Problem: plugin and theme packages could be published with a mistyped
41-character commit reference and fail when clients tried to install them.
Root cause: registry validation accepted GitHub repository paths without
requiring the commit-pinned source contract enforced by the installer.
Fix: require HTTPS GitHub tree URLs with full 40-character lowercase
hexadecimal commits, retaining the existing path safety checks. Update
publication fixtures and cover direct HTTP submissions before persistence.
Verification: all 801 Worker tests, TypeScript checking, Wrangler deployment
dry-run, and git diff --check passed on the current platform baseline.
A reply to a fixed report moves it back to recorded and clears
resolved_version in the same batch as the reply insert, so the reply
reaches the converter and a later fix can be recorded again. wontfix and
duplicate stay non-replyable.
Objects carry a one-hour cache lifetime and, when a zone and Cache Purge token
are configured, are purged from the edge on removal. A removal never touches a
pin another live package uses or a kept version shares. The package is re-read
before and after the write so a hide that lands mid-fetch cannot be undone.
Fetches time out, the size cap matches the installer's 2 MiB, retention counts
only versions that have an object and walks every version page, and every key is
asserted to sit under market/skills/.
After a skill is approved or pinned, the worker fetches its SKILL.md from the
GitHub repository, requires an OSI licence, requires the bytes to reproduce the
reviewed pin (the installer's digest over the skill name and file hash), and
stores them under market/skills/<pin>/SKILL.md on the existing download bucket.
A hide or reject removes every mirrored version; only the two newest versions
are kept. Off by default (MARKET_MIRROR_ENABLED).
The converter decides whether a fixed entry is still waiting for a tag from
resolvedVersion, but the open listing dropped the column, so no fixed(next)
entry was ever upgraded to a concrete version and nothing was credited.
Adds feedback_account_links, link/unlink/list routes, a union read for linked
installs and sibling replies, all behind FEEDBACK_ACCOUNT_LINK (off by default),
plus a signed erase endpoint for the accounts worker.
Adds POST /me/feedback-assertion (short-lived, audience-scoped) and tells the
feedback worker when an account is deleted, through a retried outbox that never
blocks the deletion.
EventRepo.recent kept every event whose package was not private, so the
public feed went on listing a package after an admin hid it, after a
publisher's update sent it back to review, and after that update was
rejected. Each of those packages answers 404 everywhere else, and the feed
is cacheable since #12207, so the stale entries also outlive the takedown.
The feed now keeps an event only when its package is active, the same rule
the listing and detail routes apply; events with no package are kept.
Fixes#12208
List, search, detail and activity now send a 60 s public Cache-Control and a
weak ETag, answer If-None-Match with 304, and are stored in the edge cache.
Credentialed requests, errors and every other route are no-store.
Add the platform-side enrollment record for phone and browser controllers
described in RFC #11878 section 10, stage 1. It is bookkeeping only: no
grant, gateway or host path reads it yet, so it adds no protection to
remote access.
- migration 0007: remote_controllers, remote_controller_challenges and
remote_rate_counters (additive, idempotent; rows are never deleted)
- routes: challenge, enroll, list and revoke under /me/remote-controllers;
pending list, resolve and revoke under /host/controllers, authenticated
with the computer's own device credential
- the enrollment id is derived from host id and key thumbprint; the server
recomputes the thumbprint from a strictly validated JWK and verifies an
ECDSA P-256 proof of possession over a labelled, length-prefixed message
- nonces are single use, hashed, bound to user, host, session and purpose,
and consumed before the signature is verified
- `revoked` is terminal: re-enrolling a revoked key is refused and no code
path clears revoked_at; ordinals are max+1 per host and never reused
- the first device on a computer auto-enrolls; any further key is held as
pending until the computer resolves it; at most 3 pending and 8 recently
used active devices per computer, with replace-least-recently-used
- limits are D1 counters that refuse the request when the counter cannot be
written; a password change, reset or account deletion revokes every
enrollment in the same batch as the host registrations
Credit an install when a maintainer moves its report to fixed with a concrete
published version, and derive quotas from one resolveFeedbackLevel policy
instead of the flat trusted flag.
- feedback_adoptions ledger (unique per install+item and per receipt, tombstones),
feedback_level_state (high-water count, revocation marker), additive idempotent
migration applied and verified by the manual platform deploy before the Worker.
- The status transition, credit, trust renewal, high-water mark and audit row
commit in one batch; replays, retries, duplicates and corrections never
double-credit; tombstoned items cannot be credited again.
- submit/reply admission and the read-only profile on GET /v1/feedback/mine
consume the same resolution; L0 is the untrusted tier and L6 the shipped
12/60/10 tier, trust without credit stays legacy_active.
- Admin POST/DELETE /v1/admin/feedback/<receipt>/adoption record and tombstone.
The maintainer's network resolves *.workers.dev to a proxy fake-IP and the TLS handshake fails, so the local listener could not connect. Attach a custom domain in our own zone, same mechanism as id.reasonix.io; workers.dev stays enabled.
Cause: when R2 is unavailable, the stable desktop manifest gateway asked
GitHub for the repository-wide latest release and accepted it only if its
tag was desktop-v*. Studio is about to become that latest release, so the
fallback would answer 502 instead of the newest 1.x desktop manifest.
Blast radius: only the stable desktop fallback in desktop_release.ts,
reached when the R2 pointer is missing or invalid. The R2-first path,
preview/canary handling, the CLI fallback and the manifest validation
(tag/version match, canonical latest.json asset URL, size bounds) are
unchanged. The 502 body gains a reason field. Not deployed.
Neighbouring behaviours tested: vitest (467 tests) and tsc --noEmit pass.
Cases: newest desktop-v* chosen among studio-v*, v*, draft, prerelease,
semver-prerelease, leading-zero and asset-less entries; numeric ordering;
desktop release on page 3 behind 200 other releases; page cap reached gives
"no-desktop-release-found"; a failing later page gives "upstream-error".
Why this layer: the gateway owns the fallback decision. It pages the
listing (100 per page, at most 10 pages) until a page holds a valid
desktop-vX.Y.Z release with a conforming latest.json, and picks the highest
strict semver on that page, because Studio and CLI releases are frequent
enough to push desktop releases off a single page.
An answered, held or needs_info report can never reach 'recorded': the
converter endpoint only takes 'received' and the status machine is
forward-only. Add POST /v1/admin/feedback/:receipt/link (admin only) that
takes only an issue number, derives the URL from the repository, and moves
held/needs_info/answered/received to recorded. The same issue again is a
no-op; a different one is feedback.issue_conflict.
Answering dropped the report's images, so the admin page could never show
the screenshot of an answered item. Keep them: they stay unreleased
(release only accepts held/received), admin-only, and the 30-day retention
sweep already covers answered rows. Reject and takedown still delete them.
Submit, user reply and admin status changes now post a best-effort event
(fixed label, receipt, category, status; no user text) to the ops-events
relay through ctx.waitUntil. Unset relay env is a no-op; a failing or
slow relay cannot change the HTTP response.
A Durable Object keeps an ordered, bounded event log and fans events out to at most four WebSocket listeners with hibernation, so an idle listener costs nothing and nothing polls a database. GitHub deliveries are verified by HMAC before parsing and deduplicated; only compact metadata (type, number, a 120 character title, author, link) is ever forwarded, never bodies. Our own workers can push through a separate emit token with a rate limit.
Adds GET /v1/admin/feedback/list (filters, cursor paging, newest first) and a
self-contained page at /admin/feedback with a detail view and the existing
triage actions. The token lives in sessionStorage and the Authorization header
only; user text is rendered with textContent under a strict CSP. Wrong admin
tokens now lock the caller out of the whole admin API for the window.
Submissions are held by default and auto-released only for trusted installs
without images. Adds triage, reply, block, takedown and cap endpoints, private
attachments until released, optional Turnstile, and an idempotent migration
wired into the deploy workflow.
Refs #11424
A browser cannot read why a WebSocket upgrade failed, so a 401, 429 or 403
from the relay reaches users as one generic sentence and left nothing to
trace afterwards. Each refusal (origin, credential, rate limit, expired
grant, sign-in age, revoked or full room) and each lease or socket close
(idle, sign-in age, revoked, re-check failure) now logs code, reason, role,
age and idle time, plus a 32-bit hash of the device or grant. Tokens and
full ids are never logged. Each event+code is capped at 20 lines a minute
per isolate and the next window reports how many were skipped.
Worker side of the feedback loop: D1 feedback and quota tables, issue-once install tokens, metadata-free image attachments in TELEMETRY_RAW under feedback/, layered abuse limits, retention in the daily purge, kill switch, and the converter admin endpoints. Refs #11424
- Remote grants and lease checks accept only password (web) sessions: a
device-flow session is minted by approving from any session, so its age
could reset the 24 hour sign-in limit indefinitely.
- The gateway refuses a grant without reauthAt instead of assuming 24
hours from now, and a controller lease without one does not parse.
- Admission time is taken before the account service answers, and the
room remembers session sign-outs for ten minutes, so an admission in
flight during a revocation is refused.
- Failed re-checks fail open for at most an hour; then every connection
must be admitted again.
- A full room closes its quietest controller (silent for a minute) rather
than refusing a reconnecting phone for half an hour.
- Revocation pushes retry once.
The relay checked a never-renewed 15 minute deadline on every controller
message, so an active phone was cut off mid-use. A credential is now
checked only at the WebSocket upgrade. After that each connection holds a
lease that slides with its own frames (30 minutes idle), a device lease
also slides with a heartbeat the runtime answers without waking the
object, and a controller ends when the account session that admitted it
is 24 hours old.
The age limit is enforced where it cannot be reset by reconnecting: the
account service refuses to issue a grant from a session older than 24
hours (remote_reauth_required), and every grant now records the session
that asked for it. The relay re-checks each live connection against the
account service every five minutes, and removing a device, changing or
resetting the password, deleting the account or signing out pushes an
immediate disconnect.
Close codes carry the cause: 4408 idle (reconnect silently), 4401 sign in
again, 4403 revoked. Controllers stay attached while their device
reconnects, and the device is greeted with the list of attached
controllers so it can keep their encrypted sessions.
Refs #11226
Desktop builds up to v1.38.3 reject the electron-v1 install layout that every
current manifest carries, so their update check fails with a retryable-looking
error and the banner offers "retry" forever.
The release gateway now reads the updater's User-Agent version. For a strict
Reasonix-Updater/vX.Y.Z at or below v1.38.3 it answers with a manifest whose
version field is a short bilingual instruction ending in "manual update
required". Those updaters validate the version first and quote it verbatim
into the check error, and their frontend classifies any error containing that
phrase as manual, which turns "download from reasonix.io" into the primary
action. Everything else (newer builds, missing or malformed UA) is forwarded
unchanged.
The guidance response is private, no-store; every desktop manifest response
now carries Vary: User-Agent so no shared cache can hand one population the
other's answer.
The 1.x desktop renders with Chromium (Electron) and sends
runtimeEngine "chromium" on /v1/ping and /v1/metrics. Both schemas only
allowed webview2, webkitgtk and unknown, so every ping and metrics batch
from a current desktop install failed validation with 400 and never
reached storage: desktop daily actives and metrics covered only installs
still on the older shells.
Add chromium to the shared enum and to the stats engine filter.
