                return@post
-            }
-            // The extraction script: prefer article/main for content pages,
-            // fall back to body. innerText preserves visual line breaks. It
-            // also stamps a ref on every element a person could act on, so the
-            // kernel can name one in an act step the way the desktop backend
-            // names an accessibility node. A ref already on an element is kept,
-            // so it stays the same across snapshots of one document; a fresh
-            // document starts the numbering over, and the kernel only accepts a
-            // ref from the snapshot it last read.
-            val script = """
-                (function(){
-                    var seq = window.__rxRefSeq || 0;
-                    var used = {};
-                    var marked = document.querySelectorAll('[data-rx-ref]');
-                    for (var i = 0; i < marked.length; i++) { used[marked[i].getAttribute('data-rx-ref')] = true; }
-                    function roleOf(el) {
-                        var tag = el.tagName.toLowerCase();
-                        var role = (el.getAttribute('role') || '').toLowerCase();
-                        if (role) return role;
-                        if (tag === 'a') return 'link';
-                        if (tag === 'button') return 'button';
-                        if (tag === 'select') return 'combobox';
-                        if (tag === 'textarea') return 'textbox';
-                        if (tag === 'input') {
-                            var t = (el.getAttribute('type') || 'text').toLowerCase();
-                            if (t === 'checkbox' || t === 'radio' || t === 'submit' || t === 'button' || t === 'reset') return t;
-                            return 'textbox';
-                        }
-                        return 'generic';
-                    }
-                    function nameOf(el) {
-                        var n = el.getAttribute('aria-label') || el.getAttribute('placeholder') || el.getAttribute('name') || '';
-                        if (!n) { n = (el.innerText || el.textContent || '').trim(); }
-                        return n.replace(/\s+/g, ' ').slice(0, 160);
-                    }
-                    var sel = 'a[href],button,input,select,textarea,[role=button],[role=link],[role=checkbox],[role=radio],[role=tab],[role=menuitem],[contenteditable=true]';
-                    var els = document.querySelectorAll(sel);
-                    var elements = [];
-                    for (var j = 0; j < els.length; j++) {
-                        var el = els[j];
-                        var ref = el.getAttribute('data-rx-ref');
-                        if (!ref) {
-                            do { seq++; ref = 'e' + seq; } while (used[ref]);
-                            el.setAttribute('data-rx-ref', ref);
-                            used[ref] = true;
-                        }
-                        var raw = (el.value != null && String(el.value) !== '') ? String(el.value).slice(0, 160) : '';
-                        elements.push({ref: ref, role: roleOf(el), name: nameOf(el), value: raw});
-                    }
-                    window.__rxRefSeq = seq;
-                    var el2 = document.querySelector('article') || document.querySelector('main') || document.body;
-                    var text = el2 ? (el2.innerText || '') : '';
-                    var title = document.title || '';
-                    var url = location.href;
-                    return JSON.stringify({title: title, url: url, text: text, elements: elements});
-                })()
-            """.trimIndent()
-            wv.evaluateJavascript(script) { value ->
-                // evaluateJavascript returns a JSON-encoded string (the result
-                // is double-encoded). Strip the outer quotes.
-                val parsed = parseJsResult(value)
-                if (parsed != null) {
-                    try {
-                        val obj = JSONObject(parsed)
-                        var text = obj.optString("text", "")
-                        if (text.length > MAX_READ_TEXT) {
-                            text = text.substring(0, MAX_READ_TEXT) +
-                                "\n\n[text truncated at 400 KB]"
-                        }
-                        result.set(JSONObject().apply {
-                            put("title", obj.optString("title", ""))
-                            put("url", obj.optString("url", ""))
-                            put("text", text)
-                            put("elements", obj.optJSONArray("elements") ?: JSONArray())
-                        }.toString())
-                    } catch (e: Exception) {
-                        result.set(JSONObject().apply {
-                            put("title", "")
-                            put("url", wv.url ?: "")
-                            put("text", parsed.take(MAX_READ_TEXT))
-                        }.toString())
-                    }
-                } else {
-                    result.set(JSONObject().apply {
-                        put("title", "")
-                        put("url", wv.url ?: "")
-                        put("text", "")
-                    }.toString())
-                }
-                latch.countDown()
-            }
-        }
-        if (!latch.await(READ_SCRIPT_MS, TimeUnit.MILLISECONDS)) {
-            return 500 to """{"error":"timeout waiting for page script"}"""
-        }
-        return 200 to result.get()
-    }
-
-    /**
-     * POST /screenshot {} → {"data":"<base64>","mime":"image/png"}
-     *
-     * Draws the WebView into a bitmap, downsamples by SCREENSHOT_SCALE to keep
-     * memory bounded, and encodes as PNG → base64. For a 1080×2400 viewport the
-     * full bitmap is ~10 MB; the downsampled one is ~2.5 MB. The full bitmap is
-     * recycled immediately after scaling.
-     */
-    private fun handleScreenshot(): Pair<Int, String> {
-        val result = AtomicReference("")
-        val failed = AtomicBoolean(false)
-        val latch = CountDownLatch(1)
-        mainHandler.post {
-            val wv = ensureView()
-            try {
-                val width = wv.width.takeIf { it > 0 } ?: 1080
-                val height = wv.height.takeIf { it > 0 } ?: 1920
-                val bmp = Bitmap.createBitmap(width, height, Bitmap.Config.ARGB_8888)
-                val canvas = Canvas(bmp)
-                wv.draw(canvas)
-
-                // Downsample to bound the PNG size and the base64 string.
-                val scaled = Bitmap.createScaledBitmap(
-                    bmp,
-                    width / SCREENSHOT_SCALE,
-                    height / SCREENSHOT_SCALE,
-                    true,
-                )
-                if (scaled !== bmp) bmp.recycle()
-
-                val baos = ByteArrayOutputStream()
-                scaled.compress(Bitmap.CompressFormat.PNG, 85, baos)
-                scaled.recycle()
-                val b64 = Base64.encodeToString(baos.toByteArray(), Base64.NO_WRAP)
-                result.set(JSONObject().apply {
-                    put("data", b64)
-                    put("mime", "image/png")
-                }.toString())
-            } catch (e: Exception) {
-                // A 200 with an error body would be read by the kernel as a
-                // screenshot whose data is empty, and it would build a `data:`
-                // URI out of nothing. The status is what tells it this failed.
-                result.set("""{"error":"screenshot failed: ${e.message}"}""")
-                failed.set(true)
-            }
-            latch.countDown()
-        }
-        if (!latch.await(UI_TIMEOUT_MS, TimeUnit.MILLISECONDS)) {
-            return 500 to """{"error":"timeout"}"""
-        }
-        if (failed.get()) return 500 to result.get()
-        return 200 to result.get()
-    }
-
-    /** POST /click {"selector":"..."} → {"ok":true|false} */
-    private fun handleClick(body: String): Pair<Int, String> {
-        val json = runCatching { JSONObject(body) }.getOrNull()
-            ?: return 500 to """{"error":"invalid request body"}"""
-        val selector = json.optString("selector", "")
-        if (selector.isEmpty()) return 500 to """{"error":"missing selector"}"""
-
-        val result = AtomicReference("")
-        val latch = CountDownLatch(1)
-        mainHandler.post {
-            val wv = ensureView()
-            // Escape the selector for embedding in a JS string.
-            val escaped = selector.replace("\\", "\\\\").replace("'", "\\'")
-            val script = """
-                (function(){
-                    try {
-                        var el = document.querySelector('$escaped');
-                        if (!el) return JSON.stringify({ok: false});
-                        el.click();
-                        return JSON.stringify({ok: true});
-                    } catch(e) {
-                        return JSON.stringify({ok: false});
-                    }
-                })()
-            """.trimIndent()
-            wv.evaluateJavascript(script) { value ->
-                val parsed = parseJsResult(value)
-                result.set(parsed ?: """{"ok":false}""")
-                latch.countDown()
-            }
-        }
-        if (!latch.await(UI_TIMEOUT_MS, TimeUnit.MILLISECONDS)) {
-            return 500 to """{"error":"timeout"}"""
-        }
-        return 200 to result.get()
-    }
-
-    /** POST /eval {"script":"..."} → {"result":"..."} */
-    private fun handleEval(body: String): Pair<Int, String> {
-        val json = runCatching { JSONObject(body) }.getOrNull()
-            ?: return 500 to """{"error":"invalid request body"}"""
-        val script = json.optString("script", "")
-        if (script.isEmpty()) return 500 to """{"error":"missing script"}"""
-
-        val result = AtomicReference("")
-        val latch = CountDownLatch(1)
-        mainHandler.post {
-            val wv = ensureView()
-            wv.evaluateJavascript(script) { value ->
-                // The kernel expects a plain string in "result". The value from
-                // evaluateJavascript is JSON-encoded; unwrap it.
-                val unwrapped = parseJsResult(value) ?: ""
-                result.set(JSONObject().apply {
-                    put("result", unwrapped)
-                }.toString())
-                latch.countDown()
-            }
-        }
-        if (!latch.await(UI_TIMEOUT_MS, TimeUnit.MILLISECONDS)) {
-            return 500 to """{"error":"timeout waiting for eval"}"""
-        }
-        return 200 to result.get()
-    }
-
-    /** POST /back → 200 */
-    private fun handleBack(): Pair<Int, String> {
-        val latch = CountDownLatch(1)
-        mainHandler.post {
-            existingView()?.let { if (it.canGoBack()) it.goBack() }
-            latch.countDown()
-        }
-        if (!latch.await(UI_TIMEOUT_MS, TimeUnit.MILLISECONDS)) {
-            return 500 to """{"error":"timeout"}"""
-        }
-        return 200 to "{}"
-    }
-
-    /** POST /forward → 200 */
-    private fun handleForward(): Pair<Int, String> {
-        val latch = CountDownLatch(1)
-        mainHandler.post {
-            existingView()?.let { if (it.canGoForward()) it.goForward() }
-            latch.countDown()
-        }
-        if (!latch.await(UI_TIMEOUT_MS, TimeUnit.MILLISECONDS)) {
-            return 500 to """{"error":"timeout"}"""
-        }
-        return 200 to "{}"
-    }
-
-    /** POST /reload → 200 */
-    private fun handleReload(): Pair<Int, String> {
-        val latch = CountDownLatch(1)
-        mainHandler.post {
-            val wv = existingView()
-            // A view sitting on the browser's own error page is not on the site,
-            // and reloading it would retry the error page itself. The address
-            // that failed is loaded again instead — which is the page a caller
-            // means by "reload" — read before `startNavigation` clears it.
-            val failed = if (wv != null && (wv.url ?: "").startsWith("chrome-error:"))
-                loadFailure()?.first else null
-            startNavigation()
-            if (wv != null) {
-                if (failed != null) wv.loadUrl(failed) else wv.reload()
-            }
-            latch.countDown()
-        }
-        if (!latch.await(UI_TIMEOUT_MS, TimeUnit.MILLISECONDS)) {
-            return 500 to """{"error":"timeout"}"""
-        }
-        return 200 to "{}"
-    }
-
-    /** POST /requests {} → {"requests":[{"method","url","kind"},…]} */
-    private fun handleRequests(): Pair<Int, String> {
-        val arr = JSONArray()
-        for (r in requests()) {
-            arr.put(JSONObject().apply {
-                put("method", r.method)
-                put("url", r.url)
-                put("kind", r.kind)
-            })
-        }
-        return 200 to JSONObject().apply { put("requests", arr) }.toString()
-    }
-
-    // ---- helpers ----------------------------------------------------------------
-
-    /**
-     * Unwrap the result of `evaluateJavascript`. The callback receives a
-     * JSON-encoded string: a JS string "hello" arrives as `"\"hello\""`, a
-     * number 42 as `"42"`, null as `"null"`. Strip the outer JSON encoding to
-     * get the raw value.
-     */
-    private fun parseJsResult(value: String?): String? {
-        if (value == null || value == "null") return null
-        // The value is a JSON literal. If it is a JSON string, decode it.
-        return try {
-            if (value.startsWith("\"") && value.endsWith("\"")) {
-                JSONObject().apply { }.let {
-                    // Use JSONObject's string decoding: wrap in an object.
-                    JSONObject("""{"v":$value}""").optString("v", "")
-                }
-            } else {
-                value
-            }
-        } catch (_: Exception) {
-            value
-        }
-    }
-}
@@ -1,119 +0,0 @@
-package io.reasonix.mobile.app
-
-import android.content.Context
-import android.net.ConnectivityManager
-import android.net.LinkProperties
-import android.os.Build
-
-/**
- * The phone's DNS servers, as the kernel needs them.
- *
- * The kernel is a CGO-free Go binary, and Go's own source explains why that
- * matters:
- *
- * ```
- * // DNS requests don't work on Android, so prefer the cgo resolver.
- * // Issue #10714.
- * case "android":
- * ```
- *
- * A normal Android program resolves names through `getaddrinfo`, which reaches
- * the `netd` daemon and gets the servers of the network that is actually up.
- * A static binary has no cgo resolver, so Go reads `/etc/resolv.conf` instead —
- * and Android has no such file. Go then falls back to `127.0.0.1:53`, where
- * nothing listens, and every lookup fails: the setup screen reports
- * "连接失败" for every provider, including the official ones, on a phone whose
- * browser reaches them fine.
- *
- * So they are read here and handed to the kernel through `REASONIX_DNS`. This is
- * the same source the system itself uses, so a VPN, a private DNS hostname, or a
- * network that changed since boot is all reflected without this code knowing
- * anything about them.
- */
-object Dns {
-
-    /**
-     * The active network's servers, comma separated, or "" when there is none.
-     *
-     * Read from the *active* network rather than from every link, because a phone
-     * commonly has several at once — Wi-Fi, mobile data, a VPN — and the servers
-     * of a network that is not carrying traffic are the wrong ones to ask.
-     */
-    fun servers(context: Context): String {
-        val manager = context.getSystemService(Context.CONNECTIVITY_SERVICE) as? ConnectivityManager
-            ?: return ""
-        val properties: LinkProperties = runCatching { manager.activeNetwork }.getOrNull()
-            ?.let { network -> runCatching { manager.getLinkProperties(network) }.getOrNull() }
-            ?: return ""
-        return properties.dnsServers
-            .mapNotNull { address -> address.hostAddress }
-            .filter { it.isNotBlank() }
-            .filter { routable(it) }
-            .sortedBy { preference(it) }
-            .joinToString(",")
-    }
-
-    /**
-     * Whether an address can actually carry a query.
-     *
-     * A link-local address (fe80::/10) without its zone cannot: the packet has
-     * no interface to leave by, so it is dropped, nothing answers, and the
-     * lookup hangs until the kernel's own timeout expires — which is reported as
-     * a timeout rather than as a failure to resolve, and so reads like the
-     * network is slow instead of like the address is unusable.
-     *
-     * Android reports the zone as a `%wlan0` suffix on `hostAddress`, and the
-     * address is only usable with it kept. Nothing here trims it: an earlier
-     * version called `substringBefore('%')`, which turned a usable link-local
-     * server into an unroutable one.
-     */
-    private fun routable(host: String): Boolean =
-        !(host.startsWith("fe80:", ignoreCase = true) && !host.contains('%'))
-
-    /**
-     * IPv4 first, then IPv6.
-     *
-     * A phone commonly reports both, and its IPv6 entry is often a router's
-     * link-local address — reachable on one network and not the next. The
-     * kernel tries the servers in the order it is given them, and stops at the
-     * first that answers; putting the address family that shares the network's
-     * own numbering first means its timeout is spent on a server that works.
-     */
-    private fun preference(host: String): Int = if (host.contains(':')) 1 else 0
-
-    /**
-     * The private-DNS setting, for the one case the address list cannot answer.