* feat(registry): votes, deduped install counts and a recommended order
One account, one vote per package (+1, -1 or none), changeable and
withdrawable; only verified accounts vote and a publisher never votes on
their own package. The vote and a recount of packages.up_count/down_count
from the votes table run in one D1 batch, so the cached counts cannot
drift. Legacy stars migrate to +1 votes (self-stars excluded, stars kept);
the star endpoint now toggles a +1 vote.
Install pings count once per (anonymous install id, package, UTC day):
a seen row is inserted fresh, the counters move only while it is fresh,
and the batch spends it before commit. Pings without an id are
acknowledged and not counted. No IP is stored; dedupe rows are purged
once their day has passed.
sort=recommended becomes the default: 0.6 x Wilson 95% lower bound of
the vote ratio + 0.4 x ln(1 + 30-day installs decayed with a 14-day
half-life), normalized against a fixed cap. The score is materialized in
packages.rec_score (per package on vote/counted install, all packages by
cron, on demand via POST /v1/admin/rescore) so the listing still sorts
and paginates in SQL. Packages with >= 10 down-votes under 30% approval
are listed as Flagged in the moderation console; nothing is auto-hidden.
The formula is published in REGISTRY-RANKING.md and lib/ranking.ts.
* feat(registry): weight heat below reputation and count distinct install ids
Anonymous install ids can be minted freely, bounded only by the per-IP
write limit, so heat now carries 0.25 of the recommended score (0.75
reputation) against a cap of ln(1 + 5000), and counts each distinct id
of the 30-day window once, decayed from its latest install. However many
ids are minted, heat cannot lift a package above the reputation alone of
one with a solid vote record. Dedupe rows are kept for the window instead
of two days; still no IP is stored.
* feat(registry): keep private packages out of votes, installs and ranking
A private package already answers 404 to votes, stars and install pings
because each requires an active package; the cron rescore now skips it
too, so it never carries a recommended score. Tests pin all four paths
and that the listing serves pinned alongside the vote fields.
A publish may now ask for `visibility: "private"`. Such a package lands in
the `private` status: outside the review queue, and absent from every public
surface (listing, search, detail, activity feed, install and star pings).
- GET /v1/me/packages/:handle/:name returns the caller's own package in any
state with its versions, so a publisher can install an unreviewed or private
package of their own. Another account's package answers exactly like a
missing one.
- POST /v1/me/packages/:handle/:name/submit moves an owner's private package
to pending; nothing else can put it in front of a reviewer. Approval
refuses a private revision, and moderators cannot hide, reject or verify
one into a state approval would accept.
- Each publish follows its own visibility: a public update of a private
package is a submission, a private update of a live one takes it down.
- The moderation console gains a read-only Private tab.
No schema change: status is free text, so no migration is needed.
The digest input added for pinning sat inline beside the other actions,
and the full 71-character digest was printed in the actions column, so the
column overflowed the card and the inputs rendered unstyled. The current
digest now shows abbreviated under the package name (full value on hover),
pinning is a collapsed control that opens a styled field, and the approve
field sits on its own line above Approve and Reject.
Packages approved before the reviewer could record a content digest are
listed in the Studio market but refused there as unpinned, and nothing let
an admin bind one after the fact.
- POST /v1/admin/packages/:handle/:name/pin (requireAdmin) and a Pin/Re-pin
form on the /community console's Active tab bind a sha256:<64 lowercase
hex> digest to the live package's current version.
- The write is fenced like approval (latest_version, updated_at, and status
must be the active revision the admin saw) and is compare-and-set on the
digest it read, so a concurrent publish or re-pin answers 409 instead of
being overwritten. Package status and updated_at are untouched.
- Every pin logs a registry event (type "pin", actor, time, "<version>
<old|unpinned> -> <new>"); the console also writes its audit_log entry.
Pin events stay out of the public activity feed.
- The console's review list now shows each package's current digest.
The listing now carries a read-only `pinned` per package: whether its latest
version holds a reviewer-bound sha256 content digest, the same shape the
publish schema accepts and the client installs against. `pinned=1` filters in
the query itself, so limit/offset pages stay correct instead of a client
dropping rows from a page it already received.
The check is an indexed EXISTS against package_versions(package_id, version);
no schema change or migration.
- kind gains `theme`: its own listing category, installed through the
plugin installer. The stored and served installKind is `plugin`, and a
theme source is held to exactly the plugin source rules (a GitHub
repository or repository path), so a theme cannot reach the generic URL
or npm fallbacks the plugin kind already refuses.
- GET /v1/me/packages (requireAuth) lists every package the caller
published, in every review state (pending, active, rejected, hidden), so
a submitter can see where review stands. The public listing still serves
active rows only.
- The worker entry routes /v1/me/ to the registry app; the trailing slash
keeps /v1/metrics out of it.
No schema migration: kind is unconstrained TEXT.
- The identity lookup never follows a redirect, and an accounts outage
answers 503 accounts_unavailable instead of 401, so a signed-in
publisher is not told to sign in because id.reasonix.io was down.
Studio's community market installs a listed package only when its approved
version carries a content digest, and install_source refuses material that
no longer matches it. That pin has to come from the review, not from the
publisher: a publisher who supplies the digest of content they later swap
into a mutable source would otherwise have their claim promoted to a pin.
- Approval (JSON admin API and the /community console) takes an optional
contentHash - the contentDigest Reasonix prints for the plan the reviewer
read - and writes it onto the reviewed version row before the package goes
public, under the same revision fence as the status change. Approving
without one clears any publisher-supplied value: the version is published
but not installable from Studio.
- contentHash, on publish and on approval, must be sha256:<64 lowercase hex>
(install_source's spelling) or empty.
Adds /me/backups (list, upload, download, delete) for the Studio cloud
backup. The client seals each backup with a passphrase before upload, so
the service keeps an opaque envelope in R2 (backups/<user>/<id>) and only
listing metadata in D1 (config_backups). Every query and object key is
scoped by user id; an account keeps at most 10 backups of up to 4 MiB,
enforced in the same INSERT so concurrent uploads cannot overshoot.
Deleting an account removes its backups.
Deploy needs the reasonix-config-backups R2 bucket bound as BACKUPS and
migration 0005; without the binding the routes answer 503.
The embedded Pi catalog (sky-valley/pi v0.84.20, unchanged in v0.87.24)
annotates minimax-m2.7 as openai-completions. Both the Endpoints table on
opencode.ai/docs/go and models.dev (the catalog the OpenCode client reads)
serve it on /v1/messages with @ai-sdk/anthropic. Because the route
catalogs are the union of Pi and the declared tables, minimax-m2.7 was
listed on the Chat Completions route too: the curated "opencode-go" chat
preset shipped it, discovery kept it for a chat connection, and
OpenCodeGoRecommendedRoute (Pi first) answered "chat".
A declared correction table in pi_catalog.go now pins minimax-m2.7 to the
Anthropic route, and Pi entries are dropped from any other route. The Qwen
models keep their current dual-route state: models.dev marks
qwen3.6-plus, qwen3.7-max, qwen3.7-plus and qwen3.8-max
@ai-sdk/openai-compatible, so the chat route is not shown to be wrong.
Only connections that are ours move. The load-time route repair and the
journaled pre-v10 upgrade both leave a route-corrected model where it is,
unless the connection has preset_id "opencode-go" on the official chat
route and its models equal a chat list v1.37.0-v1.39.1 shipped (two
declared generations). Such a connection gets an opencode-go-anthropic
sibling for minimax-m2.7, and references to it are retargeted. Hand-made
connections, including config_version>=10 manual choices, are untouched.
Test: on the merge base, TestOpenCodeGoMiniMaxM27ServedOnlyOnAnthropicRoute
(recommended route "chat") and
TestOpenCodeGoShippedChatPresetMovesMiniMaxM27ToAnthropicSibling (no
anthropic sibling) fail. Both pass after the change.
TestOpenCodeGoManualConnectionKeepsItsRoute covers a manual
"custom-opencode-ai" connection with [glm-5.3 qwen3.7-plus],
[qwen3.7-plus], [glm-5.3 minimax-m2.7] and [minimax-m2.7] through both the
load-time repair and the journaled upgrade. Against an ungated rerouting
rule it fails: the connection is split, or its kind flips to anthropic
with preset_id opencode-go-anthropic. It passes here.
TestOpenCodeGoQwenModelsKeepBothRoutes pins the Qwen models to both
routes.
The project menu above the composer lists every "project" node from
GetProjectTreeSnapshot. Pinned SSH workspaces are project nodes too
(root "remote-project:<host>:<workspace>", Remote set), so they showed
up with the local folder icon, and picking one sent that synthetic root
to SwitchWorkspace, which stats it as a local path and fails.
The menu now drops nodes that carry a remote reference. SSH projects
remain reachable from the sidebar and the menu's "Remote connection"
action. This is a different path from #10755, which fixed remote tab
selection after restart and does not touch this menu.
Test: composer-workspace-context.test.tsx adds a remote node to the
snapshot. Before: AssertionError "remote projects never appear among
local folders to switch to". After: PASS; tsc and eslint clean.
Fixes#10891
Root cause: shellrun kept a child's bytes as a Go string unchanged. On a
Chinese Windows install, console tools such as tasklist and find answer
in cp936, so the bash tool result held invalid UTF-8 and JSON turned
every bad byte into U+FFFD on the way to the transcript. The model and
the user saw mojibake instead of the command's output or its error.
Fix: both buffers decode through encoding.DecodeOutput, the one decoder
for process output, and each passes the edges it really cut:
- the failure tail keeps the last N bytes, so tailWriter records when it
dropped bytes and passes Cut{Head: cut};
- combined output is decoded whole with Cut{} until it crosses the cap;
after that the head lost its end and the rolling tail its start, so
they are decoded apart with Cut{Tail: true} and Cut{Head: true} on
either side of the truncation notice.
Output that is not UTF-8 is decoded from the raw bytes. The shell
package's own edge trimmers (completePrefix/completeTail) are gone:
they trimmed edges nothing had cut and removed the GBK lead byte of
output that starts with a CJK character.
Tests:
- TestRunForegroundDecodesCodePageOutput runs a real shell that prints
GB18030 bytes and exits non-zero.
- TestBuffersDecodeCodePageOutputStartingWithCJK covers GBK that starts
with a CJK character in the tail and in combined output, uncut and cut.
All of them fail on origin/main-v2 and pass with this change.
Fixes#8213
On a Chinese Windows, cmd.exe reports a missing command in the console
code page (GBK), not UTF-8. The stdio transport kept the stderr tail as
raw bytes, so an MCP startup failure such as "'read-only-mysql-mcp-server'
is not recognized as an internal or external command" reached the settings
page as U+FFFD mojibake and the user could not see why the server failed.
The stderr tail now goes through encoding.DecodeOutput, the one decoder
for process output. The buffer keeps the last 16 KiB, so only its head
can be cut: tailBuffer records when it dropped bytes and passes
Cut{Head: cut}. The end is never cut, because it is whatever the server
last wrote. Output that is not UTF-8 is decoded from the raw bytes, so a
GBK tail that begins with a CJK character keeps that character.
Tests:
- TestStdioFailureDecodesCodePageStderr starts a real child that writes
GBK to stderr and exits.
- TestStderrTailDecodesTheServersCodePage covers GBK that starts with a
CJK character, both uncut and cut, plus UTF-8 cut mid-character.
All of them fail on origin/main-v2 and pass with this change.
Refs #7857
DecodeOutput trims a partial rune only at an edge the caller cut. Output
that nothing cut but that stops inside a character still has invalid raw
bytes, so it went through charset detection and fell back to GB18030,
and the whole output turned into mojibake: "编译成功…正在运行" plus half
of "中" read as "缂栬瘧鎴愬姛…". This is common in real use:
- a process killed on timeout mid-write;
- a persistent shell's partial() read;
- a block-buffered pipe.
The output is now read as UTF-8, less the final incomplete rune, when
two things hold: that rune is the only invalid part, and a multi-byte
UTF-8 character has already appeared. Both are structural evidence. When
only ASCII precedes the half rune, nothing says UTF-8, so the bytes
still go through detection. The uncut GBK probes (价, 啊\r\n, ok 洹,
啊 ok) are unchanged.
Test: TestDecodeOutputReadsUncutUTF8EndingInPartialRune fails before
this change with the mojibake above and passes after it. It also pins
ASCII plus half a rune (read as a GBK pair) and uncut, tail-cut and
head-cut GBK.
Refs #6488
The history panel sends no kinds, and the desktop filled that with
user_text, assistant_text, tool_input and tool_error. tool_output was
indexed but never searched, so a result the user saw in a conversation
(for example an MCP server listing) produced no "Content matches".
The panel's default now searches tool_output in place of tool_error.
The index writes a tool_output document for every tool result, errors
included, so tool_error would only list failed results a second time.
The agent-facing history tool keeps its own narrower default.
Searching tool output multiplies candidates, and the snapshot builder
reloaded a session file whenever consecutive bm25-ranked hits came from
different sessions, so interleaved hits cost one full file read each.
The builder now collects the needed rows per session in a first pass,
reads each session once to cut its snippets, and emits hits in the
catalog's rank order in a second pass.
Tests:
- TestHistoryContentSearchDefaultsCoverEveryToolResultOnce: before,
"zulumarker" (a normal tool result) returned no items; after, each
query returns exactly one tool_output hit.
- TestHistorySearchBuildReadsEachSessionOnceAndKeepsRankOrder: four
hits alternating across two sessions. Before: 4 session loads, want 2.
After: 2 loads, hits in rank order.
- 40 sessions x 80 tool results of 4-6 KB, term only in tool output:
first page 7.09s before, 0.89s after (single local run).
Problem: a desktop session watched through the IM bot bridge re-sent the
same approval or question card to the chat every time the desktop replayed
the waiting prompt while reconciling a tab (#9156).
Root cause: botBridgeHub.observe enqueued a watcher message for every
ApprovalRequest/AskRequest, and a replay carries the same kind as the
original request.
Fix: skip the watcher message when the event is marked Replayed; the pending
prompt is still remembered so a reply from the chat routes to the tab.
Test: TestBridgeReplayedApprovalPushesOnce fails before the change with an
unexpected second notification and passes after; the other TestBridge*
tests pass.
Problem: while an approval or ask card waited for input, Windows kept
raising "Approval needed" toasts, one about every minute (#9156).
Root cause: the desktop replays pending prompts whenever it reconciles a tab
(backend status sync, tab switch, navigation), and Controller replay emits
through the same notification-wrapped sink as the original request. Nothing
on the event said it was a replay, so the notify sink treated each one as a
new request for attention.
Fix: the controller, which is the only party that knows it is replaying,
marks the events emitPendingPrompts re-emits with event.Event.Replayed, and
notify sends nothing for a marked event. The sink keeps no state, so a
controller rebuilt behind the TUI's shared sink, whose prompt ids restart at
"1", still notifies its new prompts.
Test: TestReplayedPromptDoesNotNotifyAgain fails on origin/main-v2 with
"notifications for one approval replayed 3 times = 4, want 1";
TestRebuiltControllersSharingASinkEachNotify fails against an id-set dedupe
with "notifications for two controllers' approval 1 = 1, want 2". Both pass
after, with the existing replay tests and the notify and event suites.
edit_file on a UTF-8 file carrying CJK text rewrote bytes it never touched:
continuation bytes of characters far from the edit came back as 84 31 A4 37.
Detect took a nil error from the GB18030 decoder as proof the file was
GB18030. The decoder never fails: it maps every invalid sequence to U+FFFD.
So any file that was not valid UTF-8 -- one stray byte is enough -- was read
as GB18030, and the read-modify-write tools (edit_file, multi_edit,
delete_range, write_file over an existing file), checkpoint restore and the
config migrations then re-encoded every unreadable sequence as the GB18030
form of U+FFFD.
Detect now names a charset only when decoding and re-encoding restores the
input byte for byte. GB18030 is tried first, then GBK, which restores what
GB18030 cannot such as CP936's single-byte euro 0x80, so such a file stays
editable in its own encoding; anything else is LossyUTF8, whose bytes pass
through untouched. The new Kind is appended because checkpoints persist it
by value.
GBK cannot hold every character, so Encode now returns an error instead of
falling back to UTF-8, which rewrote a whole CP936 file as UTF-8 when an edit
added a character such as an emoji. A legacy charset that cannot represent a
character answers an *UnencodableError naming it, its byte offset and the
charset, with ErrUnencodable as its identity; the file tools, checkpoint
restore and the config migrations refuse the write and leave the file as it
was. Fixtures encode through MustEncode.
Readers that hold only part of a stream say so rather than inherit the
whole-file answer:
- DetectFragment runs the round trip on the prefix the decoder consumes when
not at EOF, so a character the cut split is dropped structurally. grep's
8 KiB peek, read_file's 256 KiB sample and the desktop's 2 MiB file preview
use it; the preview's next page starts at the split character, and lossy
text is shown as text rather than as binary.
- DecodeOutput is the one entry point for bytes that are only displayed.
The producer says which ends its bound cut (Cut{Head, Tail}); UTF-8 is read
without a character split at a cut end, and an uncut end keeps its bytes,
since a GBK pair there is output rather than half a rune. What no charset
restores is still read as GB18030. Hook output passes its tail cut when
truncated.
- DetectAndDecode decodes a legacy charset once; the edit tools and
DecodeToUTF8 use it instead of detecting and decoding separately.
Tests that fail before this change (on the base or an earlier revision of it)
and pass here:
- TestE2EEditKeepsBytesOfUTF8FileWithStrayByte: e4 b8 ad became
e4 b8 84 31 a4 37 outside the edit (fails on origin/main-v2).
- TestDetectUTF8WithStrayByteIsNotGB18030 (fails on origin/main-v2).
- TestWritesRefuseCharacterCP936CannotHold (edit_file, multi_edit,
write_file): nil error and the whole CP936 file rewritten as UTF-8.
- TestDecodeOutputTrimsCutUTF8Edges: UTF-8 cut at the front read as mojibake.
- TestDecodeOutputKeepsUncutCodePageEdges, TestDecodeHookOutputKeepsUncutCodePageEdges:
GBK pairs at an uncut edge (bc db, b0 a1 0d 0a, 6f 6b 20 e4 a1,
b0 a1 20 6f 6b) were dropped as partial UTF-8 runes.
- TestEditKeepsCP936FileWithEuroByte: an edit adding Chinese wrote UTF-8
into a CP936 file.
- TestGrepGB18030PeekWithoutNewline, TestGrepGB18030PeekCutMidCharacter:
no matches past a peek cut mid-character.
- TestReadFileGB18030SampleWithoutNewline: garbled text past the sample.
- TestReadFileGB18030TruncatedWithoutNewline,
TestReadFileGB18030TruncatedMidCharacter (desktop): the 2 MiB preview of a
GB18030 file was garbled or ended in U+FFFD.
- TestDecodeHookOutputReadsTruncatedCodePageText,
TestDecodeHookOutputReadsCP936Euro: mojibake for cut or euro-carrying cmd.exe output.
- TestEncodeRefusesCharacterTheCharsetCannotHold, TestDetectGBKWithEuroByte,
TestDetectFragmentDropsTheSplitCharacter, TestDecodeOutputReadsCutCodePageText:
the API's contract.
A Responses turn could end with a tool call the model issued and never
run it. The stream reader dispatched a function call only when its
function_call_arguments.done or output_item.done event arrived; a relay
that forwards the added and delta events but not the done events (or
sends deltas without the item id) left the call open, the terminal
response.completed ended the attempt, and the turn committed as a clean
answer with no calls. The run then finished ok after one round.
The terminal response's output array is the response's own list of what
it issued. On response.completed and response.incomplete, every
function_call item there that the stream did not already close (matched
by call id) is now completed from that item; one whose status is set and
is not "completed" is left alone, so a call truncated at the output
limit is still not dispatched. An item listed without a call id is not
dispatched, and a call id listed twice is dispatched once.
The output array now decodes one item at a time. Decoded as a typed
slice, a single item with a non-string field (arguments sent as an
object by a non-conforming relay) failed the whole terminal event, which
was then skipped and the turn ended with unexpected EOF; the reasoning
snapshot reader shared that exposure and now reads the same per-item
decode. A call with no name, such as an arguments.done event that named
no item, is no longer dispatched as an empty call; it stays open for a
later event to name. The done branches share one completion helper.
Test: output_calls_wire_test.go drives the real HTTP stream reader. On
origin/main-v2 the "done events never came" and "deltas without item id"
cases fail with calls = nil; both pass after the change, and the
no-duplicate and truncated-call guards pass on both. The
unreadable-item, empty-call-id, duplicate-call-id and
unnamed-arguments.done cases fail before the per-item decode and the
skips, and pass after.
go test ./internal/provider/... ./internal/agent/ passes.
Root cause: none of the five StepFun presets (stepfun, stepfun-responses,
stepfun-anthropic, stepfun-api, stepfun-api-anthropic) set context_window,
and 1.x has no model-level fallback, so a StepFun session ran with a zero
window. agent.Options documents that ContextWindow <= 0 disables automatic
compaction, and the context gauge has nothing to show, so the conversation
grew until StepFun refused it ("maximum context length is 262144 tokens").
Fix: every StepFun preset declares 262144, the limit the API enforces for
all models they list. Installed entries that still carry no window are
brought forward on load and on load-for-edit, only when the preset id, kind,
official host (stepfun.com or stepfun.ai) and served models all still match;
a custom endpoint, a foreign model or any window the user set is left alone.
Test: internal/config/stepfun_context_test.go fails on origin/main-v2
(stepfun context_window = 0; stepfun-anthropic/step-3.5-flash context_window
= 0 after LoadForRoot) and passes with this change. go test
./internal/config/ ./internal/boot/, go vet, gofmt, golangci-lint and
repolint are clean.
Fixes#9129
A task call may name a child model without a provider, e.g.
"deepseek-v4-flash". The sub-agent resolver passed that straight to
Config.ResolveModel, which answers a bare name with the first provider that
lists it. With the official DeepSeek entry listed before a relay serving the
same model, a child of a session running on the relay was silently sent to
the official API instead.
The model-override resolution moves out of the Build closure into
subagentModelSelection, and a bare name the parent's provider serves is
qualified with that provider first, in both the runtime resolver and the
identity the usage record reports. A provider name, a provider/model
reference, or a model only another provider lists resolve as before.
Test: TestSubagentBareModelStaysOnParentProvider fails on origin/main-v2
(selection for "shared-flash" = "first/shared-flash", want
"relay/shared-flash") and passes after the fix; go test ./internal/boot/
passes, repolint clean.
The context panel's "Runtime" stat froze between model requests: during
long tool execution it kept showing the value from the last usage event,
so a two-hour session could read a few minutes.