-     *
-     * Since Android 9 a phone may use DNS-over-TLS, and then `dnsServers` holds a
-     * name rather than an address — a name this kernel cannot resolve *because*
-     * resolving it is the thing that is broken. There is no way for the shell to
-     * do that lookup for it, so this reports the situation instead of handing
-     * over an unusable value: the caller says so in the log, and the person can
-     * turn private DNS off or set it to automatic.
-     */
-    fun looksLikeDot(servers: String): Boolean =
-        servers.isNotBlank() && servers.split(',').any { part ->
-            val host = part.trim()
-            host.isNotEmpty() && host.none { it == ':' } && !host.all { it.isDigit() || it == '.' }
-        }
-
-    /** Whether the system requires a VPN or private DNS, which changes nothing
-     *  here but is worth saying in a bug report. */
-    fun describe(context: Context): String {
-        val manager = context.getSystemService(Context.CONNECTIVITY_SERVICE) as? ConnectivityManager
-            ?: return "no connectivity service"
-        val network = runCatching { manager.activeNetwork }.getOrNull() ?: return "no active network"
-        val properties = runCatching { manager.getLinkProperties(network) }.getOrNull()
-            ?: return "no link properties"
-        // The DHCP server arrived in API 30, not 23: asked for below that it is a
-        // NoSuchMethodError on a device this app supports (minSdk 26), and the
-        // answer is only ever read out of this string by a person debugging.
-        val dhcp = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
-            properties.dhcpServerAddress?.hostAddress
-        } else {
-            null
-        }
-        return "iface=${properties.interfaceName} dns=${properties.dnsServers.joinToString(",") { it.hostAddress ?: "?" }}" +
-            (dhcp?.let { " dhcp=$it" } ?: "")
-    }
-}
@@ -1,87 +0,0 @@
-package io.reasonix.mobile.app
-
-import android.content.Context
-import android.net.Uri
-import android.webkit.CookieManager
-import android.widget.Toast
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.withContext
-import java.io.FileNotFoundException
-import java.net.HttpURLConnection
-import java.net.URL
-
-/**
- * Putting a file the page produced onto the phone's disk.
- *
- * A WebView has no downloads shelf and cannot write to the system's document
- * picker itself, so the two halves are joined here: the page asks, the picker
- * answers with a `content://` the app has been granted, and this copies the
- * bytes across.
- *
- * The request carries the WebView's own cookie, read out of the jar the page
- * authenticated in. That is the only reason this is not a plain `openStream`:
- * the kernel's download route is behind the session the page established, and a
- * shell that fetched without it would get a 403 and no explanation.
- */
-object Downloader {
-
-    suspend fun run(
-        context: Context,
-        url: String,
-        userAgent: String,
-        mime: String,
-        name: String,
-        target: Uri,
-    ): Result<Unit> = withContext(Dispatchers.IO) {
-        runCatching {
-            val connection = (URL(url).openConnection() as HttpURLConnection).apply {
-                connectTimeout = 15_000
-                readTimeout = 60_000
-                requestMethod = "GET"
-                if (userAgent.isNotBlank()) setRequestProperty("User-Agent", userAgent)
-                // The download route answers with the same session cookie the
-                // page is using; without it the kernel refuses the request.
-                cookieFor(url)?.let { setRequestProperty("Cookie", it) }
-            }
-            try {
-                val code = connection.responseCode
-                if (code !in 200..299) {
-                    throw IllegalStateException(
-                        context.getString(R.string.download_failed_status, code),
-                    )
-                }
-                val resolver = context.contentResolver
-                val output = resolver.openOutputStream(target, "w")
-                    ?: throw FileNotFoundException(target.toString())
-                output.use { out ->
-                    connection.inputStream.use { input -> input.copyTo(out) }
-                }
-                // `copyTo` answers with a byte count; what the caller wants to
-                // know is that there were no bytes missing, not how many.
-                Unit
-            } finally {
-                connection.disconnect()
-            }
-        }
-    }
-
-    /**
-     * The cookie the page authenticated with, if any.
-     *
-     * `CookieManager` is the WebView's own store, so this asks the exact jar the
-     * request will be checked against rather than a copy this shell kept.
-     */
-    private fun cookieFor(url: String): String? =
-        runCatching { CookieManager.getInstance().getCookie(url) }.getOrNull()?.takeIf { it.isNotBlank() }
-
-    /** A short receipt for a tap that otherwise does nothing visible. */
-    fun report(context: Context, name: String, result: Result<Unit>) {
-        val message = result.fold(
-            onSuccess = { context.getString(R.string.download_saved, name) },
-            onFailure = { failure ->
-                context.getString(R.string.download_failed, failure.message ?: "")
-            },
-        )
-        Toast.makeText(context, message, Toast.LENGTH_LONG).show()
-    }
-}
@@ -1,741 +0,0 @@
-package io.reasonix.mobile.app
-
-import android.content.Context
-import android.content.res.AssetManager
-import org.json.JSONArray
-import org.json.JSONObject
-import android.util.Log
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.delay
-import kotlinx.coroutines.withContext
-import java.io.File
-import java.io.FileOutputStream
-import java.net.HttpURLConnection
-import java.net.URL
-import java.security.SecureRandom
-import java.util.Locale
-
-/**
- * The Reasonix kernel, as this app runs it: one child process serving loopback,
- * plus the two things it needs on disk to start — the page it serves and a
- * credential for this launch.
- *
- * The shape is the desktop host's (`cmd/reasonix-studio-host`), narrowed to what
- * a phone does not have. That host binds a socket, mints a credential, speaks a
- * handshake down a pipe and holds a lease; here the credential goes through
- * `--token-file` and the bound address through `--port-file`, because a phone's
- * app process has no pipe to hand a child and no reason to care which port was
- * free. Everything after that — the kernel's own gate, its auth middleware, its
- * CSRF check — is untouched, so the security of the surface is the one upstream
- * tested, not one this shell invented.
- *
- * One instance lives in the app process. The activity asks it for a URL; the
- * foreground service asks it to stay alive. Both see the same process, so there
- * is nothing to synchronise beyond a lock on start/stop.
- */
-class Kernel(private val context: Context) {
-
-    /** Where everything the kernel owns lives. Nothing here is backed up. */
-    private val home = File(context.filesDir, "home")
-
-    /**
-     * The folder the agent works in, which is not the folder the kernel lives in.
-     *
-     * These used to be the same directory, and that is what made the workbench
-     * unreadable: the kernel's home holds `config.toml`, `projects/`, `cache/`,
-     * `stats/` and the rest of its own bookkeeping, and a workspace pointed at
-     * it shows all of that as if the person had put it there. Reported as "why
-     * does the default workspace have so many files, the desktop version does
-     * not generate these" — the desktop does generate them, in a different
-     * directory, because its workspace is whatever folder it was opened on.
-     *
-     * Split apart, the workbench shows what the agent produced and nothing else.
-     * `write_roots` follows the workspace, so the file tools stay confined to
-     * the folder the person actually works in rather than to the kernel's own
-     * home — which is the stricter answer, and the one the desktop already has.
-     */
-    private val workspaceDir = File(context.filesDir, "workspace")
-
-    /**
-     * The directory the kernel calls `REASONIX_HOME`, for the one caller that
-     * has to put a file where the kernel can read it — a private key the person
-     * picked from their Documents folder.
-     */
-    fun homeDir(): File = home
-
-    /** The folder the agent works in. */
-    fun workspaceDir(): File = workspaceDir
-
-    /** The built page, unpacked once per version. */
-    private val pageDir = File(context.filesDir, "page")
-
-    private val tokenFile = File(home, "remote/launch.token")
-    private val portFile = File(home, "remote/serve.port")
-    private val pidFile = File(home, "remote/serve.pid")
-
-    private val lock = Any()
-
-    @Volatile
-    private var process: Process? = null
-
-    /** The port the shell's browser HTTP server listens on, set by the
-     *  activity before `start()` is called. Zero means no server is up, and
-     *  the kernel leaves its browser tools suspended (the correct degradation
-     *  on a phone with no Chromium). */
-    @Volatile
-    var browserShellPort: Int = 0
-
-    /** The bearer credential for that server, set beside the port. Sent on
-     *  every browser call so the server can refuse anything that did not come
-     *  from the kernel this shell started — loopback on a phone is reachable
-     *  by every other app. Empty when there is no server. */
-    @Volatile
-    var browserShellToken: String = ""
-
-    /** What the WebView should load, once the kernel has bound a port. */
-    @Volatile
-    var origin: String? = null
-        private set
-
-    /**
-     * The launch credential, as the URL fragment the page trades for a cookie.
-     * Kept in memory only: the file on disk belongs to the kernel's own
-     * bookkeeping, and a phone's app data is not a place to leave a second copy.
-     */
-    @Volatile
-    private var token: String? = null
-
-    /**
-     * The URL the WebView loads first. It carries the credential in the
-     * fragment, which the page exchanges for an HttpOnly cookie before it makes
-     * any request — the same path a shared `reasonix web` link takes, so the
-     * token never enters a request line, a history entry or a log.
-     */
-    fun entryUrl(): String? {
-        val origin = origin ?: return null
-        val token = token ?: return null
-        return "$origin/#token=$token"
-    }
-
-    /** The plain origin, for reloads once the cookie is set. */
-    fun plainUrl(): String? = origin
-
-    fun isRunning(): Boolean = process?.isAlive == true
-
-    /**
-     * Bring the kernel up, or answer the URL of the one already up.
-     *
-     * Starting is idempotent by intent: the activity and the service both call
-     * this, and whichever arrives second joins the running kernel instead of
-     * racing it for the port.
-     */
-    suspend fun start(): Result<String> = withContext(Dispatchers.IO) {
-        synchronized(lock) {
-            origin?.let { return@withContext Result.success(it) }
-
-            runCatching {
-                val binary = kernelBinary()
-                publishPage()
-                prepareHome()
-                val launchToken = mintToken()
-                token = launchToken
-
-                val child = launch(binary, launchToken)
-
-                // The port is the kernel's answer, not this shell's guess. It
-                // writes the file after binding, so waiting on the file is
-                // waiting on the bind.
-                val bound = awaitPort(child)
-                val url = "http://$bound"
-
-                // A kernel that bound a port and then died would look healthy
-                // here and broken in the WebView; the two facts are checked
-                // together, and only a kernel that is answering is adopted.
-                awaitServing(child, url)
-                origin = url
-                process = child
-                url
-            }.onFailure { origin = null; process = null }
-        }
-    }
-
-    /**
-     * Stop the kernel.
-     *
-     * The graceful signal first: the kernel drains its listeners and closes the
-     * runtimes it opened, which is what lets a later launch adopt the sessions
-     * rather than find them locked. `destroyForcibly` is the second attempt, and
-     * only after a wait — a phone that is being shut down should not keep a
-     * half-killed agent.
-     */
-    fun stop() {
-        synchronized(lock) {
-            val p = process ?: return
-            process = null
-            origin = null
-            token = null
-            runCatching {
-                p.destroy()
-                if (!p.waitFor(3, java.util.concurrent.TimeUnit.SECONDS)) {
-                    p.destroyForcibly()
-                }
-            }
-            portFile.delete()
-            pidFile.delete()
-        }
-    }
-
-    // ---- the two inputs that ship inside the APK -------------------------
-
-    /**
-     * The kernel binary.
-     *
-     * It is packaged as a native library, so Android has already extracted it to
-     * a directory it allows execution from and given it the executable bit —
-     * which is the one thing a file under app storage does not get for free.
-     */
-    private fun kernelBinary(): File {
-        val dir = File(context.applicationInfo.nativeLibraryDir)
-        val binary = File(dir, "libreasonix.so")
-        if (!binary.exists()) {
-            throw IllegalStateException(
-                "内核未随 APK 安装：${binary.path}\n这是一次构建问题，请重新安装完整 APK。",
-            )
-        }
-        return binary
-    }
-
-    /**
-     * Write the bundled page where the kernel can serve it.
-     *
-     * It goes to app storage rather than being served out of the APK because the
-     * kernel's `--page` is a directory on a real filesystem; there is no
-     * archive-aware variant, and adding one would be a change to the kernel for
-     * this shell's convenience alone.
-     *
-     * Unpacking is versioned: the marker holds the app's version name, so an
-     * update replaces the page and a relaunch does not. A partially written
-     * directory — the app killed mid-copy — is caught by the same marker never
-     * having been written, so the next launch rewrites it.
-     */
-    private fun publishPage() {
-        val marker = File(pageDir, ".unpacked")
-        val stamp = "${BuildConfig.VERSION_NAME}:${BuildConfig.VERSION_CODE}"
-        if (marker.isFile && marker.readText().trim() == stamp) return
-
-        pageDir.deleteRecursively()
-        pageDir.mkdirs()
-        copyAssetTree(context.assets, "page", pageDir)
-
-        if (!File(pageDir, "index.html").isFile) {
-            throw IllegalStateException("随 APK 分发的页面不完整：缺少 index.html")
-        }
-        marker.writeText(stamp)
-    }
-
-    /**
-     * A directory tree out of assets.
-     *
-     * `AssetManager.list` on a file answers with an empty array, so a "file" is
-     * told from a directory by trying to open it — which is the only signal the
-     * API offers and the reason this is not a one-liner.
-     */
-    private fun copyAssetTree(assets: AssetManager, from: String, to: File) {
-        val children = assets.list(from).orEmpty()
-        if (children.isEmpty()) {
-            // A leaf: open it as a stream. A directory that happens to be empty
-            // is indistinguishable and harmless to skip.
-            runCatching {
-                assets.open(from).use { input ->
-                    FileOutputStream(to).use { output -> input.copyTo(output) }
-                }
-            }
-            return
-        }
-        to.mkdirs()
-        for (child in children) {
-            copyAssetTree(assets, "$from/$child", File(to, child))
-        }
-    }
-
-    /**
-     * Prepare the kernel's home.
-     *
-     * `REASONIX_HOME` is what every path in the kernel hangs off — config,
-     * sessions, the remote state directory its token file lands in — so pointing
-     * it at app storage is what keeps a phone's Reasonix separate from anything
-     * else and away from global storage entirely.
-     */
-    private fun prepareHome() {
-        File(home, "remote").mkdirs()
-        // The workspace directory not existing yet is what marks the first run
-        // after this build split it from the kernel's home. That is the one
-        // moment a migration is due, and doing it here means it happens before
-        // the kernel is asked for anything.
-        val firstSplit = !workspaceDir.exists()
-        workspaceDir.mkdirs()
-        if (firstSplit) {
-            adoptSessionsFromHome()
-        }
-        // Every launch, not only the first. The rewrite is cheap and
-        // idempotent, and an entry that survived the first pass would otherwise
-        // survive forever: `firstSplit` is spent the moment the directory
-        // exists, so a build that cleaned the list once and missed leaves the
-        // home on the sidebar for good. Running it unconditionally costs one
-        // small read and makes the whole thing self-correcting.
-        forgetHomeFromWorkspaceList()
-    }
-
-    /**
-     * Drop the kernel's own home from the sidebar's remembered projects.
-     *
-     * The list is written whenever a pane opens, and until this build the pane
-     * opened on the home itself — so an upgraded install carries a "project"
-     * that is really the kernel's own directory. Leaving it there would put the
-     * person back where they started: one tap on it and the workbench is full
-     * of `config.toml`, `cache/` and `projects/` again, which is the complaint
-     * this whole change answers. Only that one path is removed; every folder
-     * someone added on purpose stays.
-     *
-     * Parsed rather than pattern-matched, because the file's two shapes — a bare
-     * array of paths and an object with `paths` and `launch` — both have to keep
-     * whatever else they hold.