Root cause: the host accumulates runtime per turn and adds the running
turn's share only at the moment a snapshot is taken, while the panel
refetches that snapshot only when a usage event arrives. Nothing refetches
while tools run, so the number stood still.
Fix: ContextPanel now reports finished-turn runtime (elapsedMs) and the
running turn's start (activeTurnStartedAt), read under the same telemetry
lock. The panel and the context ring popover add the running share locally
and tick once a second while a turn is active, without polling the host.
Test: TestContextPanelSplitsRuntimeIntoCompletedAndRunningTurn (desktop Go)
does not build on main-v2 and passes after. context-panel-runtime.test.tsx
fails on main-v2 ('10s' !== '15s', value frozen across 60s with no usage
event) and passes after. Frontend run-tests: 477 suites passed; tsc clean;
repolint clean.
listDirForWorkspaceTarget sorted entries by DirEntry.IsDir and kept a
non-directory only when its lstat mode was regular. A symlink is neither,
so every link vanished from the file panel and from the "@" reference
menu, even one pointing at a folder or file inside the workspace.
Containment was also lexical only: workspacePathForBase joins and cleans
the path but never resolves links. So ListDir and ReadFileForTab, given a
path through a link, listed and previewed whatever sat behind it outside
the workspace, while the chat's "@" references already refuse that
through canonicalPathWithin.
A link entry is now listed as its target only when canonicalPathWithin
places that target inside the real workspace. A link that dangles or
leaves the tree stays out. So does one that resolves onto the folder
being listed or one of its ancestors: that folder would contain itself,
and the panel's compact-folder probe would follow it without a click.
ListDir refuses a folder whose real path is outside the tree.
ReadFileForTab refuses a workspace path whose real location is outside
it; a path that does not exist still reports its stat error.
Session-authorized external folder refs are unchanged.
Test: TestWorkspacePanelListsOnlyLinksInsideTheTree covers in-tree folder
and file links, out-of-tree folder and file links, a link to /etc, a
dangling link, "loop -> ." and "docs/up -> ..". On origin/main-v2 it
fails: the in-tree links are missing, ListDir("etc") = 72 entries,
ListDir("out-link") = 1, and ReadFile previews out.md,
out-link/shared.md and etc/hosts. It passes with the fix, and the other
listing and preview tests still pass.
Fixes#5914
Under a fake-ip resolver (Clash / mihomo) every public host answers with a
routable A from 198.18.0.0/15 beside a unique-local AAAA from fd00::/8.
The direct dial path refused the whole host as soon as any resolved address
was on the SSRF blocklist, so web_fetch failed for every site with
"refusing to fetch internal address ... (resolves to fdfe:...)".
Root cause: the guard treated one blocked address as a verdict on the host,
although the dial is pinned to a resolved address rather than the name. A
blocked address in a mixed answer can simply be skipped; the connect still
only ever reaches an address that passed the check. A host whose addresses
are all blocked is refused exactly as before.
The direct path moves into dialVettedAddress, which tries the allowed
addresses in resolver order, and the lookup becomes a package seam so the
test can supply a resolver answer.
Test: TestWebFetchDialsAllowedAddressBesideBlockedOne resolves a name to
[fdfe:dcba:9876::152, 127.0.0.1] and fetches from a loopback server. On the
base it fails with "refusing to fetch internal address api-docs.example
(resolves to fdfe:dcba:9876::152)"; with the fix it passes.
TestWebFetchRefusesHostWithOnlyBlockedAddresses keeps the all-blocked
refusal. go test ./internal/tool/builtin/, go vet, go run ./tools/repolint and
golangci-lint are clean.
A Service-owned session drops durable message bodies from its live
projection at open and after every recovery checkpoint. The writer's only
duplicate check for message/complete looked at those bodies, so it saw
only the ids accepted since the last checkpoint. A completion that reused
an older id (the approved-plan turn admitting its host message under the
user's reserved id did exactly this before bb6b7f608) was accepted and
written. Every full replay then refused the log as damaged: the session
could not be opened, and archive failed too, because archive proves the
target exists by taking a full snapshot.
The writer now keeps the set of live message ids beside the projection.
It is seeded from every open path, carried in the recovery checkpoint
(projection version 8, so older checkpoints rebuild once from the log),
and consulted before a commit is accepted, so a reused id is refused
with ErrDuplicateMessageID however long ago it became durable.
Logs already on disk keep the first message for a repeated
message/complete in every reader (projection, bounded startup including
the model workset, the checkpoint tail, catalog, history index with its
turn summaries, search), matching #10647's rule for replacements and what
the writer would have refused.
Archive and restore no longer read content to prove existence: a damaged
store is still movable to and from the trash. A damaged store reaches the
frontend as session_damaged instead of an unclassified failure, with a
message that says the session's file is damaged and can still be moved to
the trash.
The toast is now a no-drag region in the Electron shell. It sits over the
titlebar drag region, which swallowed clicks on its "show details" toggle.
A workspace below a Box Drive mount on Windows failed every config load
with "resolve project config path ...: The system cannot find the path
specified", whether or not reasonix.toml existed.
Root cause: resolveConfigAccessPath resolves the physical path through
pathidentity.Resolve (GetFinalPathNameByHandle on Windows) before it
confines a project config link to its directory. Below a cloud-drive
reparse point that resolution fails while the files themselves open
normally, and the failure was treated as fatal even when reasonix.toml
was a plain file or absent.
Fix: when resolution fails and the config entry itself is absent or a
non-link file, use the logical path. Such a file lies in its own
directory whatever its ancestors resolve to, so the confinement check has
nothing to decide. A link still has to resolve, so an unresolvable link
is refused as before.
Test: path_access_test.go stubs resolution to fail below a mount
directory. Without the fallback both LoadForRoot cases fail with the
reported "resolve project config path" error; with it they load (and the
project value is applied), and a reasonix.toml link under the same mount
is still refused.
remark-gfm defaults to singleTilde: true, so a reply such as
"500~1000 or 2000~3000" struck out everything between the first tilde and
the second. The shared remark policy, used by the live renderer, the
markdown worker and session export, now passes singleTilde: false; a
doubled ~~text~~ still strikes.
Test: markdown-pipeline.test.tsx renders two ranges plus one ~~...~~ span
on both the live and the worker path. Before: 4 FAIL (2 <del> each,
ranges not literal). After: 88 passed. pnpm test (476 suites), tsc for
the app and test configs, and repolint are clean.
A quoted paragraph was wrapped to the full terminal width and then
shifted right by the "▎ " rail (plus any list indent), so every full
row ran two or more columns past the edge. The terminal soft-wrapped
the overflow, leaving a stray rail on one row and the last characters
of the line on the next — most visible with CJK text, where every row
is filled to the edge.
renderBlockquote now lays the quote's body out at the width left after
its prefix and restores the renderer's width afterwards, so nested
quotes and quotes inside list items narrow once per level.
Test: TestBlockquoteRowsFitTheRenderWidth renders top-level, nested,
list-indented and Latin blockquotes at widths 20/41/80 and asserts no
row exceeds the width. It fails on the base (an 84-column row at
width 80, 24 at width 20) and passes with the fix.
Every native build waited on the input job, which spent 2 of its 2.5
minutes building the embedded docs and running the cache guard. Neither
is an input to a build. They move to their own job that runs alongside
the builds and gates only the seal; source CI, version and candidate
identity still resolve before anything builds.
Before approval the publish run proved each payload file's provenance
with one gh attestation verify after another, a network round trip per
file: 2.5 of its 6 minutes. The same check now runs eight at a time; any
file that fails still fails the step.
The candidate spent most of its 48 minutes compressing a 580 MB payload
with NSIS LZMA, a single-threaded pass of 5-6 minutes, three times per
architecture's worth of work on the critical path:
- the Windows build job built an unsigned installer and portable archive
that nothing uses when the release is signed (windows-sign rebuilds both
from the signed payload): ~8.5 minutes of the arm64 build. Signed
release builds now stop at the signing payload
(REASONIX_WINDOWS_PAYLOAD_ONLY); every other caller packages as before.
- windows-sign signed and packaged amd64, then arm64, so the two
compressions ran back to back (5.6 + 5.1 minutes). The finalize script
now runs in three phases: Certum signing of both payloads in the one
session, both packages built at once in separate worktrees (no
credentials involved), then Certum sealing of each installer in turn.
Without FINALIZE_PHASE it still does all three.
Installer bytes and compression settings are unchanged.
Expand every wildcard in the expected shard artifact pattern so CodeQL accepts the rerun contract test. The test still compares each shard report name with the workflow download pattern.
#10858: desktop 1.39.0 on Windows never showed a window. Every sandboxed
Chromium child exited with STATUS_BREAKPOINT, the GPU process crash-looped
until the browser quit, and the launcher reported that startup was not
verified within 30 seconds; --no-sandbox started it.
An allow entry for a specific AppContainer package SID on the DLLs next to
the executable does this (studio #10435 isolated it). The retired Windows
sandbox of 1.38.8 to 1.38.10 granted its package read/execute with
inheritance on the directory of the tool it launched, so such entries stay
on machines that ran it.
The shell now asks the service, synchronously and before Chromium starts
its first child, to remove allow entries naming a specific app package from
the tree the shell runs from (reasonix-desktop -strip-package-grants -app).
The judgement reads SID structure only; only allow entries go, so access
only narrows; an entry inherited from above is cut by protecting the object
that inherits it, leaving the parent untouched. Packaged Windows builds
only. If a removal is refused and the renderer dies before the window
shows, the shell names that cause instead of exiting silently.
internal/packagegrant is studio's package unchanged.
Verified on Windows 11 with the 1.39.1 build and the SID from the studio
recipe: the stock build shows the reported startup_failed dialog with no
window; the patched build starts and lists sessions with the grant on the
app directory and with it inherited from the install root (root and
service untouched). internal/packagegrant's Windows tests pass there.
A legacy transcript opened from the sidebar runs in place as a preview:
sends are refused, so it never holds anything its source lacks. It was
still persisted like any runtime. Moving to the imported session flushed
the preview's events and rewrote the transcript and meta (a resumed
preview carries the current system prompt, so the bytes differ), which
broke "the original file is kept" and made the import report the source
as updated and offer a branch right after it finished. The tab meta
writer rewrote the source .meta on open as well.
Every desktop path that persists a runtime (navigation, rebuild,
takeover, topic archive, removal, shutdown) and the tab meta writer now
skip a historical preview. Reproduced on Windows: transcript, event log
and both indexes stay byte-identical through preview, import and
navigation, and the update check reports unchanged.
A tab opened from a legacy row published only its transcript path, while
the row is listed by its source identity, so the renderer could not tell
they were one session and added a second row titled with the raw file id
and stuck on "indexing". The runtime node now carries the same source
identity (path and head through desktopSourceKey), and the existing
overlay marks the listed row open instead.
A headless `reasonix run`/`-p` binds a fresh v4 store in the project's
sessions-v4 root exactly like an interactive conversation, and nothing in
the store says it was a one-shot run. The desktop's historical catalog
lists every canonical store it finds there, so each agent-driven
`reasonix -p` became a permanent row labelled with its raw 32-hex id and
the Legacy badge.
The run kind is now persisted at creation: session.CreateOptions and the
v4 manifest carry an optional `kind`, the controller's
EnsureHeadlessRunSessionPath binds fresh stores with
kind=headless-run, and runAgent uses it. SessionInfo projects the kind
and the desktop's canonical catalog drops such stores from the sidebar,
the history list and the historical management listing. The store stays
resumable through --resume/--continue. The field is omitempty in the
manifest, so older binaries ignore it and keep reading these stores.