-     */
-    private fun forgetHomeFromWorkspaceList() {
-        val file = File(home, "serve-workspaces.json")
-        if (!file.isFile) return
-        val text = runCatching { file.readText() }.getOrNull() ?: return
-        val wrong = runCatching { homeNames() }.getOrNull() ?: return
-        val rewritten = runCatching { withoutHome(text, wrong) }.getOrNull() ?: return
-        if (!rewritten.dropped) return
-        runCatching { file.writeText(rewritten.text) }
-            .onSuccess { Log.i(TAG, "dropped the kernel home from the project list") }
-            .onFailure { Log.w(TAG, "could not rewrite the project list: ${it.message}") }
-    }
-
-    /**
-     * Every name of the kernel's home on this device — not just the one this
-     * process happens to write.
-     *
-     * Android shows one directory under two names: `/data/data/<pkg>` and
-     * `/data/user/0/<pkg>` are two mounts of the same tree, the same inode
-     * either way, and which name a path carries depends on how it was written
-     * rather than on where it points. The list is written by the kernel, whose
-     * working directory this shell set from a path it built itself; a lookup
-     * that compared against only one spelling would silently keep the entry
-     * this exists to remove. Both names are compared, so either spelling is
-     * recognised.
-     */
-    private fun homeNames(): Set<String> {
-        val path = home.absolutePath
-        val names = mutableSetOf(path)
-        val user = "/data/user/0/"
-        val data = "/data/data/"
-        when {
-            path.startsWith(user) -> names.add(data + path.removePrefix(user))
-            path.startsWith(data) -> names.add(user + path.removePrefix(data))
-        }
-        return names
-    }
-
-    /** What a rewrite produced, and whether it actually removed anything. */
-    private class Rewrite(val text: String, val dropped: Boolean)
-
-    /**
-     * The list without the home, in whichever shape it arrived, and whether
-     * anything was actually dropped from it.
-     *
-     * The flag matters because `JSONObject` re-serialises: it escapes every
-     * `/` and does not preserve key order, so a round trip never reproduces
-     * the original bytes. Deciding to write on "the text differs" alone would
-     * therefore rewrite the kernel's file on every single launch, log a drop
-     * that never happened, and race the kernel for a file it also writes.
-     */
-    private fun withoutHome(text: String, wrong: Set<String>): Rewrite {
-        if (text.trimStart().startsWith("[")) {
-            val paths = JSONArray(text)
-            val kept = JSONArray()
-            var dropped = false
-            for (i in 0 until paths.length()) {
-                val path = paths.optString(i)
-                if (path in wrong) {
-                    dropped = true
-                    continue
-                }
-                kept.put(path)
-            }
-            return if (dropped) Rewrite(kept.toString(), true) else Rewrite(text, false)
-        }
-        val list = JSONObject(text)
-        val kept = JSONArray()
-        var dropped = false
-        val paths = list.optJSONArray("paths")
-        if (paths != null) {
-            for (i in 0 until paths.length()) {
-                val path = paths.optString(i)
-                if (path in wrong) {
-                    dropped = true
-                    continue
-                }
-                kept.put(path)
-            }
-            if (dropped) list.put("paths", kept)
-        }
-        if (list.optString("launch") in wrong) {
-            list.remove("launch")
-            dropped = true
-        }
-        return if (dropped) Rewrite(list.toString(), true) else Rewrite(text, false)
-    }
-
-    /**
-     * Move the conversations that were filed under the kernel's own home.
-     *
-     * The transcript store is keyed by the workspace root — one directory per
-     * project, under `<state>/projects/<slug>/sessions` — and until this build
-     * the root was the home itself. Splitting the two therefore moves every
-     * existing conversation to a slug nothing looks under, which reads as "my
-     * history is gone" rather than as a reorganisation. So the old directory is
-     * renamed onto the new slug once.
-     *
-     * Renaming the project directory rather than just `sessions/` carries the
-     * rest of it too: `memory/` is filed the same way, and a project's memory
-     * lost while its transcripts were kept would be a stranger failure than
-     * either alone.
-     *
-     * The slug is the absolute path with its separators flattened, which is
-     * what `config.WorkspaceSlug` does on the kernel's side. Only the home's own
-     * slug is touched: a slug for some other folder is left exactly where it is,
-     * because those are projects someone added on purpose.
-     */
-    private fun adoptSessionsFromHome() {
-        val projects = File(home, "projects")
-        if (!projects.isDirectory) return
-        val from = projects.resolve(slugOf(home.absolutePath))
-        if (!from.isDirectory) return
-        val to = projects.resolve(slugOf(workspaceDir.absolutePath))
-        // A target already there means a previous run half-finished, or the
-        // person opened this folder before. Either way its contents win:
-        // merging two transcript directories is not a thing this can do safely,
-        // and the old one is still on disk to be looked at.
-        if (to.exists()) {
-            Log.i(TAG, "${to.name} already exists; leaving ${from.name} in place")
-            return
-        }
-        if (!from.renameTo(to)) {
-            Log.w(TAG, "could not move ${from.name} to ${to.name}; history stays under the old slug")
-        } else {
-            Log.i(TAG, "moved conversations from ${from.name} to ${to.name}")
-        }
-    }
-
-    /** The kernel's `config.WorkspaceSlug`, for the two paths that matter here. */
-    private fun slugOf(path: String): String = path.replace('/', '-').replace('\\', '-').replace(':', '-')
-
-    /**
-     * The launch credential.
-     *
-     * Minted here rather than read from configuration: a credential a person can
-     * set is one anything that can read their files can present. 32 bytes, hex,
-     * the same shape the desktop host mints.
-     */
-    private fun mintToken(): String {
-        val bytes = ByteArray(32)
-        SecureRandom().nextBytes(bytes)
-        val token = bytes.joinToString("") { "%02x".format(it) }
-        tokenFile.parentFile?.mkdirs()
-        tokenFile.writeText("$token\n")
-        // 0600 by intent, and the app's own private directory means it is
-        // already unreachable to every other app on the device.
-        runCatching {
-            tokenFile.setReadable(false, false)
-            tokenFile.setReadable(true, true)
-            tokenFile.setWritable(false, false)
-            tokenFile.setWritable(true, true)
-        }
-        return token
-    }
-
-    /**
-     * Start the child.
-     *
-     * `--addr 127.0.0.1:0` lets the kernel pick a free port; `--port-file`
-     * makes it announce which. `--auth token` is the mode a phone needs: the
-     * page authenticates, and a state-changing request without the credential
-     * is refused. `--no-open` is belt and braces — a serve never opens a
-     * browser, and a phone has no browser to open.
-     */
-    private fun launch(binary: File, token: String): Process {
-        portFile.delete()
-        pidFile.delete()
-        // The folder the agent works in, resolved before the command line is
-        // built so it can be named on it. See the note under the environment
-        // block for why naming it is not the same as setting the directory.
-        val workspace = launchWorkspaceDir()
-        val command = listOf(
-            binary.absolutePath,
-            "serve",
-            "--addr", "127.0.0.1:0",
-            "--auth", "token",
-            "--token-file", tokenFile.absolutePath,
-            "--port-file", portFile.absolutePath,
-            "--pid-file", pidFile.absolutePath,
-            "--no-open",
-            "-page", pageDir.absolutePath,
-            // The project root, said outright. Without this the kernel derives
-            // it from its working directory, and on this phone the two did not
-            // agree: the sidebar named the shared folder, `write_roots` confined
-            // the file tools to the app's own directory, and every write into the
-            // folder the person was looking at came back
-            // `workspace.write_outside_scope`. A flag is a fact the kernel was
-            // told rather than one it inferred from a mount it sees differently.
-            "--dir", workspace.absolutePath,
-        )
-        val builder = ProcessBuilder(command)
-        builder.environment().apply {
-            put("REASONIX_HOME", home.absolutePath)
-            put("HOME", home.absolutePath)
-            // The kernel's own language, for its tool failures, approval
-            // prompts and error sentences. Without this it detects from the
-            // POSIX locale variables, and Android sets none of them for an
-            // app: the kernel then answers in English while the page in front
-            // of the person is Chinese, and every sentence added for a Chinese
-            // reader was dead text. The tag, not the bare language, so a
-            // Traditional Chinese device resolves to zh-TW rather than zh.
-            // An explicit `language` in the kernel's config.toml still wins:
-            // DetectLanguage applies the configured value over this.
-            val languageTag = Locale.getDefault().toLanguageTag()
-            if (languageTag.isNotBlank() && languageTag != "und") {
-                put("REASONIX_LANG", languageTag)
-            }
-            // Android has no /tmp. Everything that wants a scratch directory —
-            // the shell tool, tool output spooling, sqlite journals — reads this.
-            put("TMPDIR", context.cacheDir.absolutePath)
-            // The phone's own DNS servers. A CGO-free Go binary cannot read them
-            // for itself — Android keeps them in `netd`, and Go looks for a
-            // `/etc/resolv.conf` that does not exist — so without this the kernel
-            // resolves nothing and every provider probe reports "连接失败" on a
-            // device whose browser reaches the same address fine.
-            val dns = Dns.servers(context)
-            if (dns.isNotBlank()) {
-                put("REASONIX_DNS", dns)
-                Log.i(TAG, "kernel DNS: $dns (${Dns.describe(context)})")
-                if (Dns.looksLikeDot(dns)) {
-                    // Private DNS (DNS-over-TLS) is on, and it hands back a
-                    // hostname this kernel cannot resolve by definition. Saying
-                    // so here is what turns "连不上" into something actionable.
-                    Log.w(TAG, "kernel DNS looks like a private-DNS hostname; turn private DNS off or set it to automatic")
-                }
-            } else {
-                Log.w(TAG, "kernel DNS: none reported by the system")
-            }
-            // The shell's browser server, when one is listening. The kernel
-            // reads this to bind its browser tools to the shell's WebView
-            // instead of looking for a Chromium binary that does not exist on
-            // a phone. When absent (zero), the variable is not set and the
-            // kernel keeps the browser tools suspended — the correct
-            // degradation for a phone with no engine to drive.
-            val shellPort = browserShellPort
-            if (shellPort > 0) {
-                put("REASONIX_SHELL_BROWSER_PORT", shellPort.toString())
-                // The credential the server checks. Set only alongside the
-                // port: a token with nothing listening would be a variable the
-                // kernel carries for no reason.
-                val shellToken = browserShellToken
-                if (shellToken.isNotBlank()) {
-                    put("REASONIX_SHELL_BROWSER_TOKEN", shellToken)
-                }
-            }
-        }
-        // The agent's folder, not the kernel's. `REASONIX_HOME` above is still
-        // where the config, the sessions and the transcripts live; this is what
-        // the workspace root resolves to, because the kernel reads the working
-        // directory for it.
-        //
-        // The folder the person last opened, when it is still usable — the same
-        // answer the desktop host gives (`launchWorkspace`), and the reason a
-        // phone session used to work in the app's own `files/workspace` while
-        // the sidebar said it was in the shared folder: the launch entry in
-        // `serve-workspaces.json` was written and then ignored, and `write_roots`
-        // is derived from the working directory, so the file tools were confined
-        // to the app's private folder and every write into the shared one was
-        // refused. `workspaceDir` is still the answer for a first run and for a
-        // folder since deleted, but the choice is never silent — see
-        // [launchWorkspaceDir]. `workspace` was resolved above so it could also
-        // be named on the command line.
-        builder.directory(workspace)
-        // `PWD` is what the kernel's own `os.Getwd` prefers: Go uses it whenever
-        // it names the same directory as `.`, which is exactly this case, and it
-        // is the only way to make the kernel resolve its root to the string this
-        // shell chose. Without it `os.Getwd` falls back to the kernel's view of
-        // the mount, and on Android `/storage/emulated/0/...` and the path the
-        // FUSE layer reports for it need not be spelled the same way. The kernel
-        // derives `write_roots` from that root, so the two spellings have to be
-        // the same one.
-        builder.environment().put("PWD", workspace.absolutePath)
-        builder.redirectErrorStream(true)
-        val process = builder.start()
-
-        // The kernel's own log is the only place a startup failure says why, and
-        // a phone has no terminal to read. It is drained on a thread and kept
-        // ring-buffered so the About screen can show the last of it.
-        Thread({ drain(process) }, "kernel-log").apply { isDaemon = true }.start()
-        return process
-    }
-
-    /**
-     * The folder the person last opened, or null when there is not one.
-     *
-     * `serve-workspaces.json` is the kernel's own record of the projects the
-     * sidebar lists, and its `launch` entry is which of them a session starts
-     * in. Both shapes the file has are read — a bare array of paths, and an
-     * object with `paths` and `launch` — because both are written in the wild
-     * and a reader that only knew one would silently fall back.
-     *
-     * The entry has to be one of the listed paths, which is the same rule the
-     * kernel applies when it reads this file (`workspacelist.Read` blanks a
-     * `launch` that is not in `paths`). It matters more here than there: the
-     * working directory decides `write_roots`, so whatever this answers is
-     * where the agent's file tools may write — and on a phone that permission
-     * reaches all of shared storage. A file with a `launch` outside its own
-     * list is one this shell did not write, and it gets the listed answer.
-     *
-     * Null for anything unusable: no file, unreadable JSON, a launch that is
-     * not among the listed folders, an entry that has since been deleted, or a
-     * path that is now a file. Every one of those means the same thing to the
-     * caller — start where this shell always started.
-     */
-    private fun rememberedLaunchDir(): File? {
-        val file = File(home, "serve-workspaces.json")
-        if (!file.isFile) return null
-        val text = runCatching { file.readText() }.getOrNull() ?: return null
-        val launch = runCatching {
-            // A bare array is the file's other shape — the one older kernels
-            // wrote, and therefore the one a person upgrading is most likely to
-            // have. Without this branch `JSONObject(text)` throws on it and the
-            // whole function falls back, which is the same mismatch (the
-            // sidebar naming one folder, the session working in another) this
-            // exists to fix. `withoutHome` below reads both shapes the same way.
-            if (text.trimStart().startsWith("[")) {
-                val arr = JSONArray(text)
-                if (arr.length() == 0) return@runCatching null
-                arr.optString(0)
-            } else {
-                val json = JSONObject(text)
-                val paths = json.optJSONArray("paths")
-                    ?.let { arr -> (0 until arr.length()).mapNotNull { arr.optString(it).takeIf(String::isNotBlank) } }
-                    .orEmpty()
-                if (paths.isEmpty()) return@runCatching null
-                json.optString("launch").takeIf { it.isNotBlank() && it in paths } ?: paths.first()
-            }
-        }.getOrNull()?.takeIf { it.isNotBlank() } ?: return null
-        val dir = runCatching { File(launch) }.getOrNull() ?: return null
-        if (!dir.isDirectory) {
-            // A launch entry this process cannot stat is exactly the failure the
-            // caller exists to avoid, and falling back silently is what made it
-            // take three releases to notice: the session opened in the app's own
-            // folder while the sidebar named the shared one. A phone has no
-            // terminal, so the log is the only place the reason can be said —
-            // and `exists`/`readable` tell apart "deleted" from "not permitted",
-            // which need different answers from the person.
-            Log.w(
-                TAG,
-                "launch entry $launch is not a usable directory " +
-                    "(exists=${dir.exists()}, readable=${dir.canRead()})",
-            )
-            return null
-        }
-        return dir
-    }
-
-    /**
-     * The folder the kernel should start in.
-     *
-     * Either the launch entry — the folder the person last opened, which is
-     * also the one the sidebar shows — or the app's own folder when there is
-     * none. Whichever it is, it is logged, because the two disagreeing is the
-     * bug this exists to fix and a silent choice is what let it survive.