No header.json is written, so desktop ownership logic is unaffected.
Test:
- internal/cli TestRunPrintRecordsHeadlessRunKind drives runAgent -p
against a fake OpenAI endpoint; with runAgent still calling
EnsureSessionPath it fails with `store kinds = [""]`, and it passes after.
- desktop TestHistoricalCatalogOmitsHeadlessRunStores; without the
catalog filter it fails listing the store as a row labelled
0123456789abcdef0123456789abcdef in the sidebar, history and management
lists, and it passes after.
Stores created before this change carry no kind and stay listed.
A new conversation in a folder with many sessions disappeared from the
sidebar as soon as another conversation was selected.
Root cause: while any of a folder's session directories is scanning,
pending or degraded, ListProjectTopics answers with complete=false.
ProjectTree kept the last complete window by returning early for such
a first-page refresh, before mergeIncompleteProjectTopicPage ran and
before the page's keys reached itemKeys. The window renders only rows
whose key is in itemKeys plus the active row, so a new conversation
showed only while it was active. Once the user switched away it was no
longer active and not accepted, so it vanished until a complete page
arrived. With few sessions a full reload follows quickly; with many,
each refresh reconciles every catalog target and the Global scan stays
incomplete long enough, or permanently when a directory is degraded.
Fix: drop the early return. An incomplete first page goes through the
existing merge: residents keep their complete-page rows and order,
only newly discovered keys are added, and the old snapshot and cursor
are retained as before.
Test: project-tree-loading.test.tsx gains a case where a busy folder
(12 rows, 5-row window) receives an incomplete refresh carrying a newer
conversation. On base it fails ("a conversation discovered while the
catalog is incomplete is accepted into the window": A-0 is first, the
new row is absent); with the fix it passes. All 476 frontend suites
pass, tsc --noEmit is clean, repolint is clean.
`reasonix review` runs inside the checkout it reviews, which is untrusted.
Two routes let that checkout decide what review executes or asks for:
- The tool registry was built from the merged config, so a checkout's
reasonix.toml `[tools.search] engine = "rg"` + `rg_path = "tools/rg"` made
review's grep execute the checkout's own binary (unsandboxed on Windows),
and its `[sandbox]` chose the bash sandbox mode.
- The review skill resolved with project scope, so a checkout's
`.reasonix/skills/review/SKILL.md` replaced the built-in prompt and its
allow-list (e.g. adding web_fetch under an attacker-written prompt).
Review now builds its tool registry from the user-only config
(config.LoadUserConfigReadOnly) and resolves its skill from a store with no
project scope, so only built-in and user-level skills are candidates.
Credential env names from the merged config are still registered for env
filtering.
Two paths made a 1.38 user's sessions look gone on the first 1.39 launch,
both reproduced on Windows with data written by the 1.38.3 desktop:
- With no tab to restore, the Global folder started collapsed, so its
first page was never requested and the sidebar showed no sessions at
all. The folder now starts expanded when nothing is open; a manual
collapse still wins.
- The chat 1.38 opens at launch is saved as the active tab. When it was
never sent it has sidecars (.meta, goal state, inbox lock) but no
transcript, event log, turn log or subagent, and restore classified it
as recoverable legacy artifacts: every launch opened on a startup error
and "unable to load session". Such a tab is now dropped as stale
presentation, on both the unmapped and the archived-mapping path. No
file is touched.
#10843 gave task, skill, fleet and background subagents their own hook
session, but three agents that call tools still ran with no hook runner:
- the dual-model planner (plannerOpts in boot.build) runs read-only
research tools such as read_file, and its Options carried no Hooks, so
a PreToolUse deny on reading a secret did not cover the planner's reads;
- `reasonix review` builds its subagent outside boot and passed Options
with no Hooks at all;
- the desktop settings-page try run (App.TrySubagentProfile) runs
read_file, search and policy-wrapped bash in the active workspace, also
with no Hooks.
Options.Hooks is the whole ToolHooks surface, so each of these agents now
runs PreToolUse, PostToolUse and PostToolUseFailure around its tool calls,
PostLLMCall on each model turn (its stdout replaces the reasoning stored in
that agent's session) and PreCompact before its compaction (its stdout is
added to the summary guidance), not only tool hooks. No agent reads hooks
while building its prompt or tool schema, so the cache-stable prefix is
unchanged.
Hook sources and sessions:
- Planner: hook.Runner.ForRole("planner") keeps the session's resolved
hooks, cwd and spawner, and derives its session ID as
"<parent session>:planner" each time a hook fires, so a SetSessionID on
the parent (/new, /clear, resume) reaches it and hooks keyed on
session_id do not merge sessions.
- reasonix review: loads only the user's own hooks, global settings.json
and installed plugins. hook.LoadOptions gains SkipProject, which leaves
out <root>/.reasonix/settings.json, so reviewing an untrusted checkout
never executes a command that checkout configures. Its hooks keep the
checkout as cwd, which is what they inspect, and run with
NoDefaultCurrentDirectoryInExePath=1 (Runner.WithoutCwdCommandSearch), so
on Windows cmd.exe never resolves a bare `python` in a user hook to a
python.exe the checkout ships. Each run is its own session,
"review:<random>".
- Desktop try run: loads project and global hooks the way a chat session
in that workspace does, under "try-subagent:<random>".
boot.NewCommandHookRunner now takes the hook.LoadOptions to resolve, so a
caller states its hook sources. The hook package doc no longer claims
project hooks load only for trusted projects.
The guardian is left as is. On main-v2 nothing outside internal/guardian
calls Session.Review or ReviewVerdict, the only paths that run its agent,
so it executes no tool. Wiring it is not a one-liner either: its agent is
built inside guardian.NewSession, which would need a new parameter across
29 call sites for a path no production code reaches.
Tests:
- TestBuildRunsPreToolUseInsidePlanner (through boot.Build): a plan-only
turn whose planner calls read_file is blocked by PreToolUse, and the hook
sees "<parent>:planner" where <parent> is the ID the UserPromptSubmit
hook got. After ClearSession a second turn's planner follows the new
parent ID.
- TestReviewCommandRunsOnlyUserHooks: with a global deny hook and a
project hook, the global one blocks read_file and the project one never
runs; two runs get distinct review:<id> sessions.
- TestTrySubagentProfileRunsWorkspaceAndUserHooks (desktop): both the
project hook and the global deny run for the try run's read_file under
a try-subagent:<id> session, and the file contents never reach the model.
- TestReviewHooksNeverResolveCommandsAgainstTheCheckout: every review hook
spawn carries NoDefaultCurrentDirectoryInExePath=1 with the checkout cwd.
- TestForRoleDerivesSessionFromParentAtFireTime and
TestWithoutCwdCommandSearchReachesEverySpawnOfItsChildren (internal/hook).
Docs: GUIDE.md and GUIDE.zh-CN.md describe which hooks each read-only
child runs and under which session ID.
Refs #9255
* docs(release): prepare v1.39.1 notes
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
* docs(release): describe the session catalog fix by what users saw
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: esengine <[email protected]>
This reverts commit 1aa4a1fb3.
The 1.x line keeps the CLI's install channels (npm `reasonix`, the
Homebrew cask and the CLI update pointers) until 2.x is stable; the
studio line now publishes them only when STUDIO_PUBLISHES_CLI is set.
Without this, 1.39.1 would ship its fixes while npm and Homebrew stayed
at 1.39.0.
Restored workflow steps are pinned to the same full-length SHAs the
rest of main-v2 uses, and the contract test that cuts release-npm.yml at
setup-go matches the pinned form.
A pull request authored with GITHUB_TOKEN never starts other workflows, so
the weekly acknowledgments PR never reported the checks branch protection
requires and could only land by bypassing it. The step now uses the
dedicated ACKNOWLEDGMENTS_TOKEN secret when it is set, and falls back to
GITHUB_TOKEN otherwise.
The contributor table also listed github-actions[bot]; bot accounts are
now filtered before the top 20 are taken (30 are fetched to keep 20).
Checked by running the script against the live API: the previous version
writes one github-actions row, this one writes none.
TestScheduleSnapshotCoalesces and TestCloseTabNoResurrectionFromAutosave
polled the session file for 10s and then gave the loop another fixed 10s
to go idle. Neither bound is anything the autosave loop promises: one pass
can wait sessionFileLockWait (5s) on the compatibility lock, ReplaceFile
retries a locked destination for up to ~1.5s per replace, and a failed pass
is retried twice more. On a loaded hosted Windows disk the first save of a
test binary missed both windows.
CI evidence (desktop-windows-go-group, windows-latest):
- 36162070209/108163266006: TestScheduleSnapshotCoalesces 59.13s; the
first saveLocked entry is logged ~50s after the test started, both waits
expire, then "open ...session.jsonl: The system cannot find the file
specified" followed by "file already closed".
- 36144229234/108103306720: same test, 25.12s, file never had the content.
- 36164121404/108168781324: TestCloseTabNoResurrectionFromAutosave, 19.97s,
same symptom with a single TurnDone.
The two trailing errors are teardown, not the save: once the idle wait gave
up, the remaining cleanups closed the controller's event store and removed
the TempDir under the still-running loop.
Diagnostic runs on windows-latest (run 36221953315, CI-shaped
`go test -run ^Test[Q-S] ./...` x4 and ^TestC x4) put the same tests at
0.7-1.8s with every phase I/O-bound and no scheduler stall, versus 0.2s
unloaded: latency scales with the disk, which the test does not control.
Fix: wait for the loop to go idle - its termination is guaranteed by the
bounded waits and retries above - and only then read the file once. The
only cap left is the test binary deadline. Every autosave test in the file
uses this, including the retry test's former 5s bound.
Reproduction (test-only, not committed): fileutil.CrashPoint sleeping 1s
before every durable write/replace, then running the original test body.
- origin/main-v2: TestScheduleSnapshotCoalesces 3/3 FAIL and
TestCloseTabNoResurrectionFromAutosave 3/3 FAIL, with the CI lines
(app_autosave_test.go:139/:497 and :92) and the same teardown pair
"no such file or directory" then "file already closed".
- this change: 3/3 and 2/2 PASS, no teardown errors.
Unmodified stress: the five autosave tests -count=200 clean,
-race -count=20 clean.
The macOS native browser smoke (electron/scripts/browser-runtime-smoke.mjs,
job desktop-macos) failed with
RpcError: cancelled: browser request cancelled or expired
at Timeout.<anonymous> (main.cjs:8:34337)
10 times across 6 PRs and main-v2 (e.g. runs 35905864950/job 107334745447,
35924725548/107398259097, 36143253798/108099365388,
36144902003/108109092740, 36166759544/108177697220,
35847129273/107137474207). main.cjs:8:34337 is the 10s timer in
BrowserRecorder.start that waits for the recorder renderer's "started"
message; passing runs reach "started" in under 2s.
Root cause: the recorder asked getDisplayMedia for { frameRate: 25 }. The
fixture page is static, so tab capture emits only its first frame and the
refresh frame a newly attached video sink requests. The first frame can
reach the track before the <video> sink connects; when the capturer answers
the sink's refresh with a frame that trails the first by under 40ms, the
track's 25fps limiter discards it. Nothing else is ever produced, the video
never reaches HAVE_METADATA, the canvas is never painted, no chunk arrives
and start aborts at 10s. Instrumented stalls show exactly this in
MediaStreamTrack.stats: deliveredFrames 1, discardedFrames 1, totalFrames 2,
unchanged for 9s, while the page, capture host and capturePage stay healthy.
Fix: request the capture track without a frame-rate cap. The output rate is
already set by the canvas paint interval (40ms) and requestFrame, so the cap
only ever discarded frames.
Reproduction (local macOS, Electron 44.2.0): a test-only hook attaches the
video sink immediately after the track's first frame, the interleaving from
the stalls.
before (origin/main-v2): 9/40 recordings abort at 10s; all 9 are exactly
the runs whose track discarded a frame, the 31 without a discard pass.
after: 0/200 fail, 0 discarded frames, although 115/200 runs had a second
frame within 40ms of the first.
Full smoke minus the foreground-input block, 6 parallel workers under CPU
load: before 4 recorder aborts in 540 runs, after 0 in 192.
recorderRenderer.test.ts pins that the capture track is requested without a
frame-rate limit; it fails on the previous renderer.
TestLegacyTopicArchiveVisibility failed in desktop-windows-go-group (I-P)
8 times across 7 branches, including main-v2, e.g. runs/jobs
36141013690/108092129567, 36158613176/108151570952,
35910881048/107351239668, 35979938768/107570884455:
topic_archive_visibility_test.go:41: session catalog did not stop
before directory cleanup
(the two older runs, before the cleanup check existed, show the same
handle as "TempDir RemoveAll cleanup: ... rebuilt-catalog.sqlite: being
used by another process").
Root cause, two parts:
- stopSessionCatalog dropped the catalog pointer, then gave up at its
deadline while Catalog.Close kept running in the background. Nothing
kept the in-flight close, so the next stop found nothing to wait for
and reported true while the SQLite handle was still open. This is
reachable in production: a rebuild whose stop times out restarts the
watcher, and the next rebuild's stop then reports the old handle
released. In the test, the mid-test stop's result was ignored and the
old owner's cleanup check passed vacuously.
- The test bounded the whole orderly shutdown (reconcile drain, worker
drain, TRUNCATE checkpoint, close) by 1s of wall clock. Under load the
checkpoint alone was measured at up to 1.87s, so the bound was below
the observed latency of work the test does not control.
Fix: each stop records its close; the close runs to completion in the
background and waits for any earlier one, and stop reports true only
once every handle the App opened is released. The reconcile wait still
ends at the deadline, since a reconcile can wait on discovery nobody
resumes once stopped. The test waits on that condition with the shared
sessionCatalogTestDeadline hang detector, and checks the mid-test stop.
Reproduction:
- TestStopSessionCatalogWaitsForEarlierTimedOutClose holds a read
snapshot so the closing checkpoint waits out its busy timeout, stops
with a 1ms deadline, then stops again: origin/main-v2 fails 20/20
("stop reported the catalog stopped while it was ready"); fixed passes
-count=200.
- 24 concurrent GOMAXPROCS=1 processes of TestLegacyTopicArchiveVisibility
-count=4: origin/main-v2 17/24 processes fail with the CI line (48
hits); fixed 0/24.
desktop-windows-go-group (I-P) ran `go test -run ^Test[I-P] ./...` and
reasonix/desktop hit Go's default 10m per-package alarm:
run 36165720818 / job 108174359373 (main-v2) FAIL reasonix/desktop 600.369s
run 36161103402 / job 108158948888 FAIL reasonix/desktop 600.159s
run 36166824914 / job 108179614742 FAIL reasonix/desktop 600.199s
The reruns of the same commits passed with reasonix/desktop at 348.6s
(job 108167833614) and 401.9s (job 108309233796).
Root cause: no test hangs. At the alarm the running test had been going
for 1-15s (TestLegacyTopicArchiveVisibility,
TestOpenCanonicalSessionAfterWorkspaceRemovalFromNativeSurface,
TestProjectTreeMigratesNewCLISessionAfterProjectDirMarker), and the
largest gap in the product log (66-86s after the parallel-NN.jsonl
writes) covers TestParallelDesktopTabs... through
TestPurgeMigratedSourcesBusyWriterResumesFromTombstone, which take 27.9s
locally: the same ~3x Windows slowdown seen everywhere else. I-P holds
651 tests and is the heaviest group by far (other groups: 66-244s on
the same runners, Q-S up to 398s), so on a slow hosted runner its
package run alone crosses 600s.
Fix: split I-P into I-M (367 tests, 69s locally) and N-P (314 tests,
67s locally) in the partition driver and in both matrices that use it
(desktop-windows-go-group and desktop-go-race). The partition test now
also holds the race matrix to the driver's group list so the two cannot
drift. The alarm stays at Go's default: it is the hang detector, and
each group now has roughly twice the headroom under it.
Reproduction (macOS, CGO_ENABLED=0, same alarm scaled to local speed;
I-P takes ~138s here, so 120s stands for 600s on a runner ~5x slower,
where the failing jobs were):
before: go test -run '^Test[I-P]' -timeout 120s .
panic: test timed out after 2m0s, FAIL 120.874s
after: go test -run '^Test[I-M]' -timeout 120s . ok 78.2s / 86.7s / 96.8s
go test -run '^Test[N-P]' -timeout 120s . ok 67.1s / 86.5s / 71.1s
TestHistoricalRegressionShutdownDrainsStartupWorker panicked with
"close of closed channel" on Linux desktop-go, killing the whole
reasonix/desktop package run:
run 35905864950 / job 107334745459 (main-v2 3a0a3d91)
run 36160668180 / job 108157764097 (main-v2 c0b98408)
run 36152302442 / job 108137534322 (PR, rerun passed)
The panicking goroutine is the catalog discovery started by
requestHistoricalCatalogWithContext, emitting from
discoverHistoricalSessions' deferred notify (historical_catalog.go:125).
Root cause: after tabs are restored the startup worker calls
requestHistoricalCatalog (spawning a discovery worker) and then
emitProjectTreeMetadataChanged. Both publish a project-tree change, and
both are legitimate: the discovery replaces a nil catalog with an empty
one, so it reports a change. The test's hook closed `entered` on every
call, assuming exactly one emission before shutdown. Normally the
discovery is still running when the test cancels the coordinator and it
returns without notifying; when the test goroutine is descheduled after
<-entered, the discovery finishes first, emits, and closes `entered`
again. The product's behaviour is correct; the test asserted on an
ordering it does not control.
Fix: the hook signals `entered` once and parks every caller until
release. Stop must drain both workers either way, so the assertion that
shutdown waits for the parked publisher is unchanged in meaning.
Reproduction: a copy of the test with a 2s pause between <-entered and
stopHistoricalImports fails every run on origin/main-v2 with the CI's
exact stack; with the fixed hook it passes -count=20. The real test
passes -count=200 -cpu 1,4 and -race -count=10 over TestHistoricalRegression*.
Flake: desktop-browser-group (transcript), step "Test native browser
foreground runtime" (xvfb-run node electron/scripts/browser-runtime-smoke.mjs).
Four failures, all at the first cross-origin click, all with
RpcError: page_not_ready: input target has not reached a stable
rendered frame; observe the page again data: { kind: 'page_not_ready' }
run 35833016485 / job 107091102092 (main-v2)
run 35983968809 / job 107583562246 (main-v2)
run 35954377998 / job 107490367842 (main-v2)
run 35866024386 / job 107199844899 (PR fix/transcript-render-isolation)
Root cause: dispatchMouseInput refuses a mouseMove, before dispatching
anything, when pageInputReady does not see two animation frames with
unchanged geometry within 500ms. The refusal is typed and retryable; its
contract is "observe the page again". The smoke sent its first click right
after iframe onload, which is not a rendered-frame boundary, and treated the
refusal as fatal. In every failing log the run ends ~0.7s after Electron
starts versus ~0.34s to the first click in passing runs, consistent with the
500ms unpainted-frame deadline on a slow runner. The product refusal is
correct; the smoke asserted a timing it does not control.
Fix: every native smoke click goes through clickObserved, which follows the
contract: on page_not_ready it re-observes (snapshot + ref resolution, or
the zoom-point read) and retries within 5s; any other failure, or the
refusal at the deadline, still fails. A refused child-frame attempt retires
its OOPIF session, so the shared-session assertion counts from the
observation that clicked, and the idle-release assertion counts from the
attachments before idle.
Reproduction: REASONIX_BROWSER_UNSETTLED_INPUT=1 keeps the fixture page
moving until the first input is refused, then stops it before
re-observation, and asserts a refusal happened. The Linux CI step now sets
it, so the refusal/re-observe path runs on every build.
Local, macOS (Electron 44.2.0; screen locked, so run with
--disable-gpu-vsync --disable-frame-rate-limit to keep frames flowing):
origin/main-v2 + hook only: 0/20 pass, 20/20 the CI page_not_ready line
fix, REASONIX_BROWSER_UNSETTLED_INPUT=1: 29/30 pass (1 failure in the
later recording-takeover phase, "cancelled: browser request cancelled
or expired", after all input sites had passed)
fix, default: 15/15 pass
Root cause: canonical (v5) sessions had nowhere to keep their permission
preset. The legacy BranchMeta sidecar is refused for them, and neither the
Session Service projection nor workspace presentation carries a preset, so
the value lived only on the tab. OpenSession applied the source surface's
live preset to the target session (prepareCanonicalControllerRuntime read
it from the outgoing controller). Session B inherited A's
danger-full-access, and a surface built from New Chat forced workspace-write
onto every session opened into it. The renderer had the same leak one layer
up: its composer profile table is keyed by tab, and the push that follows a
navigation sent the previous session's preset to the new one.
Decision: keep the preset per canonical SessionID in a desktop-owned record
(desktop-session-presets.json next to desktop-tabs.json), with no change to
the session log schema. Opening a session, and restoring tabs at startup,
use only the value recorded for that exact SessionID. A session with no
record gets the new-session default. The value on the surface is never
carried over.
Recording rule: a record is written only by SetPermissionPresetForTab, the
one preset setter fenced by session. The caller passes the SessionID of the
permission snapshot it read; under the tab's turnStartMu, which also
serializes navigation, the call is refused with
reasonix_error:permission_session_changed (errPermissionSessionChanged)
unless that id equals the live controller's session. The record is keyed by
that same session and the file is written outside App.mu. The revision alone
cannot fence this: it is per controller, so two freshly opened sessions share
a number. SetToolApprovalModeForTab and SetModeForTab name no session and so
never record; saving tabs, submissions, composer-profile sync and draft
settings never record either.
Fix:
- sessionPresetStore exposes restore, record and forget. A failed write
removes the file, or empties it in place when the directory refuses the
removal, so a restart opens every session at the default; the full set is
written again on the next record or forget.
- The renderer passes the snapshot's sessionId to SetPermissionPresetForTab.
On permission_session_changed it re-reads the tab and does not retry the
choice on the session the tab now shows.
- Whenever a tab's canonical SessionID changes (syncTabSessionIdentity:
New Session, clear, legacy continue, rebuild), the tab and its controller
take that session's own record or the new-session default.
- New Session on a blank tab that is reused drops the blank session's record,
resets it to the default, and advances the controller's permission
revision (Controller.InvalidatePermissionSnapshots), so a snapshot read
before the reuse cannot record a choice for the session handed out as new.
- A fork tab starts at the new-session default rather than the source tab's
preset.