-     */
-    private fun launchWorkspaceDir(): File {
-        val remembered = rememberedLaunchDir()
-        if (remembered != null) {
-            Log.i(TAG, "kernel workspace: ${remembered.absolutePath} (the remembered launch project)")
-            return remembered
-        }
-        Log.i(TAG, "kernel workspace: ${workspaceDir.absolutePath} (no remembered launch project)")
-        return workspaceDir
-    }
-
-    private val logLines = ArrayDeque<String>()
-
-    private fun drain(process: Process) {
-        runCatching {
-            process.inputStream.bufferedReader().useLines { lines ->
-                lines.forEach { line ->
-                    Log.i(TAG, line)
-                    synchronized(logLines) {
-                        logLines.addLast(line)
-                        while (logLines.size > LOG_KEEP) logLines.removeFirst()
-                    }
-                }
-            }
-        }
-    }
-
-    /** The kernel's tail, newest last, for a bug report or the About screen. */
-    fun recentLog(): String = synchronized(logLines) { logLines.joinToString("\n") }
-
-    private fun awaitPort(process: Process): String {
-        val deadline = System.currentTimeMillis() + START_TIMEOUT_MS
-        while (System.currentTimeMillis() < deadline) {
-            if (!process.isAlive) {
-                throw IllegalStateException("内核启动即退出。\n${recentLog().takeLast(2000)}")
-            }
-            val text = if (portFile.isFile) runCatching { portFile.readText().trim() }.getOrNull() else null
-            // The file is written by the kernel on the way to serving, and the
-            // kernel rewrites it with the real port when it was given :0.
-            if (!text.isNullOrBlank() && text.contains(":")) return text
-            Thread.sleep(POLL_MS)
-        }
-        throw IllegalStateException("内核在 ${START_TIMEOUT_MS / 1000}s 内没有报告监听地址。\n${recentLog().takeLast(2000)}")
-    }
-
-    /**
-     * Wait until the bound port answers.
-     *
-     * A port that is open but not yet serving is the normal first second of a
-     * kernel's life; a WebView pointed at it would show a connection error and
-     * cache the failure, so the wait belongs here rather than in the page.
-     */
-    private fun awaitServing(process: Process, origin: String) {
-        val deadline = System.currentTimeMillis() + START_TIMEOUT_MS
-        while (System.currentTimeMillis() < deadline) {
-            if (!process.isAlive) {
-                throw IllegalStateException("内核在开始服务前退出。\n${recentLog().takeLast(2000)}")
-            }
-            if (probe("$origin/")) return
-            Thread.sleep(POLL_MS)
-        }
-        throw IllegalStateException("内核已监听 $origin，但页面没有响应。\n${recentLog().takeLast(2000)}")
-    }
-
-    private fun probe(url: String): Boolean = runCatching {
-        (URL(url).openConnection() as HttpURLConnection).run {
-            connectTimeout = 1000
-            readTimeout = 1000
-            requestMethod = "GET"
-            try {
-                responseCode in 200..399
-            } finally {
-                disconnect()
-            }
-        }
-    }.getOrDefault(false)
-
-    private companion object {
-        const val TAG = "ReasonixKernel"
-        const val LOG_KEEP = 400
-        const val POLL_MS = 120L
-        const val START_TIMEOUT_MS = 30_000L
-    }
-}
@@ -1,139 +0,0 @@
-package io.reasonix.mobile.app
-
-import android.Manifest
-import android.app.Notification
-import android.app.PendingIntent
-import android.app.Service
-import android.content.Context
-import android.content.Intent
-import android.content.pm.PackageManager
-import android.content.pm.ServiceInfo
-import android.os.Build
-import android.os.IBinder
-import androidx.core.app.NotificationCompat
-import androidx.core.app.NotificationManagerCompat
-import androidx.core.app.ServiceCompat
-import androidx.core.content.ContextCompat
-import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.SupervisorJob
-import kotlinx.coroutines.cancel
-import kotlinx.coroutines.launch
-
-/**
- * Keeps the kernel alive while the app is not on screen.
- *
- * The reason this exists at all: an agent turn that takes minutes is a normal
- * turn, and Android reclaims a backgrounded app's child process within seconds
- * of the screen going off. Without the service, pocketing the phone would kill
- * a running task — the one failure mode that makes a phone a bad client for
- * something that works on its own.
- *
- * A foreground service needs a notification the person can see, which is also
- * the honest thing to show: the kernel is running and what it is doing lives on
- * another machine.
- */
-class KernelService : Service() {
-
-    private val scope = CoroutineScope(SupervisorJob() + Dispatchers.Main)
-
-    override fun onBind(intent: Intent?): IBinder? = null
-
-    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
-        // Promoted before `start()`: a service that starts work first and
-        // notifies after has a window in which the system may kill it, and the
-        // work it would have been protecting is exactly what is being started.
-        startForegroundNotification()
-
-        val kernel = (application as App).kernel
-        scope.launch {
-            kernel.start().onFailure { failure ->
-                // A kernel that will not start is a fact the person needs, and a
-                // notification that only ever said "running" would be a lie.
-                notify(SERVICE_NOTICE, getString(R.string.notify_failed_title), failure.message.orEmpty())
-                stopSelf()
-            }
-        }
-        // Sticky, so a kernel killed under memory pressure comes back when there
-        // is room — which is what a person who left a task running expects.
-        return START_STICKY
-    }
-
-    override fun onDestroy() {
-        scope.cancel()
-        super.onDestroy()
-    }
-
-    private fun startForegroundNotification() {
-        val notification = buildNotification(
-            getString(R.string.notify_running_title),
-            getString(R.string.notify_running_body),
-        )
-        // `dataSync` matches the manifest's declaration. On 34+ the type is
-        // mandatory and a mismatch throws, so it is named in both places.
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
-            ServiceCompat.startForeground(
-                this,
-                SERVICE_NOTICE,
-                notification,
-                ServiceInfo.FOREGROUND_SERVICE_TYPE_DATA_SYNC,
-            )
-        } else {
-            startForeground(SERVICE_NOTICE, notification)
-        }
-    }
-
-    private fun buildNotification(title: String, body: String): Notification {
-        val open = PendingIntent.getActivity(
-            this,
-            0,
-            Intent(this, MainActivity::class.java).apply {
-                flags = Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TOP
-            },
-            PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE,
-        )
-        return NotificationCompat.Builder(this, App.CHANNEL_KERNEL)
-            .setSmallIcon(R.drawable.ic_notification)
-            .setContentTitle(title)
-            .setContentText(body)
-            .setContentIntent(open)
-            // The notification is a receipt, not an alarm; swiping it away
-            // leaves the kernel running, which is what the person meant by
-            // swiping it.
-            .setOngoing(false)
-            .setSilent(true)
-            .setPriority(NotificationCompat.PRIORITY_MIN)
-            .build()
-    }
-
-    private fun notify(id: Int, title: String, body: String) {
-        // The notification permission is granted at runtime from Android 13 and
-        // the person can refuse it. Without this check the call throws
-        // SecurityException and takes the service down with it — the opposite of
-        // what a notification that could not be shown should do. Below 13 the
-        // permission does not exist and posting always succeeds.
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU &&
-            ContextCompat.checkSelfPermission(this, Manifest.permission.POST_NOTIFICATIONS) !=
-            PackageManager.PERMISSION_GRANTED
-        ) {
-            return
-        }
-        runCatching {
-            NotificationManagerCompat.from(this).notify(id, buildNotification(title, body))
-        }
-    }
-
-    companion object {
-        private const val SERVICE_NOTICE = 1
-
-        /** Idempotent: called on every start of the activity, and by the boot
-         *  path, and safe to repeat. */
-        fun start(context: Context) {
-            ContextCompat.startForegroundService(context, Intent(context, KernelService::class.java))
-        }
-
-        fun stop(context: Context) {
-            context.stopService(Intent(context, KernelService::class.java))
-        }
-    }
-}
@@ -1,744 +0,0 @@
-package io.reasonix.mobile.app
-
-import android.content.ClipData
-import android.content.ClipboardManager
-import android.content.ContentValues
-import android.content.Context
-import android.content.res.Configuration
-import android.net.Uri
-import android.os.Build
-import android.os.Environment
-import android.os.Handler
-import android.os.Looper
-import android.provider.MediaStore
-import android.webkit.JavascriptInterface
-import android.webkit.MimeTypeMap
-import java.io.File
-import java.util.concurrent.CountDownLatch
-import java.util.concurrent.TimeUnit
-import java.util.concurrent.atomic.AtomicReference
-
-/**
- * What the page can ask the phone for.
- *
- * This is the whole surface, and it is deliberately tiny. Android's
- * `@JavascriptInterface` is a bridge into the app's process from a WebView whose
- * content is a web page: every method here is reachable by anything that can run
- * script in that page, so each one is written as a verb with no address
- * parameter it does not need, and none of them can name a path outside the
- * kernel's own home.
- *
- * It is deliberately *not* the Electron preload bridge. That one exposes window
- * management, a filesystem walker, an editor launcher and a browser view host —
- * all of which are meaningless on a phone, and the two that were not (open a URL,
- * save a file) already have a way to happen here: `WebViewClient` routes external
- * links to the browser, and the page's own download reaches the WebView's
- * `DownloadListener`.
- *
- * The one thing a phone must add is `importIntoHome`: the kernel runs on this
- * device and can only read paths under its own home, so a private key the person
- * has in their Documents folder has to be copied across. Nothing else the page
- * wants is out of its reach.
- */
-class NativeBridge(
-    private val context: Context,
-    private val kernel: Kernel,
-    private val onOpen: (String) -> Unit,
-) {
-
-    /**
-     * Whether the document calling may use this bridge.
-     *
-     * `addJavascriptInterface` makes the object reachable from whatever page the
-     * WebView holds, so a link the model produced — or a cleartext page on the
-     * LAN — would otherwise get `importIntoHome`, `pickFolder`, `hostCall` and
-     * the clipboard. The activity answers by comparing the main frame's origin
-     * against the kernel's and the one paired computer the person confirmed.
-     *
-     * Anything that reaches the device checks this first. The five methods that
-     * do not — version, systemTheme, safeArea, setLayerOpen, setRunning — report
-     * back what the page already knows about its own window and grant nothing.
-     */
-    var trusted: () -> Boolean = { false }
-
-    /** The version the page reads to decide whether this bridge is the one it
-     *  knows. Bumped when a method's contract changes, not when one is added. */
-    @JavascriptInterface
-    fun version(): String = BRIDGE_VERSION
-
-    /**
-     * Copy a file the person picks into the kernel's home, answering with its
-     * path there — or "" when they dismissed the picker.
-     *
-     * `kind` names the directory inside the home, because that is a fact about
-     * the kernel's layout and not about the file: an SSH private key belongs in
-     * `.ssh`, and a dotenv the kernel reads for passphrases belongs at the root
-     * of the home where `config.Load` looks for it.
-     *
-     * The path that comes back is *inside the home*, never the document
-     * provider's URI. That is the point: the kernel is a child process with no
-     * access to the provider, so a `content://` would be a path it cannot open.
-     */
-    @JavascriptInterface
-    fun importIntoHome(kind: String, name: String): String {
-        if (!trusted()) return ""
-        val dir = when (kind) {
-            "identity" -> File(kernel.homeDir(), ".ssh")
-            "env" -> kernel.homeDir()
-            else -> return ""
-        }
-        val safeName = sanitise(name)
-        if (safeName.isEmpty()) return ""
-
-        val picked = pickFile() ?: return ""
-        return try {
-            dir.mkdirs()
-            val target = File(dir, safeName)
-            context.contentResolver.openInputStream(picked)?.use { input ->
-                target.outputStream().use { output -> input.copyTo(output) }
-            } ?: return ""
-            // A private key with group or world read is one OpenSSH refuses to
-            // use, and the refusal reads as "bad permissions" from a long way
-            // away. Setting it here is what makes the file usable at all.
-            if (kind == "identity") {
-                runCatching {
-                    target.setReadable(false, false)
-                    target.setReadable(true, true)
-                    target.setWritable(false, false)
-                    target.setWritable(true, true)
-                }
-            }
-            target.absolutePath
-        } catch (_: Exception) {
-            // A copy that failed leaves nothing behind; the caller sees "" and
-            // the person can try again.
-            ""
-        }
-    }
-
-    /**
-     * Open a URL in the device's browser.
-     *
-     * The page asks for this when a link points somewhere outside the kernel —
-     * a provider's console, a documentation page — and loading it in place would
-     * strand the person in a window with no address bar and no way back.
-     */
-    @JavascriptInterface
-    fun openExternal(url: String) {
-        if (!trusted()) return
-        // Only what a browser can open. A `file://` or `content://` here would
-        // be the page reaching into the device through a method named for
-        // leaving it.
-        if (!url.startsWith("http://") && !url.startsWith("https://")) return
-        onOpen(url)
-    }
-
-    /** Put text on the clipboard. A WebView's own `navigator.clipboard` write is
-     *  gated behind a permission Android grants only to a focused document, so
-     *  the one thing the page actually offers to copy — a token, a command, a
-     *  path — has no other way out.
-     *
-     *  Answers whether the write landed. A platform that refuses it raises
-     *  rather than answering, and an exception must not cross
-     *  `@JavascriptInterface` as a silent success — the page would say 已复制
-     *  over an empty clipboard. Caught here, the answer is the one the caller
-     *  can act on: false, and the button says 复制失败 instead. */
-    @JavascriptInterface
-    fun copyText(text: String): Boolean = if (!trusted()) false else runCatching {
-        val clipboard = context.getSystemService(Context.CLIPBOARD_SERVICE) as ClipboardManager
-        clipboard.setPrimaryClip(ClipData.newPlainText("reasonix", text))
-    }.isSuccess
-
-    /**
-     * Write text where the person picks, and answer with the path it went to.
-     *
-     * The page's own route to a file — a blob URL on an `<a download>` — reaches
-     * nothing here: a WebView has no downloads shelf, and its `DownloadListener`
-     * fires only for a real navigation, not for a blob the page just built. So
-     * the text crosses the bridge and the shell opens the system's document
-     * picker, which is also the only way to reach a folder the person can find
-     * again afterwards.
-     *
-     * "" is a dismissal, the same answer `importIntoHome` gives, and the page
-     * reads the two the same way.
-     */
-    /**
-     * Put a copy of a file where a phone's own file manager will show it.
-     *
-     * `saveText` asks the person where to put it, which is the right question
-     * on a desktop and the wrong one here: the kernel's workspace is
-     * app-private storage, so the file someone wants is in a place no file
-     * manager can open, and a picker that starts at "recent" is another place
-     * to lose it. This answers the actual question — "where is it" — by
-     * putting it in Downloads, in a folder named after the app, under a name
-     * that is the file's own.
-     *
-     * The answer is the path relative to shared storage, so the page can say
-     * where the file went rather than only that it worked. "" means the write
-     * failed or the platform refused it.
-     *
-     * MediaStore on Android 10 and later, a plain file before that. The two
-     * are not interchangeable: from 10 the app may not write another app's
-     * files directly, and MediaStore is the only way in; before it there is no
-     * MediaStore collection for downloads and the public directory is writable
-     * with the storage permission this app does not ask for, so that branch is
-     * best-effort and says so by answering "".
-     */
-    @JavascriptInterface
-    fun exportToDownloads(name: String, content: String): String {
-        if (!trusted()) return ""
-        val safeName = sanitise(name).ifEmpty { "reasonix.txt" }
-        return exportFile(safeName, content).orEmpty()
-    }
-
-    @JavascriptInterface
-    fun saveText(name: String, content: String): String {
-        if (!trusted()) return ""
-        val safeName = sanitise(name).ifEmpty { "reasonix.txt" }
-        return saveFile(safeName, content) ?: ""
-    }
-
-    /**
-     * Hand text to whatever the device shares with — a chat app, the mail
-     * client, a note app.
-     *
-     * The share sheet rather than a second save dialog: "where is that file"
-     * is the question this answers, and on a phone a document someone wants to
-     * keep or send usually goes through one of those apps rather than a folder.
-     *
-     * Shared as text with the filename as its subject, which is what every
-     * target understands. A file attachment would need a `FileProvider` and a
-     * cache copy for the same words to arrive.
-     */
-    @JavascriptInterface
-    fun shareText(name: String, content: String): Boolean {
-        if (!trusted()) return false
-        val safeName = sanitise(name).ifEmpty { "reasonix.txt" }
-        val posted = java.util.concurrent.CountDownLatch(1)
-        var ok = false
-        main.post {
-            ok = runCatching { askForShare(safeName, content) }.getOrDefault(false)
-            posted.countDown()
-        }
-        runCatching { posted.await(SHARE_TIMEOUT_SECONDS, TimeUnit.SECONDS) }
-        return ok
-    }
-
-    /**
-     * The device's own light/dark answer.
-     *
-     * The page resolves its theme from `localStorage` first and only asks the
-     * system when nothing is saved, so this is what makes a fresh install match
-     * the phone instead of defaulting to light.
-     */
-    @JavascriptInterface
-    fun systemTheme(): String {
-        val night = context.resources.configuration.uiMode and Configuration.UI_MODE_NIGHT_MASK
-        return if (night == Configuration.UI_MODE_NIGHT_YES) "dark" else "light"
-    }
-
-    /**
-     * The window's real safe-area insets, in CSS pixels, as
-     * `top,right,bottom,left`.
-     *
-     * A WebView does not implement `env(safe-area-inset-*)`: those are an iOS
-     * Safari feature, and on Android every one of them resolves to `0`. So a
-     * page that pads itself with them — which `mobile.css` does — is un-padded
-     * on exactly the platform this shell exists for, and the first line of the
-     * interface sits under the status bar.
-     *
-     * The values have to come from here for a second reason too: from Android 15
-     * the window is edge-to-edge whether the app asks for it or not, so the bars
-     * really are drawn over the page and there is no window-manager switch that
-     * could move the content back down.
-     *
-     * Answered as a string because that is what crosses the bridge; the page
-     * sets it as a CSS custom property and `mobile.css` reads it.
-     */
-    @JavascriptInterface
-    fun safeArea(): String {
-        val insets = onInsets?.invoke() ?: return "0,0,0,0"
-        return "${insets.left},${insets.top},${insets.right},${insets.bottom}"
-    }
-
-    /**
-     * Read the pairing code a computer is showing.
-     *
-     * A phone cannot type what a computer renders as a QR code — it is a
-     * one-time code inside a URL, and the whole reason it is a picture is that
-     * nobody reads one aloud. So the page asks for the camera and gets the text
-     * back, which is the same direction the computer's own dialog describes.
-     *
-     * The answer is the code's own text, not a parsed result: what a pairing
-     * fragment means is the page's to decide, and it already knows how — the
-     * `#pair=` handling ships with the interface.
-     */
-    @JavascriptInterface
-    fun scanPairingCode(): String = if (!trusted()) "" else scanWithCamera()
-
-    /**
-     * Load a URL in this window instead of handing it to the browser.
-     *
-     * The page asks for this once, right after a scan: the code it read points at
-     * the computer's own Studio, and the whole point of scanning is to end up
-     * looking at that computer. Going out to a browser would leave the app on one
-     * screen and the paired machine on another, with the back gesture an exit
-     * rather than a return.
-     *
-     * Only http and https are accepted. The page is this repository's own build
-     * and is trusted, but a scanner reads whatever is held in front of it, so the
-     * one value that arrives here from outside is checked: a `file://` or
-     * `javascript:` that happened to be on a printed code must not become a
-     * navigation.
-     */
-    @JavascriptInterface
-    fun openInApp(url: String) {
-        if (!trusted()) return
-        val trimmed = url.trim()
-        if (!trimmed.startsWith("http://") && !trimmed.startsWith("https://")) return
-        main.post { onOpenInApp?.invoke(trimmed) }
-    }
-
-    /** How the activity loads a URL in the window it owns. Set by the activity. */
-    var onOpenInApp: ((String) -> Unit)? = null
-
-    // ---- the native browser view host bridge ----
-    //
-    // The page's `host.ts` looks for `window.reasonixHost` with Promise-based
-    // methods (showBrowserView, hideBrowserView, etc.). `@JavascriptInterface`
-    // is synchronous, so the round trip is: JS generates an id, calls
-    // `hostCall(id, method, args)`, Kotlin does the work asynchronously, then
-    // pushes the result back via `evaluateJavascript` calling
-    // `window.__reasonixHostReply(id, json)`. The injected script (in
-    // MainActivity) wires each Promise to that reply channel.
-
-    /** How the activity handles an async host call. Set by the activity. */
-    var onHostCall: ((id: String, method: String, args: String) -> Unit)? = null
-
-    /**
-     * Entry point for the page's `window.reasonixHost` Promise methods.
-     *
-     * `id` is a unique call identifier the JS side generated; `method` is the
-     * method name (e.g. "showBrowserView"); `args` is the JSON-encoded argument
-     * array. The activity handles the call asynchronously and replies through
-     * `evaluateJavascript` with `window.__reasonixHostReply(id, resultJson)`.
-     */
-    @JavascriptInterface
-    fun hostCall(id: String, method: String, args: String) {
-        if (!trusted()) return
-        onHostCall?.invoke(id, method, args)
-    }
-
-    /**
-     * Whether the page has a panel up that the back gesture should close first.
-     *
-     * Written by the page, read by the activity's back handler. The page owns the
-     * answer — it is the only thing that knows what is open, and a second
-     * implementation of that question in the shell would be one that drifts — so
-     * the page reports the fact and the shell keeps the action.
-     *
-     * Volatile because the two ends are on different threads: the page sets it
-     * from the WebView's JavaScript thread, the back gesture reads it on the main
-     * one, and a stale read here is a panel that does not close.
-     */
-    @Volatile
-    var layerOpen: Boolean = false
-        private set
-
-    @JavascriptInterface
-    fun setLayerOpen(open: Boolean) {
-        layerOpen = open
-    }
-
-    // ---- the picker, which is an Activity result in a synchronous world ----
-
-    private val pending = AtomicReference<Uri?>(null)
-    private val latch = AtomicReference<CountDownLatch?>(null)
-
-    /** The code the camera read, held between the activity's answer and the
-     *  wait below — the same round trip the file picker takes. */
-    private val scanned = AtomicReference<String?>(null)
-    private val scanLatch = AtomicReference<CountDownLatch?>(null)
-
-    /** The main thread, because starting an Activity result must happen there. */
-    private val main = Handler(Looper.getMainLooper())
-
-    /**
-     * How to ask for a file. Set by the activity, which owns the Activity Result
-     * API; it answers whether the ask was dispatched, not whether the person
-     * picked anything — that arrives through `deliver`.
-     */
-    var askForFile: () -> Boolean = { false }
-
-    /**
-     * How the activity reports the window's insets. Set by the activity, which is
-     * the only thing that can see them, and asked on every call rather than
-     * cached — a rotation, a fold, or the keyboard opening all change them, and a
-     * stale answer here is a stripe of interface under the status bar.
-     */
-    var onInsets: (() -> Insets?)? = null
-
-    /**
-     * How to open the camera. Set by the activity, which owns the Activity
-     * Result API; like `askForFile` it answers whether the ask was dispatched,
-     * and the code itself arrives through `deliverScan`.
-     */
-    var askForScan: () -> Boolean = { false }
-
-    /**
-     * How to put a file where the person picks. Set by the activity, which owns
-     * the Activity Result API; it answers whether the ask was dispatched, and
-     * the chosen place arrives through `deliverSave`.
-     */
-    var askForSave: (name: String, content: String) -> Boolean = { _, _ -> false }
-
-    /**
-     * How to open the share sheet. Set by the activity, which is the only thing
-     * that can start an Intent; it answers whether anything on the device took
-     * the text.
-     */
-    var askForShare: (name: String, content: String) -> Boolean = { _, _ -> false }
-
-    /** The place the save dialog answered with, held between the two halves. */
-    private val saveTarget = AtomicReference<Uri?>(null)
-    private val saveLatch = AtomicReference<CountDownLatch?>(null)
-
-    /**
-     * Ask where to put a file and write it there.
-     *
-     * The same latch round trip as `pickFile`, and for the same reason:
-     * `@JavascriptInterface` cannot suspend, so the WebView's thread waits while
-     * the picker is open — a modal panel the person is looking at.
-     */
-    private fun saveFile(name: String, content: String): String? {
-        val gate = CountDownLatch(1)
-        saveLatch.set(gate)
-        saveTarget.set(null)
-
-        val posted = CountDownLatch(1)
-        var dispatched = false
-        main.post {
-            dispatched = runCatching { askForSave(name, content) }.getOrDefault(false)
-            posted.countDown()
-        }
-        val ready = runCatching { posted.await(PICK_TIMEOUT_SECONDS, TimeUnit.SECONDS) }.getOrDefault(false)
-        if (!ready || !dispatched) {
-            saveLatch.set(null)
-            return null
-        }
-        return try {
-            if (!gate.await(PICK_TIMEOUT_SECONDS, TimeUnit.SECONDS)) null
-            else saveTarget.get()?.toString()
-        } catch (_: InterruptedException) {
-            null
-        } finally {
-            saveLatch.set(null)
-        }
-    }
-
-    /** Called by the activity once the bytes are written. A null uri is a dismissal. */
-    fun deliverSave(uri: Uri?) {
-        saveTarget.set(uri)
-        saveLatch.get()?.countDown()
-    }
-
-    /**
-     * Read the pairing code a computer is showing, and return it.
-     *
-     * The same shape as `pickFile` and for the same reason: a
-     * `@JavascriptInterface` method is called on the WebView's thread and must
-     * return a value, so the camera is opened on the main thread and this one
-     * waits. The block lasts as long as the person is aiming, which is why the
-     * timeout is generous — a scan that gave up after a few seconds would be
-     * one nobody could complete.
-     *
-     * An empty string is "no code", which is what a refusal, a cancellation and
-     * a timeout all are. The caller acts on the text, so a distinct error would
-     * only be a fourth way to say the same thing.
-     */
-    private fun scanWithCamera(): String {
-        val gate = CountDownLatch(1)
-        scanLatch.set(gate)
-        scanned.set(null)
-
-        val posted = CountDownLatch(1)
-        var dispatched = false
-        main.post {
-            dispatched = runCatching { askForScan() }.getOrDefault(false)
-            posted.countDown()
-        }
-        val ready = runCatching { posted.await(SCAN_TIMEOUT_SECONDS, TimeUnit.SECONDS) }.getOrDefault(false)
-        if (!ready || !dispatched) {
-            scanLatch.set(null)
-            return ""
-        }
-        return try {
-            if (!gate.await(SCAN_TIMEOUT_SECONDS, TimeUnit.SECONDS)) "" else scanned.get().orEmpty()
-        } catch (_: InterruptedException) {
-            ""
-        } finally {
-            scanLatch.set(null)
-        }
-    }
-
-    /** Called by the activity when the scanner answers. Null is a dismissal. */
-    fun deliverScan(text: String?) {
-        scanned.set(text)
-        scanLatch.get()?.countDown()
-    }
-
-    /**
-     * Ask for one file and wait for the answer.
-     *
-     * `@JavascriptInterface` methods cannot suspend: the WebView calls them on
-     * its own thread and expects a value back. So the ask is posted to the main
-     * thread and this one waits on a latch. The cost is a blocked JS thread for
-     * as long as the picker is open — which is a modal panel the person is
-     * looking at, with nothing else in the page running.
-     *
-     * A timeout is set rather than waiting forever: a picker that never answers
-     * (the activity destroyed underneath it) would otherwise pin a WebView
-     * thread until the process died.
-     */
-    private fun pickFile(): Uri? {
-        val gate = CountDownLatch(1)
-        latch.set(gate)
-        pending.set(null)
-
-        val posted = CountDownLatch(1)
-        var dispatched = false
-        main.post {
-            dispatched = runCatching { askForFile() }.getOrDefault(false)
-            posted.countDown()
-        }
-        val ready = runCatching { posted.await(PICK_TIMEOUT_SECONDS, TimeUnit.SECONDS) }.getOrDefault(false)
-        if (!ready || !dispatched) {
-            latch.set(null)
-            return null
-        }
-
-        return try {
-            if (!gate.await(PICK_TIMEOUT_SECONDS, TimeUnit.SECONDS)) null else pending.get()
-        } catch (_: InterruptedException) {
-            null
-        } finally {
-            latch.set(null)
-        }
-    }
-
-    /** Called by the activity when the picker answers. A null uri is a dismissal. */
-    fun deliver(uri: Uri?) {
-        pending.set(uri)
-        latch.get()?.countDown()
-    }
-
-    /** The folder under Downloads that this app's exports land in. */
-    private fun exportFolder(): String = "Reasonix"
-
-    /** The MIME type this name declares, or null when the platform does not know
-     *  it.
-     *
-     * Where the type is written, the name and the type agree, and that agreement
-     * is the whole fix: `.md` is answered `text/markdown` here, so MediaStore
-     * has nothing to correct and the export stays `报告.md` instead of being
-     * renamed `报告.md.txt` by the `text/plain` it used to be given. Where the
-     * type is unknown the field is left off, which leaves MediaStore to derive
-     * the same `application/octet-stream` it would have been told — the name
-     * still stands on its own, which is all this is for. */
-    private fun mimeFor(name: String): String? {
-        val ext = name.substringAfterLast('.', "").lowercase()
-        if (ext.isEmpty() || ext == name.lowercase()) return null
-        return runCatching { MimeTypeMap.getSingleton().getMimeTypeFromExtension(ext) }.getOrNull()
-    }
-
-    private fun exportFile(name: String, content: String): String? = runCatching {
-        val bytes = content.toByteArray(Charsets.UTF_8)
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
-            val resolver = context.contentResolver
-            val values = ContentValues().apply {
-                put(MediaStore.Downloads.DISPLAY_NAME, name)
-                // The type is derived here rather than declared, and it is
-                // written only when the name really has an extension that maps
-                // to one.
-                //
-                // It used to be `text/plain` for everything, and MediaStore
-                // answers a name whose extension disagrees with the declared
-                // type by appending its own: exporting `报告.md` landed in
-                // Downloads as `报告.md.txt`, and any source file came out with
-                // the wrong second extension. Deriving the type from the name
-                // instead keeps the two in agreement — which is what stops the
-                // rename — and a name the platform has no type for is left off
-                // entirely rather than declared as `application/octet-stream`,
-                // so nothing is corrected there either.
-                mimeFor(name)?.let { put(MediaStore.Downloads.MIME_TYPE, it) }
-                put(
-                    MediaStore.Downloads.RELATIVE_PATH,
-                    Environment.DIRECTORY_DOWNLOADS + "/" + exportFolder(),
-                )
-                // Hidden until the bytes are all there, so a file manager that
-                // reads the folder mid-write cannot show half a document.
-                put(MediaStore.Downloads.IS_PENDING, 1)
-            }
-            val uri = resolver.insert(MediaStore.Downloads.EXTERNAL_CONTENT_URI, values)
-                ?: return@runCatching null
-            resolver.openOutputStream(uri)?.use { it.write(bytes) } ?: return@runCatching null
-            values.clear()
-            values.put(MediaStore.Downloads.IS_PENDING, 0)
-            resolver.update(uri, values, null, null)
-            "${Environment.DIRECTORY_DOWNLOADS}/${exportFolder()}/$name"
-        } else {
-            val dir = File(
-                Environment.getExternalStoragePublicDirectory(Environment.DIRECTORY_DOWNLOADS),
-                exportFolder(),
-            )
-            if (!dir.exists() && !dir.mkdirs()) return@runCatching null
-            val target = File(dir, name)
-            target.writeBytes(bytes)
-            target.absolutePath
-        }
-    }.getOrNull()
-
-    private fun sanitise(name: String): String {
-        // A name from the page is used as a filename, so it is reduced to one:
-        // no separators, no traversal, and nothing a filesystem treats as
-        // special. The default is the name the field it came from suggests.