- The canonical open path passes the target session's restored preset to
prepareCanonicalControllerRuntime, and startup restore does the same for
tabs bound to a SessionID. Legacy tabs keep their existing sidecar path.
A session that is permanently deleted drops its record.
- docs/desktop-migration inventory regenerated for the new signature and
line positions.
- Composer profiles in the renderer record which session they were read for
(owner). A profile, or a meta snapshot, whose owner belongs to a different
session than the tab's current one is discarded, not reconciled.
Tests:
- TestCanonicalSessionPresetFollowsSessionAcrossNavigationAndRestart and
TestRestartDoesNotTrustSurfacePresetForUnrecordedSession fail on
origin/main-v2 (session-B / session-A tab preset = "danger-full-access",
want "workspace-write").
- TestNewSessionInTabDoesNotInheritSourcePreset: A=full, New Session in the
same tab -> the new session is the default, has no record, and stays the
default after restart through desktop-tabs.json and after reopening; A is
still full.
- TestNewSessionOnBlankTabDropsItsEarlierChoice and
TestForkStartsAtNewSessionDefault cover the reused blank and fork paths.
These three fail without the recording rule above with
tab preset = "danger-full-access", want "workspace-write".
- TestUnreadablePresetRecordsRestoreDefault: a corrupt record file restores
the default.
- TestStalePresetChoiceDoesNotLandOnNavigatedSession: snapshot A, open B
(same revision), then set full access with A's snapshot -> refused with
errPermissionSessionChanged, B not recorded, B stays at the default. The
same scenario through the unfenced signature fails with "stale choice for
session-A accepted on session-B" and B recorded as danger-full-access.
- TestPresetWriteFailureInReadOnlyDirFailsClosed: full access recorded, the
config directory made read-only, read-only chosen -> restart does not
restore full access. Without the in-place truncation it fails with
narrowed to read-only, write failed, restart restored "danger-full-access".
- TestSnapshotBeforeBlankSessionReuseIsRefused: snapshot the blank tab, New
Session reuses it, set full access with the old snapshot -> refused and
nothing recorded. Without the revision advance the set is accepted and
recorded as danger-full-access.
- The desktop preset tests pin a host that offers every preset
(control.SetPresetSandboxForTest), so they assert the same thing on a
runner without an OS sandbox, where read-only and workspace-write are not
offered. Pinned to "no sandbox", three of them fail with
permission preset "read-only" is unavailable: shell sandbox requested but
unavailable on this host.
- TestUnfencedModeSettersDoNotRecord: SetToolApprovalModeForTab and
SetModeForTab leave no record.
- frontend permission-preset-session-fence.test.tsx: a navigation between the
snapshot and the set neither applies nor records the stale choice, the
refusal is not retried, and the tab is re-read.
- frontend composer-profile-session-navigation.test.tsx runs the real
projection, lifecycle and controller-profile hooks through A -> B -> A.
The v1.38.9 desktop release page reads "This vv1.38.9 desktop release":
resolve already emits the version with its v prefix, and the disclosure
template added another one.
Normalize the prefix in the step instead of assuming either convention,
so the public text stays correct if the resolver output ever changes, and
assert the shape in the release workflow contract test.
Root cause: legacy conhost with a CJK TrueType font (the default on
Chinese Windows) sizes East Asian Ambiguous runes by the glyph, so it
draws a font-dependent subset two cells wide: · … “ ” ‘ ’ — – ● → ↑ ↓
◆ ° × and Greek/Cyrillic letters among them. The TUI and its renderer
count all of them as one cell, so every full-width row carrying k of
them is k cells too wide on screen: conhost wraps it, the alt-screen
frame grows past the window and scrolls, and later repaints land on
shifted rows, which is the stacked-frame garbage in the report.
Decision: measure instead of guess. When stdout is a console, a
never-activated screen buffer of that console (same font) measures
each non-ASCII rune the layout counts as one cell, once, via
WriteConsoleW and a cursor read-back. A rune the console draws wider is
swapped, after layout, for a one-cell stand-in both sides agree on:
Unicode's halfwidth variant when it has one (→ becomes U+FFEB), else
the OS US-ASCII best-fit (· becomes ., “ becomes "), else the OS
default character. Each candidate is itself measured before it is
used. The swap is rune for rune at equal counted width, so applying it
to the finished frame changes no row's layout; escape sequences and
OSC payloads pass through untouched. A pseudoconsole (Windows Terminal,
VS Code, SSH) measures these runes as one cell, so nothing is replaced
there; other platforms get a nil fit and are unchanged.
Test: TestChatFrameFitsConhostMeasuredWidths renders the real chat
View at 120 columns with the width table measured on a Chinese
Windows 11 conhost and asserts no row draws wider than the terminal.
With the substitution disabled it fails:
row 0 draws 121 cells on conhost, terminal has 120
With the fix it passes on macOS and on the Windows box. In a real
conhost window, the unfixed binary's status row wraps ("EFFORT aut" /
"o") and the header scrolls away; the fixed binary keeps the 30-row
frame intact. Under ConPTY the fixed binary still emits the original
glyphs.
Fixes#10540
Root cause: a force-killed turn lost state in two ways. Sessions opened
from a legacy transcript write the model-visible .jsonl only on the 30s
autosave tick or at turn end, so a kill before the first tick dropped the
prompt from the model's context even though the display ledger kept it.
Event-log (v3) sessions record the prompt on admission, but streamed
assistant text reaches the log only when the message completes, so a kill
mid-stream lost the partial reply entirely.
Decision (option A): two bounded changes, no change to the cache-stable
prompt prefix.
- The agent announces a new advisory checkpoint boundary right after the
user message is admitted. A controller without an event store saves the
legacy transcript there (one extra save per turn); stores that already
hold the message ignore it, and a failed save only logs.
- The controller accumulates the open stream's deltas and, on the existing
30s autosave tick, appends an optional stream/checkpoint event carrying
the same local-only interrupted record a cancelled stream leaves. It
holds commitMu so the checkpoint can never land after the commit of the
message it describes. The projection keeps the newest checkpoint of the
open turn and drops it on any later message commit or turn boundary;
restart recovery upserts it before turn/end interrupted. A completed
stream therefore never shows twice, and the record stays out of
provider-visible history.
Tests (internal/control/turn_kill_durability_test.go), each killing a
child process with os.Exit and no TurnDone, then reopening:
- TestKilledLegacyTurnKeepsItsPrompt fails on main-v2 with
"prompt of the killed turn lost after restart"; passes with the fix.
- TestKilledTurnKeepsItsPartialOutput fails on main-v2 with
"partial output of the killed turn not durable after reopen: 0 rows";
passes with the fix, and the partial text stays out of ModelMessages.
- TestCompletedStreamSupersedesItsCheckpoint and
TestKilledAfterCommittedStreamShowsItOnce fail on main-v2 with
"no partial-output checkpoint was written while the stream was open";
with the fix the completed reply appears exactly once, including after
a kill between its commit and turn end. Disabling the supersede rule
makes the latter fail with the checkpoint replacing the reply.
Root cause: Electron 44 picks its Wayland Ozone backend by itself in a
Wayland session. On drivers whose EGL platform init fails there (Kylin V10
SP1 with the Mali stack in #10369) the GPU process exits and the app dies
with 139 before a window appears; the same machine works with
--ozone-platform=x11. Nothing in the launch chain chose a backend. The
.desktop entry runs reasonix-launcher, which runs reasonix-desktop, whose
bootstrapShell builds the Electron argv and starts it detached, so that
spawn is the one place that controls the shell's argv. The flag has to be
in argv: Chromium selects Ozone before the main script runs.
Decision: default to X11 whenever it is available. bootstrapShell prefixes
--ozone-platform=x11 on Linux when the session is Wayland
(XDG_SESSION_TYPE, else WAYLAND_DISPLAY) and DISPLAY is set.
REASONIX_OZONE_PLATFORM=wayland keeps native Wayland, x11 forces X11, auto
is the default. A pure Wayland session without DISPLAY and an X11 session
are unchanged, and an explicit --ozone-platform or --ozone-platform-hint
argument wins. Relaunches through the launcher re-decide; Electron's own
relaunches reuse process.argv and keep the flag.
Test: TestBootstrapShellChoosesOzonePlatformFromSession drives
bootstrapShell with a fake shell that records its argv, over the session
table. On origin/main-v2 it fails:
shell argv = ["--flag"], want ["--ozone-platform=x11" "--flag"]
With the fix all nine cases pass.
Root cause: handleFinalResponse accepts any reasoning-only clean stop as
the end of the turn unless RequireVisibleFinal is set, which only
internal callers set. When the model runs tools and then stops with
reasoning only, the tool results never get a visible synthesis and the
turn goes idle until the user sends another message (#9758).
Decision: a narrow structural retry. When this turn ran tools, no
visible assistant text follows the last tool result in the transcript,
and the stop is reasoning-only, the existing empty-final retry runs
once. A second reasoning-only stop is accepted. A reasoning-only answer
to a turn that ran no tools is still accepted as final, as #9788 set
out. The judgement reads structure only: usedAnyTool, empty content,
and message position; no wording is inspected.
Tests: TestRunRetriesReasoningOnlyStopAfterToolRoundOnce and
TestRunAcceptsSecondReasoningOnlyStopAfterToolRound drive a scripted
provider through Agent.Run. On the base both fail with
"provider calls = 2, want tool round + reasoning-only stop + one retry";
with the fix they pass. The existing no-tool reasoning-only tests
(TestRunAcceptsReasoningOnlyFinalAnswer and siblings) pass unchanged,
as do internal/agent and its direct dependents.
internal/crashreport gained process_unix.go (built on darwin) with the CLI
fatal-crash capture, but the package was not in darwinRoots, so pull
requests touching it skip the macOS lane. release-control's
"every darwin-specific package is inside the pull-request group" test
caught it on the main-v2 push; the pull request itself skipped
release-control by path.
scripts/macos-go-tests.test.mjs: 2 pass / 1 fail before, 3 pass after.
The Linux reasonix-desktop service was the one Go binary in the package
built with cgo left at its default. On the ubuntu-22.04 release runner that
links it against glibc 2.35, so the desktop-v1.39.0 tarball's service names
/lib64/ld-linux-x86-64.so.2 and needs GLIBC_2.32/2.34: it will not start on
glibc 2.31 systems (Debian 11, Ubuntu 20.04, Kylin V10, UOS 20), while the
launcher, migrator, CLI and update helper beside it are already static.
Nothing on Linux needs cgo: every `import "C"` file is darwin-only, sqlite
is pure Go, and the Linux StatusNotifierItem tray is pure-Go D-Bus. The
tray files were gated on cgo, though, so a plain CGO_ENABLED=0 build would
have swapped in the no-op tray; they now select the D-Bus tray on linux
regardless of cgo.
- scripts/desktop-build.sh builds the Linux service with CGO_ENABLED=0.
- verify.mjs reads the ELF program headers of every Go member of the Linux
tarball and .deb and refuses one that names a program interpreter, so the
release build fails instead of shipping a glibc floor again.
Test: lib.test.mjs adds ELF parsing and archive-member cases; on the base
it fails at import ("does not provide an export named
'checkStaticGoMembers'"), with the fix 23/23 pass. Against real binaries,
checkStaticGoMembers reports the desktop-v1.39.0 release service as
"reasonix-desktop is dynamically linked (interpreter
/lib64/ld-linux-x86-64.so.2)" and returns no errors for the service built
by the fixed script path. `GOOS=linux CGO_ENABLED=0 go list` now selects
tray.go, tray_loop_external.go and tray_health_unix.go instead of
tray_nocgo.go; linux vet/test compile and darwin vet pass.