-        val trimmed = name.trim().substringAfterLast('/').substringAfterLast('\\')
-        if (trimmed.isEmpty() || trimmed == "." || trimmed == "..") return ""
-        return trimmed.filter { it.isLetterOrDigit() || it in "._-" }.take(64)
-    }
-
-    /**
-     * Whether a turn is running, so the screen can be kept awake for one.
-     *
-     * The page owns the answer — it is the only thing that knows if the kernel
-     * is working — and the shell owns the flag, because a window flag is not
-     * something a page can set. Nothing is asked at launch: a window that is
-     * merely open is one the person may be reading, and holding the screen on
-     * for that is holding it on for nothing.
-     */
-    @JavascriptInterface
-    fun setRunning(running: Boolean) {
-        onRunning?.invoke(running)
-    }
-
-    /** How the activity applies that flag. Set by the activity. */
-    var onRunning: ((Boolean) -> Unit)? = null
-
-    /**
-     * Whether the app may read every file, which is what lets the kernel open a
-     * folder on this phone as a workspace.
-     *
-     * Asked rather than assumed: the permission is granted by hand in system
-     * settings, so the page has to be able to say "not yet" rather than fail on
-     * the first `stat`. Answered `true` below API 30, where ordinary read
-     * permission is enough and the concept does not exist.
-     */
-    @JavascriptInterface
-    fun hasAllFilesAccess(): Boolean = filesAccess?.invoke() ?: true
-
-    var filesAccess: (() -> Boolean)? = null
-
-    /** Open the system page where that permission is granted. The only place
-     *  Android offers it — there is no dialog for this one. */
-    @JavascriptInterface
-    fun requestAllFilesAccess() {
-        if (!trusted()) return
-        askForFilesAccess?.invoke()
-    }
-
-    var askForFilesAccess: (() -> Unit)? = null
-
-    /**
-     * Whether this app is exempt from the system's battery optimisation.
-     *
-     * A turn runs in a child process under a foreground service. Under doze the
-     * whole app group is frozen anyway, so the turn stops making progress while
-     * the screen is off — which is the state the person left it in on purpose.
-     * Unrestricted is the answer, and it is a question Android answers.
-     */
-    @JavascriptInterface
-    fun batteryUnrestricted(): Boolean = if (!trusted()) false else (batteryFree?.invoke() ?: true)
-
-    var batteryFree: (() -> Boolean)? = null
-
-    /** Ask for that exemption. Unlike the storage one, this has a real dialog. */
-    @JavascriptInterface
-    fun requestBatteryUnrestricted() {
-        if (!trusted()) return
-        askForBattery?.invoke()
-    }
-
-    var askForBattery: (() -> Unit)? = null
-
-    /**
-     * Ask for a folder on this phone and answer with its real filesystem path.
-     *
-     * "" is a dismissal, the same answer `importIntoHome` gives — and, unlike
-     * that one, an empty string is a normal outcome here rather than a failure.
-     * The `startIn` hint is a path the kernel knows; the picker may ignore it,
-     * which is the picker's business.
-     *
-     * The round trip is the same latch as `pickFile`, for the same reason: a
-     * document-tree picker is another activity, and this call cannot suspend.
-     */
-    @JavascriptInterface
-    fun pickFolder(startIn: String): String {
-        if (!trusted()) return ""
-        val gate = CountDownLatch(1)
-        folderLatch.set(gate)
-        folderPending.set(null)
-
-        val posted = CountDownLatch(1)
-        var dispatched = false
-        main.post {
-            dispatched = runCatching { askForFolder(startIn) }.getOrDefault(false)
-            posted.countDown()
-        }
-        val ready = runCatching { posted.await(PICK_TIMEOUT_SECONDS, TimeUnit.SECONDS) }.getOrDefault(false)
-        if (!ready || !dispatched) {
-            folderLatch.set(null)
-            return ""
-        }
-        return try {
-            if (!gate.await(PICK_TIMEOUT_SECONDS, TimeUnit.SECONDS)) "" else folderPending.get().orEmpty()
-        } catch (_: InterruptedException) {
-            ""
-        } finally {
-            folderLatch.set(null)
-        }
-    }
-
-    var askForFolder: (String) -> Boolean = { false }
-
-    private val folderPending = AtomicReference<String?>(null)
-    private val folderLatch = AtomicReference<CountDownLatch?>(null)
-
-    /** Called by the activity with the folder's real path, or null on dismissal. */
-    fun deliverFolder(path: String?) {
-        folderPending.set(path ?: "")
-        folderLatch.get()?.countDown()
-    }
-
-    companion object {
-        const val BRIDGE_VERSION = "4"
-        private const val PICK_TIMEOUT_SECONDS = 5L * 60
-
-        /** Long, because this is however long someone takes to aim. A shorter
-         *  one would turn "still lining it up" into a failed scan. */
-        private const val SCAN_TIMEOUT_SECONDS = 5L * 60
-
-        /** Only as long as the sheet takes to appear: the answer is "something
-         *  took it", which is known the moment the Intent resolves. */
-        private const val SHARE_TIMEOUT_SECONDS = 15L
-    }
-}
-
-/**
- * The window's insets, in CSS pixels.
- *
- * A named type rather than four numbers because the page reads them as one
- * thing: half an inset is a layout that is wrong in one direction, and a caller
- * that passed the wrong pair would be indistinguishable from a device with no
- * cutout at all.
- */
-data class Insets(val left: Int, val top: Int, val right: Int, val bottom: Int)
@@ -1,66 +0,0 @@
-package io.reasonix.mobile.app
-
-import androidx.camera.core.ImageProxy
-import com.google.zxing.BarcodeFormat
-import com.google.zxing.BinaryBitmap
-import com.google.zxing.DecodeHintType
-import com.google.zxing.MultiFormatReader
-import com.google.zxing.PlanarYUVLuminanceSource
-import com.google.zxing.common.HybridBinarizer
-
-/**
- * Reading a QR code out of one camera frame.
- *
- * ZXing core and nothing else: it is pure Java, so it runs identically on a
- * phone with Google Play Services and on one whose HarmonyOS compatibility
- * layer has none. A decoder that leaned on ML Kit would work on the machine it
- * was written on and fail on the one that needs it.
- *
- * The frame arrives as YUV_420_888, whose Y plane is already the greyscale
- * bitmap ZXing wants — no conversion, no colour maths, just the bytes. That is
- * the whole reason a phone can decode 30 frames a second without warming up.
- */
-object Qr {
-
-    private val reader = MultiFormatReader().apply {
-        setHints(
-            mapOf(
-                // Only the form the computer actually renders. Leaving the
-                // reader open to every 1D barcode makes each frame slower for
-                // a case that cannot occur, and a slower frame is a code that
-                // has already left the viewfinder.
-                DecodeHintType.POSSIBLE_FORMATS to listOf(BarcodeFormat.QR_CODE),
-                DecodeHintType.TRY_HARDER to true,
-            ),
-        )
-    }
-
-    /** The code's text, or null when this frame holds none. */
-    fun decode(image: ImageProxy): String? {
-        val plane = image.planes.firstOrNull() ?: return null
-        val buffer = plane.buffer
-        val data = ByteArray(buffer.remaining())
-        buffer.get(data)
-        // `rowStride` is padded to a hardware alignment and is usually wider
-        // than the picture. Passing the width as the row length is what tells
-        // ZXing where each row actually ends; getting it wrong shears the image
-        // and every code reads as garbage.
-        val source = PlanarYUVLuminanceSource(
-            data,
-            plane.rowStride,
-            image.height,
-            0,
-            0,
-            image.width,
-            image.height,
-            false,
-        )
-        return runCatching {
-            reader.decodeWithState(BinaryBitmap(HybridBinarizer(source))).text
-        }.getOrNull().also {
-            // The reader keeps per-frame state between calls; resetting is what
-            // stops a partial match in one frame from corrupting the next.
-            reader.reset()
-        }
-    }
-}
@@ -1,146 +0,0 @@
-package io.reasonix.mobile.app
-
-import android.Manifest
-import android.content.Intent
-import android.content.pm.PackageManager
-import android.os.Bundle
-import android.view.Gravity
-import android.view.ViewGroup
-import android.widget.FrameLayout
-import android.widget.TextView
-import androidx.activity.result.contract.ActivityResultContracts
-import androidx.appcompat.app.AppCompatActivity
-import androidx.camera.core.CameraSelector
-import androidx.camera.core.ImageAnalysis
-import androidx.camera.core.ImageProxy
-import androidx.camera.core.Preview
-import androidx.camera.lifecycle.ProcessCameraProvider
-import androidx.camera.view.PreviewView
-import androidx.core.content.ContextCompat
-import java.util.concurrent.Executors
-
-/**
- * The camera, held open just long enough to read one pairing code.
- *
- * A phone that wants to drive a computer cannot type the code that computer
- * shows: it is a base64 fragment inside a URL, and the whole point of showing it
- * as a QR code is that nobody reads one aloud. So this is the way in — the same
- * gesture the computer's own dialog asks for, from the other side.
- *
- * The decode is ZXing rather than ML Kit on purpose. ML Kit needs Google Play
- * Services, and this app installs on phones whose HarmonyOS compatibility layer
- * has none: a GMS-backed scanner would work on a developer's phone and fail on
- * the device that needs it. ZXing core is pure Java, so the scanner behaves the
- * same on both.
- *
- * It returns the first code it reads and finishes. A pairing code is
- * single-use and short-lived, so "keep scanning after a hit" is not a feature —
- * it is a way to spend a code that a later frame would have discarded.
- */
-class ScanActivity : AppCompatActivity() {
-
-    private lateinit var preview: PreviewView
-    private lateinit var hint: TextView
-    private val executor = Executors.newSingleThreadExecutor()
-
-    /** Set once a code is found, so the frames in flight behind it do not each
-     *  try to finish the activity. */
-    @Volatile
-    private var settled = false
-
-    private val requestCamera = registerForActivityResult(ActivityResultContracts.RequestPermission()) { granted ->
-        if (granted) start() else refuse()
-    }
-
-    override fun onCreate(savedInstanceState: Bundle?) {
-        super.onCreate(savedInstanceState)
-        val root = FrameLayout(this)
-        preview = PreviewView(this).apply {
-            layoutParams = FrameLayout.LayoutParams(
-                ViewGroup.LayoutParams.MATCH_PARENT,
-                ViewGroup.LayoutParams.MATCH_PARENT,
-            )
-            // The frames are analysed, not composed: filling the view and
-            // cropping is right here and would be wrong for a camera app.
-            scaleType = PreviewView.ScaleType.FILL_CENTER
-        }
-        hint = TextView(this).apply {
-            text = getString(R.string.scan_hint)
-            setTextColor(0xFFFFFFFF.toInt())
-            textSize = 14f
-            gravity = Gravity.CENTER
-            val pad = (16 * resources.displayMetrics.density).toInt()
-            setPadding(pad, pad, pad, pad)
-            // Readable over whatever the camera is pointing at, which is the
-            // one background a design system cannot choose.
-            setBackgroundColor(0x99000000.toInt())
-            layoutParams = FrameLayout.LayoutParams(
-                ViewGroup.LayoutParams.MATCH_PARENT,
-                ViewGroup.LayoutParams.WRAP_CONTENT,
-                Gravity.BOTTOM,
-            )
-        }
-        root.addView(preview)
-        root.addView(hint)
-        setContentView(root)
-
-        if (ContextCompat.checkSelfPermission(this, Manifest.permission.CAMERA) ==
-            PackageManager.PERMISSION_GRANTED
-        ) {
-            start()
-        } else {
-            requestCamera.launch(Manifest.permission.CAMERA)
-        }
-    }
-
-    private fun refuse() {
-        // No dialog of our own: the permission prompt already said no, and a
-        // second window repeating it is one more tap to dismiss. The caller
-        // gets the same answer as a cancelled scan.
-        setResult(RESULT_CANCELED)
-        finish()
-    }
-
-    private fun start() {
-        val providerFuture = ProcessCameraProvider.getInstance(this)
-        providerFuture.addListener({
-            val provider = runCatching { providerFuture.get() }.getOrNull() ?: return@addListener refuse()
-            val previewUseCase = Preview.Builder().build().also { it.setSurfaceProvider(preview.surfaceProvider) }
-            val analysis = ImageAnalysis.Builder()
-                // Only the newest frame matters: a stale one describes where the
-                // camera was, and a code that has already left the viewfinder
-                // must not win over one that is in it now.
-                .setBackpressureStrategy(ImageAnalysis.STRATEGY_KEEP_ONLY_LATEST)
-                .build()
-                .also { it.setAnalyzer(executor, ::analyse) }
-            runCatching {
-                provider.unbindAll()
-                provider.bindToLifecycle(this, CameraSelector.DEFAULT_BACK_CAMERA, previewUseCase, analysis)
-            }.onFailure { refuse() }
-        }, ContextCompat.getMainExecutor(this))
-    }
-
-    private fun analyse(image: ImageProxy) {
-        try {
-            if (settled) return
-            val text = Qr.decode(image) ?: return
-            if (settled) return
-            settled = true
-            setResult(RESULT_OK, Intent().putExtra(EXTRA_TEXT, text))
-            // Finishing from the analysis thread is the whole reason `settled`
-            // exists; the activity teardown has to happen on the main one.
-            runOnUiThread { finish() }
-        } finally {
-            image.close()
-        }
-    }
-
-    override fun onDestroy() {
-        super.onDestroy()
-        executor.shutdown()
-    }
-
-    companion object {
-        const val EXTRA_TEXT = "text"
-    }
-}
@@ -1,18 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- The mark, drawn rather than shipped as a bitmap: one R in the app's own ink
-     on the palette's ground, which scales to every launcher's mask without a
-     density bucket per size. The hole in the R is the glyph's own counter, cut
-     with evenOdd rather than painted over. -->
-<vector xmlns:android="http://schemas.android.com/apk/res/android"
-    android:width="108dp"
-    android:height="108dp"
-    android:viewportWidth="108"
-    android:viewportHeight="108">
-    <path
-        android:fillColor="#F4F1EA"
-        android:fillType="evenOdd"
-        android:pathData="M39,30 L39,78 L47,78 L47,60 L54.5,60 L65,78 L74.5,78 L62.5,58 C68.6,55.8 72.6,50.6 72.6,43.6 C72.6,35.4 66.8,30 57.6,30 Z M47,37 L56.4,37 C61.2,37 64.4,39.4 64.4,43.8 C64.4,48.2 61.2,50.9 56.4,50.9 L47,50.9 Z" />
-    <path
-        android:fillColor="#A6680C"
-        android:pathData="M62,66 L74,66 L74,78 L62,78 Z" />
-</vector>
@@ -1,14 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- The status-bar glyph, not the launcher icon: Android renders a notification
-     icon as a mask, so anything that is not a solid silhouette on transparency
-     comes out as a grey blob. -->
-<vector xmlns:android="http://schemas.android.com/apk/res/android"
-    android:width="24dp"
-    android:height="24dp"
-    android:viewportWidth="24"
-    android:viewportHeight="24"
-    android:tint="#FFFFFF">
-    <path
-        android:fillColor="#FFFFFF"
-        android:pathData="M3,4h18v2H3zM3,9h18v2H3zM3,14h12v2H3zM3,19h12v2H3zM17.5,13.2l1.6,2.6 1.6,-2.6h2.3l-2.8,4.3V21h-2.2v-3.5L15.2,13.2z" />
-</vector>
@@ -1,62 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!--
-  The screen between the tap and the page.
-
-  It exists for a reason that is not cosmetic: the kernel has to be unpacked and
-  started before there is a page to show, and on a cold start that is about a
-  second. A blank window for a second reads as a broken app; a line of text that
-  says what is happening does not.
-
-  The progress bar is indeterminate and driven by nothing: the WebView's own
-  progress is mirrored onto it while the page loads, and before that it simply
-  turns, which is the honest description of "we do not know how long".
-->
-<LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
-    android:layout_width="match_parent"
-    android:layout_height="match_parent"
-    android:background="@color/page"
-    android:orientation="vertical"
-    android:gravity="center"
-    android:paddingStart="32dp"
-    android:paddingEnd="32dp">
-
-    <TextView
-        android:id="@+id/splash_wordmark"
-        android:layout_width="wrap_content"
-        android:layout_height="wrap_content"
-        android:text="@string/app_name"
-        android:textColor="#8A857B"
-        android:textSize="22sp"
-        android:letterSpacing="0.08"
-        android:fontFamily="sans-serif-medium" />
-
-    <ProgressBar
-        android:id="@+id/splash_bar"
-        style="?android:attr/progressBarStyleHorizontal"
-        android:layout_width="132dp"
-        android:layout_height="wrap_content"
-        android:layout_marginTop="26dp"
-        android:indeterminate="true" />
-
-    <TextView
-        android:id="@+id/splash_text"
-        android:layout_width="wrap_content"
-        android:layout_height="wrap_content"
-        android:layout_marginTop="18dp"
-        android:gravity="center"
-        android:text="@string/splash_connecting"
-        android:textColor="#8A857B"
-        android:textSize="13sp"
-        android:lineSpacingMultiplier="1.5" />
-
-    <Button
-        android:id="@+id/splash_retry"
-        style="?android:attr/borderlessButtonStyle"
-        android:layout_width="wrap_content"
-        android:layout_height="wrap_content"
-        android:layout_marginTop="14dp"
-        android:minHeight="44dp"
-        android:text="@string/splash_retry"
-        android:textColor="#A6680C"
-        android:visibility="gone" />
-</LinearLayout>
@@ -1,13 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- The adaptive launcher icon.
-
-     minSdk is 26, which is the release that introduced adaptive icons, so this
-     is the only launcher asset the app needs: there is no device running it
-     that would ask for a bitmap fallback. -->
-<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
-    <background android:drawable="@color/ic_launcher_background" />
-    <!-- The safe zone is the middle 66dp of 108dp; the glyph is drawn inside it
-         so no launcher's mask can clip it. -->
-    <foreground android:drawable="@drawable/ic_launcher_foreground" />
-    <monochrome android:drawable="@drawable/ic_launcher_foreground" />
-</adaptive-icon>
@@ -1,26 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<resources>
-    <string name="app_name">Reasonix</string>
-
-    <string name="channel_kernel">Kernel running</string>
-    <string name="channel_kernel_desc">Shown while the Reasonix kernel runs in the background. Can be muted on its own in system settings.</string>
-
-    <string name="notify_running_title">Reasonix is running</string>
-    <string name="notify_running_body">A task is still going. Switch back to see it.</string>
-    <string name="notify_failed_title">Reasonix could not start</string>
-
-    <string name="err_kernel_unreachable">Could not reach the kernel. Reopen the app from your home screen.</string>
-
-    <string name="download_default_name">reasonix-download</string>
-    <string name="download_saved">Saved: %1$s</string>
-    <string name="download_failed">Save failed: %1$s</string>
-    <string name="download_failed_status">Save failed: the server answered %1$d</string>
-
-    <string name="splash_connecting">Starting the kernel…</string>
-    <string name="splash_retry">Retry</string>
-
-    <string name="scan_title">Scan the code on the computer</string>
-    <string name="scan_hint">Point at the QR code in the computer\'s device panel to connect to it.</string>
-    <string name="scan_button">Scan to connect</string>
-    <string name="scan_denied">No camera permission, so scanning is unavailable. Allow it in system settings.</string>
-</resources>
@@ -1,7 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- The dark palette's page colour. `DayNight` on the theme picks this up when
-     the system is dark, which is what keeps the frame before the WebView from
-     flashing light at someone using a dark phone at night. -->
-<resources>
-    <color name="page">#0E1014</color>
-</resources>
@@ -1,9 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- The light palette's page colour, and only what the window needs before the
-     WebView paints. The interface's own colours are `tokens.css`'s and are the
-     page's business; these two exist so the first frame is the app's ground
-     rather than the platform default white. -->
-<resources>
-    <color name="page">#F4F1EA</color>
-    <color name="boot">#07080C</color>
-</resources>
@@ -1,6 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- The launcher ground: the interface's dark page colour. It is the same in
-     both themes because a launcher icon is not themed by the app. -->
-<resources>
-    <color name="ic_launcher_background">#14161C</color>
-</resources>
@@ -1,35 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Every string the shell itself shows. The interface's own text belongs to
-     the page and lives in its i18n bundle; these are only the few lines that
-     exist before it, or when it cannot load. -->
-<resources>
-    <string name="app_name">Reasonix</string>
-
-    <string name="channel_kernel">内核运行中</string>
-    <string name="channel_kernel_desc">Reasonix 内核在后台运行时显示，可在系统设置中单独关闭。</string>
-
-    <string name="notify_running_title">Reasonix 正在运行</string>
-    <string name="notify_running_body">任务继续进行，切回应用即可查看。</string>
-    <string name="notify_failed_title">Reasonix 无法启动</string>
-
-    <string name="err_kernel_unreachable">连接内核失败。请返回桌面重新打开应用。</string>
-
-    <string name="download_default_name">reasonix-download</string>
-    <string name="download_saved">已保存：%1$s</string>
-    <string name="download_failed">保存失败：%1$s</string>
-    <string name="download_failed_status">保存失败：服务器返回 %1$d</string>
-
-    <string name="splash_connecting">正在启动内核…</string>
-    <string name="splash_retry">重试</string>
-
-    <string name="wsperm_title">需要「所有文件访问」权限</string>
-    <string name="wsperm_body">要打开手机上的文件夹作为工作区，需要先允许本应用访问所有文件。点「去设置」，在列表里打开 Reasonix 的开关，然后返回这里。</string>
-    <string name="wsperm_go">去设置</string>
-    <string name="wsperm_later">以后再说</string>
-
-    <string name="scan_title">扫描电脑上的二维码</string>
-    <string name="scan_hint">对准电脑上「设备访问」里的二维码，识别后即可连接这台电脑。</string>
-    <string name="scan_button">扫码连接电脑</string>
-    <string name="scan_denied">没有相机权限，无法扫码。请在系统设置里允许。</string>
-    <string name="share_title">分享文件</string>
-</resources>
@@ -1,28 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- The shell's own furniture: a window background matching the page's light
-     palette before the WebView paints, and a transparent system bar so the
-     page's own safe-area padding is what the notch meets. The page themes
-     itself; this exists only so the first frame is not a white flash. -->
-<resources xmlns:tools="http://schemas.android.com/tools">
-
-    <style name="Theme.Reasonix" parent="Theme.AppCompat.DayNight.NoActionBar">
-        <item name="android:windowBackground">@color/page</item>
-        <item name="android:statusBarColor">@android:color/transparent</item>
-        <item name="android:navigationBarColor">@android:color/transparent</item>
-        <!-- The page draws its own edge-to-edge layout and pads itself with the
-             safe-area insets from mobile.css. Laying the window out edge to edge
-             while leaving the bars transparent is what makes those insets real
-             numbers instead of zero. -->
-        <item name="android:windowLayoutInDisplayCutoutMode" tools:targetApi="p">shortEdges</item>
-        <item name="android:enforceStatusBarContrast" tools:targetApi="q">false</item>
-        <item name="android:enforceNavigationBarContrast" tools:targetApi="q">false</item>
-    </style>
-
-    <!-- The camera. A black ground because the preview has not drawn yet and a
-         light window behind a dark viewfinder is a flash in the dark; the bars
-         stay transparent so the preview reaches the edges, which is what makes
-         a code near the top of the screen scannable. -->
-    <style name="Theme.Reasonix.Scan" parent="Theme.Reasonix">
-        <item name="android:windowBackground">@android:color/black</item>
-    </style>
-</resources>
@@ -1,31 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!--
-  Backups are off, and this file says why rather than leaving it implicit.
-
-  A Reasonix home holds provider keys, an account token and every session
-  transcript. Android's auto-backup would copy all of it to the person's cloud
-  drive and, on a device-to-device transfer, to a new phone — which is a
-  credential leaving the device by a route nobody chose. `allowBackup="false"`
-  in the manifest turns that off; these two stanzas are the belt to its braces,
-  excluding everything explicitly so that a later change to `allowBackup` cannot
-  quietly start copying credentials.
-
-  What a person wants to move between phones, the kernel already moves: its own
-  export writes a file the person hands to the system's picker.
-->
-<data-extraction-rules>
-    <cloud-backup>
-        <exclude domain="root" />
-        <exclude domain="file" />
-        <exclude domain="database" />
-        <exclude domain="sharedpref" />
-        <exclude domain="external" />
-    </cloud-backup>
-    <device-transfer>
-        <exclude domain="root" />
-        <exclude domain="file" />
-        <exclude domain="database" />
-        <exclude domain="sharedpref" />
-        <exclude domain="external" />
-    </device-transfer>
-</data-extraction-rules>
@@ -1,27 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!--
-  Cleartext HTTP is permitted, and the platform has no way to permit less.
-
-  Two kinds of page load over plain HTTP: the kernel's own page on
-  `127.0.0.1:<port>`, and the same page served by a paired computer on whatever
-  address its router handed out. The port is chosen when the kernel starts and
-  the LAN address when a code is scanned, so neither can be written here — and a
-  `domain-config` matches literals and domains, never a subnet.
-
-  So the boundary is not this file. `MainActivity` decides which cleartext origin
-  may become the window: `shouldOverrideUrlLoading` sends every http(s) origin
-  that is not the kernel's or the one just paired out to the browser, and the
-  native bridge answers only those two. A plaintext page on the LAN therefore
-  cannot become the document holding the bridge, which is what the reviewer's
-  "deliberate path for LAN pairing" asks for.
-
-  HTTPS is untouched: nothing here downgrades a request, and `trust-anchors`
-  keeps the system roots for every TLS connection that is made.
-->
-<network-security-config>
-    <base-config cleartextTrafficPermitted="true">
-        <trust-anchors>
-            <certificates src="system" />
-        </trust-anchors>
-    </base-config>
-</network-security-config>
@@ -1,15 +0,0 @@
-// The build itself lives in app/build.gradle; this file declares the plugin
-// versions once so the app module can be read on its own.
-//
-// AGP 8.11.1 is the pairing for the Gradle 8.14 toolchain this machine has:
-// AGP 8.7 and older refuse a Gradle that new, and AGP 8.13+ wants a Gradle this
-// one does not have. Both numbers are pinned rather than ranged, because a
-// build that silently moved either one would be a different build.
-plugins {
-    id "com.android.application" version "8.11.1" apply false
-    id "org.jetbrains.kotlin.android" version "2.1.20" apply false
-}
-
-tasks.register("clean", Delete) {
-    delete rootProject.layout.buildDirectory
-}
@@ -1,15 +0,0 @@
-# AndroidX is the only copy of the support libraries this project uses; the
-# non-transitive R class keeps the app's own resources from aliasing library
-# ones, which is what makes `R.string.*` unambiguous here.
-android.useAndroidX=true
-android.nonTransitiveRClass=true
-
-# The daemon is what keeps a second `gradle assembleDebug` from re-reading the
-# whole SDK, and the heap is sized for the R8 pass over the WebView and the
-# packaged page rather than for this handful of Kotlin files.
-org.gradle.jvmargs=-Xmx3g -Dfile.encoding=UTF-8
-org.gradle.daemon=true
-org.gradle.parallel=true
-org.gradle.caching=true
-
-kotlin.code.style=official
@@ -1,12 +0,0 @@
-distributionBase=GRADLE_USER_HOME
-distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.3-bin.zip
-# Pinning the distribution's checksum is what makes the download verifiable: a
-# mirror that served a different zip would fail here instead of being unpacked
-# and run. The value is Gradle's own, from
-# https://services.gradle.org/distributions/gradle-8.14.3-bin.zip.sha256
-distributionSha256Sum=bd71102213493060956ec229d946beee57158dbd89d0e62b91bca0fa2c5f3531
-networkTimeout=10000
-validateDistributionUrl=true
-zipStoreBase=GRADLE_USER_HOME
-zipStorePath=wrapper/dists
@@ -1,251 +0,0 @@
-#!/bin/sh
-
-#
-# Copyright © 2015-2021 the original authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      https://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-
-##############################################################################
-#
-#   Gradle start up script for POSIX generated by Gradle.
-#
-#   Important for running:
-#
-#   (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
-#       noncompliant, but you have some other compliant shell such as ksh or
-#       bash, then to run this script, type that shell name before the whole
-#       command line, like:
-#
-#           ksh Gradle
-#
-#       Busybox and similar reduced shells will NOT work, because this script
-#       requires all of these POSIX shell features:
-#         * functions;
-#         * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
-#           «${var#prefix}», «${var%suffix}», and «$( cmd )»;
-#         * compound commands having a testable exit status, especially «case»;
-#         * various built-in commands including «command», «set», and «ulimit».
-#
-#   Important for patching:
-#
-#   (2) This script targets any POSIX shell, so it avoids extensions provided
-#       by Bash, Ksh, etc; in particular arrays are avoided.
-#
-#       The "traditional" practice of packing multiple parameters into a
-#       space-separated string is a well documented source of bugs and security
-#       problems, so this is (mostly) avoided, by progressively accumulating
-#       options in "$@", and eventually passing that to Java.
-#
-#       Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
-#       and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
-#       see the in-line comments for details.
-#
-#       There are tweaks for specific operating systems such as AIX, CygWin,
-#       Darwin, MinGW, and NonStop.
-#
-#   (3) This script is generated from the Groovy template
-#       https://github.com/gradle/gradle/blob/HEAD/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
-#       within the Gradle project.
-#
-#       You can find Gradle at https://github.com/gradle/gradle/.
-#
-##############################################################################
-
-# Attempt to set APP_HOME
-
-# Resolve links: $0 may be a link
-app_path=$0
-
-# Need this for daisy-chained symlinks.
-while
-    APP_HOME=${app_path%"${app_path##*/}"}  # leaves a trailing /; empty if no leading path
-    [ -h "$app_path" ]
-do
-    ls=$( ls -ld "$app_path" )
-    link=${ls#*' -> '}
-    case $link in             #(
-      /*)   app_path=$link ;; #(
-      *)    app_path=$APP_HOME$link ;;
-    esac
-done
-
-# This is normally unused
-# shellcheck disable=SC2034
-APP_BASE_NAME=${0##*/}
-# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
-APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s\n' "$PWD" ) || exit
-
-# Use the maximum available, or set MAX_FD != -1 to use that value.
-MAX_FD=maximum
-
-warn () {
-    echo "$*"
-} >&2
-
-die () {
-    echo
-    echo "$*"
-    echo
-    exit 1
-} >&2
-
-# OS specific support (must be 'true' or 'false').
-cygwin=false
-msys=false
-darwin=false
-nonstop=false
-case "$( uname )" in                #(
-  CYGWIN* )         cygwin=true  ;; #(
-  Darwin* )         darwin=true  ;; #(
-  MSYS* | MINGW* )  msys=true    ;; #(
-  NONSTOP* )        nonstop=true ;;
-esac
-
-CLASSPATH="\\\"\\\""
-
-
-# Determine the Java command to use to start the JVM.
-if [ -n "$JAVA_HOME" ] ; then
-    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
-        # IBM's JDK on AIX uses strange locations for the executables
-        JAVACMD=$JAVA_HOME/jre/sh/java
-    else
-        JAVACMD=$JAVA_HOME/bin/java
-    fi
-    if [ ! -x "$JAVACMD" ] ; then
-        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
-
-Please set the JAVA_HOME variable in your environment to match the
-location of your Java installation."
-    fi
-else
-    JAVACMD=java
-    if ! command -v java >/dev/null 2>&1
-    then
-        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
-
-Please set the JAVA_HOME variable in your environment to match the
-location of your Java installation."
-    fi
-fi
-
-# Increase the maximum file descriptors if we can.
-if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
-    case $MAX_FD in #(
-      max*)
-        # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC2039,SC3045
-        MAX_FD=$( ulimit -H -n ) ||
-            warn "Could not query maximum file descriptor limit"
-    esac
-    case $MAX_FD in  #(
-      '' | soft) :;; #(
-      *)
-        # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC2039,SC3045
-        ulimit -n "$MAX_FD" ||
-            warn "Could not set maximum file descriptor limit to $MAX_FD"
-    esac
-fi
-
-# Collect all arguments for the java command, stacking in reverse order:
-#   * args from the command line
-#   * the main class name
-#   * -classpath
-#   * -D...appname settings
-#   * --module-path (only if needed)
-#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
-
-# For Cygwin or MSYS, switch paths to Windows format before running java
-if "$cygwin" || "$msys" ; then
-    APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
-    CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
-
-    JAVACMD=$( cygpath --unix "$JAVACMD" )
-
-    # Now convert the arguments - kludge to limit ourselves to /bin/sh
-    for arg do
-        if
-            case $arg in                                #(
-              -*)   false ;;                            # don't mess with options #(
-              /?*)  t=${arg#/} t=/${t%%/*}              # looks like a POSIX filepath
-                    [ -e "$t" ] ;;                      #(
-              *)    false ;;
-            esac
-        then
-            arg=$( cygpath --path --ignore --mixed "$arg" )
-        fi
-        # Roll the args list around exactly as many times as the number of
-        # args, so each arg winds up back in the position where it started, but
-        # possibly modified.
-        #
-        # NB: a `for` loop captures its iteration list before it begins, so
-        # changing the positional parameters here affects neither the number of
-        # iterations, nor the values presented in `arg`.
-        shift                   # remove old arg
-        set -- "$@" "$arg"      # push replacement arg
-    done
-fi
-
-
-# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
-
-# Collect all arguments for the java command:
-#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
-#     and any embedded shellness will be escaped.
-#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
-#     treated as '${Hostname}' itself on the command line.
-
-set -- \
-        "-Dorg.gradle.appname=$APP_BASE_NAME" \
-        -classpath "$CLASSPATH" \
-        -jar "$APP_HOME/gradle/wrapper/gradle-wrapper.jar" \
-        "$@"
-
-# Stop when "xargs" is not available.
-if ! command -v xargs >/dev/null 2>&1
-then
-    die "xargs is not available"
-fi
-
-# Use "xargs" to parse quoted args.
-#
-# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
-#
-# In Bash we could simply go:
-#
-#   readarray ARGS < <( xargs -n1 <<<"$var" ) &&
-#   set -- "${ARGS[@]}" "$@"
-#
-# but POSIX shell has neither arrays nor command substitution, so instead we
-# post-process each arg (as a line of input to sed) to backslash-escape any
-# character that might be a shell metacharacter, then use eval to reverse
-# that process (while maintaining the separation between arguments), and wrap
-# the whole thing up as a single "set" statement.
-#
-# This will of course break if any of these variables contains a newline or
-# an unmatched quote.
-#
-
-eval "set -- $(
-        printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
-        xargs -n1 |
-        sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
-        tr '\n' ' '
-    )" '"$@"'
-
-exec "$JAVACMD" "$@"
@@ -1,94 +0,0 @@
-@rem
-@rem Copyright 2015 the original author or authors.
-@rem
-@rem Licensed under the Apache License, Version 2.0 (the "License");
-@rem you may not use this file except in compliance with the License.
-@rem You may obtain a copy of the License at
-@rem
-@rem      https://www.apache.org/licenses/LICENSE-2.0
-@rem
-@rem Unless required by applicable law or agreed to in writing, software
-@rem distributed under the License is distributed on an "AS IS" BASIS,
-@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-@rem See the License for the specific language governing permissions and
-@rem limitations under the License.
-@rem
-@rem SPDX-License-Identifier: Apache-2.0
-@rem
-
-@if "%DEBUG%"=="" @echo off
-@rem ##########################################################################
-@rem
-@rem  Gradle startup script for Windows
-@rem
-@rem ##########################################################################
-
-@rem Set local scope for the variables with windows NT shell
-if "%OS%"=="Windows_NT" setlocal
-
-set DIRNAME=%~dp0
-if "%DIRNAME%"=="" set DIRNAME=.
-@rem This is normally unused
-set APP_BASE_NAME=%~n0
-set APP_HOME=%DIRNAME%
-
-@rem Resolve any "." and ".." in APP_HOME to make it shorter.
-for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
-
-@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
-
-@rem Find java.exe
-if defined JAVA_HOME goto findJavaFromJavaHome
-
-set JAVA_EXE=java.exe
-%JAVA_EXE% -version >NUL 2>&1
-if %ERRORLEVEL% equ 0 goto execute
-
-echo. 1>&2
-echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
-echo. 1>&2
-echo Please set the JAVA_HOME variable in your environment to match the 1>&2
-echo location of your Java installation. 1>&2
-
-goto fail
-
-:findJavaFromJavaHome
-set JAVA_HOME=%JAVA_HOME:"=%
-set JAVA_EXE=%JAVA_HOME%/bin/java.exe
-
-if exist "%JAVA_EXE%" goto execute
-
-echo. 1>&2
-echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
-echo. 1>&2
-echo Please set the JAVA_HOME variable in your environment to match the 1>&2
-echo location of your Java installation. 1>&2
-
-goto fail
-
-:execute
-@rem Setup the command line
-
-set CLASSPATH=
-
-
-@rem Execute Gradle
-"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %*
-
-:end
-@rem End local scope for the variables with windows NT shell
-if %ERRORLEVEL% equ 0 goto mainEnd
-
-:fail
-rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
-rem the _cmd.exe /c_ return code!
-set EXIT_CODE=%ERRORLEVEL%
-if %EXIT_CODE% equ 0 set EXIT_CODE=1
-if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE%
-exit /b %EXIT_CODE%
-
-:mainEnd
-if "%OS%"=="Windows_NT" endlocal
-
-:omega
@@ -1,64 +0,0 @@
-#!/usr/bin/env bash
-#
-# Build the Reasonix kernel for Android and place it where the APK packager
-# expects a native library.
-#
-# Why a shell script and not a Gradle task: the kernel is a Go module that lives
-# outside this Gradle build, with its own toolchain version pinned in go.mod. A
-# Gradle task that invoked `go build` would make the Android build depend on a Go
-# toolchain being configured for it, and would rebuild a 21MB binary on every
-# `assembleDebug` even when nothing in the kernel changed. This runs when you
-# mean it to, and the APK task only checks that the result is there.
-#
-# Output: app/src/main/jniLibs/arm64-v8a/libreasonix.so
-#   The name is not cosmetic. Android extracts files under `jniLibs/` to
-#   `nativeLibraryDir` and permits execution *there*; a binary shipped in
-#   `assets/` would have to be copied to app storage and chmod'd, which fails on
-#   a device whose data partition is mounted noexec. `lib*.so` is the shape the
-#   packager recognises as a native library, so the kernel wears it.
-set -euo pipefail
-
-here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-android="$here/.."
-upstream="$android/.."
-out="$android/app/src/main/jniLibs/arm64-v8a/libreasonix.so"
-
-if [ ! -d "$upstream" ]; then
-  echo "kernel source not found: $upstream" >&2
-  echo "run this from a checkout: the parent of android/ must be the kernel source." >&2
-  exit 1
-fi
-
-# GOOS=android needs nothing else: the kernel is CGO-free, which is what makes a
-# single static binary possible in the first place. `-s -w` drops the symbol and
-# DWARF tables — about a third of the file — and nothing on a phone reads them.
-export GOOS=android
-export GOARCH=arm64
-export CGO_ENABLED=0
-
-# The app version, read from the module's own build.gradle so the two cannot
-# drift. The official build stamps these through `-X` (see upstream's Makefile);
-# without them the kernel reports `version=dev revision=unknown`, which a phone
-# then shows next to the documentation it was built with and makes a bug report
-# from that build impossible to place. There is no `.git` here, so the revision
-# names the package the corpus shipped in rather than a commit hash — the honest
-# answer when there is no commit to name.
-app_gradle="$android/app/build.gradle"
-version_field() {
-  sed -n "s/^def $1 *= *\([0-9]*\).*/\1/p" "$app_gradle" | head -n1
-}
-app_version="${REASONIX_APP_VERSION:-$(version_field versionMajor).$(version_field versionMinor).$(version_field versionPatch)}"
-build_time_utc="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-ldflags="-s -w"
-ldflags="$ldflags -X main.version=v$app_version"
-ldflags="$ldflags -X main.buildTimeUTC=$build_time_utc"
-ldflags="$ldflags -X reasonix/internal/tools/productdocs.linkedVersion=v$app_version"
-ldflags="$ldflags -X reasonix/internal/tools/productdocs.linkedRevision=apk-v$app_version"
-
-echo "building the kernel (android/arm64, v$app_version) ..."
-mkdir -p "$(dirname "$out")"
-cd "$upstream"
-go build -trimpath -ldflags="$ldflags" -o "$out" ./cmd/reasonix
-
-size=$(wc -c < "$out")
-echo "kernel ready: $out ($((size / 1024 / 1024)) MiB)"
@@ -1,45 +0,0 @@
-#!/usr/bin/env bash
-#
-# One command from a clean checkout to an installable APK.
-#
-# The order matters and is the whole content of this script: the kernel and the
-# page are inputs to packaging, not build steps inside it, so they are produced
-# first and the Gradle task only assembles what is already there. Running
-# `gradle assembleRelease` directly on a fresh checkout fails on purpose (see
-# `requireBuildInputs` in app/build.gradle) rather than producing an APK with no
-# kernel in it.
-#
-# Usage: ./scripts/build.sh [debug|release]     (default: release)
-set -euo pipefail
-
-here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-android="$here/.."
-variant="${1:-release}"
-
-case "$variant" in
-  debug|release) ;;
-  *) echo "usage: $0 [debug|release]" >&2; exit 2 ;;
-esac
-
-"$here/build-kernel.sh"
-"$here/sync-page.sh"
-
-cd "$android"
-
-# The wrapper is committed, jar and all, and it is the only thing that runs the
-# build. Generating one here would tie the dependency versions to whichever
-# `gradle` happened to be on PATH, which is the opposite of a pinned build.
-if [ ! -f gradlew ]; then
-  echo "gradlew is missing: this repository commits the Gradle wrapper, so the checkout is incomplete" >&2
-  echo "(a release build does not use `gradle` from PATH: that would tie dependency versions to the machine)" >&2
-  exit 1
-fi
-
-task="assemble$([ "$variant" = release ] && echo Release || echo Debug)"
-echo "packaging the APK ($variant) ..."
-./gradlew "$task" --no-daemon
-
-apk_dir="$android/app/build/outputs/apk/$variant"
-echo
-echo "done. Installable artifacts:"
-find "$apk_dir" -name '*.apk' -maxdepth 1 -print -exec ls -lh {} \;
@@ -1,43 +0,0 @@
-#!/usr/bin/env bash
-#
-# Install the built APK on a connected phone and show its log.
-#
-# `adb` comes from the Android SDK rather than this project, because the SDK is
-# already how the app is built. Point ANDROID_HOME at it, or have `adb` on PATH.
-#
-# Usage: ./scripts/run.sh [debug|release]
-set -euo pipefail
-
-here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-android="$here/.."
-variant="${1:-release}"
-
-adb="${ADB:-${ANDROID_HOME:-$HOME/AndroidSDK}/platform-tools/adb}"
-if ! command -v "$adb" >/dev/null 2>&1; then
-  adb="adb"
-fi
-
-apk_dir="$android/app/build/outputs/apk/$variant"
-apk=$(find "$apk_dir" -name '*.apk' -maxdepth 1 2>/dev/null | head -n1)
-if [ -z "$apk" ]; then
-  echo "no $variant APK found; run ./scripts/build.sh $variant first" >&2
-  exit 1
-fi
-
-echo "installing $apk ..."
-"$adb" install -r "$apk"
-
-# The device count is checked before the app is started so an emulator-less
-# machine gets "no devices" rather than a launch failure that reads like a bug.
-if [ "$("$adb" devices | grep -c 'device$')" -eq 0 ]; then
-  echo "no device attached; skipping the launch." >&2
-  exit 0
-fi
-
-package="io.reasonix.mobile.app"
-[ "$variant" = debug ] && package="io.reasonix.mobile.app.debug"
-"$adb" shell monkey -p "$package" -c android.intent.category.LAUNCHER 1 >/dev/null
-
-echo
-echo "following the log (Ctrl-C to stop) ..."
-"$adb" logcat -v color "ReasonixKernel:V" "AndroidRuntime:E" "*:S"
@@ -1,64 +0,0 @@
-#!/usr/bin/env bash
-#
-# Build the interface and copy it where the APK will carry it.
-#
-# The page that ships is the same build the desktop Studio serves — that is the
-# whole reason the mobile layout lives in `desktop/frontend-next` rather than in
-# an Android project's own web root. Nothing is edited on the way through: the
-# only thing this script does that `pnpm build` does not is copy `dist/` into the
-# app's assets.
-#
-# Output: app/src/main/assets/page/
-set -euo pipefail
-
-here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-android="$here/.."
-frontend="$android/../desktop/frontend-next"
-dest="$android/app/src/main/assets/page"
-
-if [ ! -d "$frontend" ]; then
-  echo "frontend project not found: $frontend" >&2
-  exit 1
-fi
-
-cd "$frontend"
-
-# pnpm is the package manager the lockfile is written for; npm would resolve a
-# different tree than the one that was tested.
-if ! command -v pnpm >/dev/null 2>&1; then
-  echo "pnpm 10 is required: npm install -g pnpm@10" >&2
-  exit 1
-fi
-
-if [ ! -d node_modules ]; then
-  echo "installing frontend dependencies ..."
-  pnpm install --frozen-lockfile
-fi
-
-echo "building the frontend ..."
-pnpm build
-
-rm -rf "$dest"
-mkdir -p "$dest"
-cp -R dist/. "$dest/"
-
-if [ ! -f "$dest/index.html" ]; then
-  echo "the build produced no index.html; the frontend build probably failed." >&2
-  exit 1
-fi
-
-count=$(find "$dest" -type f | wc -l)
-size=$(du -sk "$dest" | cut -f1)
-echo "page ready: $dest ($count files, $((size / 1024)) MiB)"
-
-# MIT requires the copyright notice and the licence text to travel with a binary
-# distribution, so the APK carries it. Generated from the repository's own
-# `LICENSE` rather than committed a second time: a checked-in copy is one more
-# thing that drifts when the root file is updated.
-root_license="$android/../LICENSE"
-if [ ! -f "$root_license" ]; then
-  echo "LICENSE not found: $root_license" >&2
-  exit 1
-fi
-cp "$root_license" "$android/app/src/main/assets/LICENSE"
-echo "licence: app/src/main/assets/LICENSE (copied from the repository's LICENSE)"