Fixes#10372
The sidebar is meant to show Global only while it holds conversations
or has a custom title, or while no project exists. The registry merge
in mergeCanonicalWorkspaceShellsFromProjection broke that: it re-adds
every workspace whose registry record is Visible, and
ensureDesktopWorkspace marks Global Visible the first time anything
targets it, including opening the Global composer draft
(OpenSessionDraftForTarget), even when no session gets created. From
then on Global stayed in the sidebar with no conversations, whether or
not any project existed. The reporter saw this on one machine and not
on another because it depends on whether Global was touched before the
first project was added, not on the OS.
Projects are added on purpose, so their Visible flag stays
authoritative. Global is never added on purpose. The registry now keeps
it only while it owns an unarchived session or a source mapping.
Test: TestGlobalFolderAfterProjectCreatedFollowsGlobalConversations
- base: draft_target_without_a_conversation fails with
"Global folder listed = true, want false after a project was created"
- fix: all three cases pass (untouched, draft target, blank
conversation, which still keeps Global)
The transcript's parsed-markdown cache was keyed on `${item.id}@${revision}`.
A settled assistant message carries a live id (p3) while the controller owns
it and a history id (m:<messageId> / he:<entryId>) once the store projection
renders it, so the same text parsed under one id missed under the other and
went back through the markdown worker.
A parse is a pure function of its source text, so the cache is now keyed by
the text's content revision and a hit additionally requires the stored source
to equal the requested text, which keeps a 32-bit revision collision a miss.
The row id still opts a row into caching; it no longer names the entry.
Test: markdown-natural-flow renders a settled body under cacheKey "p3",
remounts it under "m:msg-1", and asserts no second worker parse. On base it
fails with `4 !== 3` ("a row re-keyed by the history projection reuses the
parse of the same text"); with the fix it passes. transcript-store covers the
LRU budget, pinning and the collision miss (382 passed).
An explicit --model whose provider has no key failed with
`provider "deepseek-flash" requires DEEPSEEK_API_KEY`. Provider keys
resolve only from <Reasonix home>/.env (storedCredentialValue), so the
message sent users to export the variable in their shell or VM-wide
environment, which Reasonix never reads. It also labelled the model ref
as a provider. Reported through `reasonix acp --model deepseek-flash`
from the VS Code extension in #10458.
The error now names the model, the variable, the credentials file path
and `reasonix setup`, and says shell environment variables are not read.
Test: TestResolveModelForCLIMissingKeyNamesCredentialFile sets the key
only in the process environment. On the base it fails with
error "provider \"deepseek-flash\" requires REASONIX_CLI_TEST_KEYLESS_KEY"
does not mention ".../.reasonix/.env"
and passes with the fix; go test ./internal/cli/ passes.
loadProjectsFile runs on every sidebar read and catalog pass. Its
normalizers (project dedupe, pinned list, sidebar order, organization
sidecar) find a root with projectIndexByRoot/projectRootInList, and each
comparison went through pathidentity.Same, which resolves both paths from
scratch. One load therefore cost O(projects^2) identity resolutions; on
Windows each resolution opens every ancestor directory and queries its
case-sensitivity flag, which matches the Procmon trace in #10738 (about
57k Read-Attributes opens on every project root, 533k
QueryCaseSensitiveInformation calls, almost no file content read).
pathidentity gains a pass-scoped Matcher that resolves and stats each
distinct path once; Same delegates to it, so a single comparison behaves
exactly as before. The project-file normalizers share one matcher per
pass. Nothing is cached across passes, so a directory whose identity
changes is seen fresh on the next load.
Test: TestLoadProjectsFileResolvesEachRootLinearly loads 24 projects
(pinned, sidebar order, organization sidecar, one symlink alias) and
counts identity resolutions. With only the counting seam in place it
failed: "loading 24 projects resolved path identity 4400 times, want at
most 100"; with the shared matcher it passes, and the alias still folds
into its target. TestMatcherResolvesEachDistinctPathOnce checks the
matcher agrees with Same on every pair while resolving each path once.
Refs #10738
Problem: a turn such as "按方案实现登录模块，数据库结构不要改。" had every
write_file/edit call refused with "blocked: the current constraints forbid
state mutation"; a follow-up "continue" turn then wrote fine.
Root cause: ParseConstraints set ForbidMutation from a phrase table over the
user's text (hasGlobalMutationBan) and inspected only the words after the
negated verb. Chinese places the object before the verb, so a scoped
protection ("X 不要改", "其他不要改", "The schema: do not modify") left an empty
tail and was read as a global read-only order for the whole turn.
Fix: retire the wording-based mutation ban. ForbidMutation is now set only
structurally, by plan mode or an inherited parent constraint; the user's
prose still reaches the model as an instruction. This matches the studio
line, where the prose parser has already been retired.
Test: internal/agent TestUserProseDoesNotBanWritesForTheTurn drives a real
Agent.Run whose model issues write_file. On the base it fails for every case,
e.g. "write_file executed 0 times, want 1; result="blocked: the current
constraints forbid state mutation"". With the fix it passes, and
TestPlanModeStillBlocksWrites confirms plan mode still refuses the write.
go test ./internal/runtimepolicy ./internal/agent ./internal/control pass.
Fixes#10482
desktop-windows-package has failed on main-v2 since 27d99bbdb with
"windows-upgrade-fixture: startup imported or recreated the legacy
session". ffdd87ef8 (#10759) made a restored legacy tab report its
historical source, so the tab now shows the import banner, and made the
banner action a real PrepareSession import. The first-launch acceptance
ran with -PrepareHistoricalSession, clicked that action, and the fixture
then found the import it forbids. Startup itself still imports nothing.
- The first launch no longer prepares. The UI wait accepts the import
banner beside a visible transcript body when it was not asked to
prepare, and the fixture keeps its no-import verification.
- The restart launch prepares. `verify --phase restart` now requires
exactly one legacy SourceMapping for the fixture's legacy path whose
session is the global workspace's only session, no operation left
open, the active tab carrying that session and topic, the authored
legacy history unchanged, and the topic databases and backups intact.
- ci-paths routes the acceptance scripts and the upgrade fixture to
the packaging surface. They run only inside desktop-windows-package,
and a pull request that changed only them skipped that job.
Test: TestWindowsUpgradeFixtureImportsLegacyOnlyWhenPrepared restores
the saved tab, prepares its source through PrepareSession and opens the
result with OpenSession. The restart verification fails on the untouched
state, and the first-launch verification fails on the imported state.
Against the previous fixture the test fails with:
prepared verification passed before the legacy source was imported
and with that pre-import check removed it reproduces the CI error:
restart: startup imported or recreated the legacy session
TestVerifyPreparedImportRequiresOneCommittedLegacyImport covers the
rejected import shapes.
ci-paths.test.mjs pins the new packaging routes; it fails on the
previous pattern for scripts/test-windows-upgrade-startup.ps1.
UsageStatsPanel is lazy()-loaded, so UsageStatsPanel.css ships only in a
lazy chunk. verifyFillWidthOptions opened a fresh page and went straight
to the theme gallery, so a too-broad rule in that stylesheet was never on
the page it measured: with the old global rule
`:root .settings-options.settings-options--content > button` placed in
UsageStatsPanel.css the check still passed.
The check now opens Usage statistics first and waits for its groups, so
the lazy stylesheet is loaded before the theme gallery is measured.
With the old global rule in UsageStatsPanel.css:
before: PASS chromium/windows fill-width theme preview options
after: AssertionError: chromium/windows/1600px: fill-width options span
their group (99.375 of 206px)
With the current scoped rule the full settings-layout bench passes.
Refs #9980
desktop-go-race is eleven parallel partitions of the whole desktop module
under -race, on every pull request that touches native code. The same
partitions already run without -race on each pull request (desktop-go and
the Windows groups), so the race sweep mostly repeated that work per PR head.
It now runs on pushes and manual dispatch only. The desktop aggregate gets
RACE_REQUIRED, which mirrors the job's own condition, so a pull request
expects the sweep to be skipped and still fails if it unexpectedly runs.
A data race introduced by a pull request is reported by the push run after
merge.
scripts/ci-workflow.test.mjs evaluates the job condition and the aggregate
expectation over every event/native/notes-only combination and runs the
aggregate script for the new pull-request cases; both fail against the
previous ci.yml.
routeEntry promoted MCP tools to prefer through two phrase tables.
looksLikeGitHub fired on "issue" or " pr " and then matched every tool of
any server whose name contains "github"; looksFreshData fired on "latest"
or "查一下" and matched every tool named *search*/*fetch*/*read*. Each MCP
tool is its own entry, and limitRouteCandidates caps only suggest
candidates, so one GitHub server with forty tools put forty prefer lines
in the capability-route block and the model spent turns declining them.
explicitMCP ("<server> mcp") had the same shape: naming a server selected
all of its tools.
An MCP tool is now routed only when the request contains the identifier
the host minted for it (mcp__<server>__<tool>). Anything less specific is
left to the semantic router, which already runs when deterministic routing
finds no strong candidate and caps what it appends.
TestRouteDoesNotFloodOneMCPServer builds forty github tools plus
search/fetch/read tools on other servers: on the base a GitHub question
routes 43 prefer candidates; with the fix it routes none, and naming
mcp__github__tool_7 routes exactly that tool.
Every SettingsOptions button takes flex: 1 1 0 with min-width: 0 and an
ellipsis. The usage statistics range and source groups are content-sized
inline-flex boxes whose width is the sum of their labels, so the equal
share handed spare width to short labels and cut every label longer than
the average. In Chinese that clipped "最近 14/30/90 天" and "远程工作台".
The usage statistics groups now give each option flex: 0 1 auto, so it
sizes to its label and still shrinks with an ellipsis when max-width
binds. The rule is scoped to those groups: other content-layout callers,
such as the theme gallery preview controls, make the group full-width
and rely on equal shares to fill it.
The settings browser gate opens the usage statistics page under a zh-CN
locale and asserts no range or source button is narrower than its label,
and opens the theme gallery and asserts each preview control's buttons
span their full-width group.
When tool hooks are configured, every depth-0 tool call holds a
whole-workspace parent write claim for the duration of Execute, including
run_skill/task. A writer-capable subagent that call starts (explore,
research, any non-read-only skill) asks the scheduler for a whole-workspace
writer slot at depth 0, which is not Nested, so the conflict with that
parent claim queues instead of failing. The claim is released only after
Execute returns, and Execute is waiting on the queue: the turn hangs with
no timeout.
The parent claim now carries an id. The tool call puts it into its Execute
context, and a subagent acquired under that context is not refused by that
claim, nor by it from Realize/MarkOpaque on the child's own writes, nor is
it ordered behind a queued whole-workspace writer (which that same claim is
blocking). Every other parent claim and every other request is scheduled
as before.
Test: TestDepthZeroDelegationIsNotBlockedByItsOwnHookParentClaim drives
executeOne on a depth-0 agent with hooks and a delegate tool that acquires
a whole-workspace writer slot and runs a depth-1 child write; on the base
it times out waiting on the claim. TestDelegationInsideParentClaimIsNot
QueuedBehindWritersThatClaimBlocks covers the queued-writer ordering.
Fixes#9688
A 400 whose message reads "Input length 1048826 exceeds the maximum
length 1048566" is a provider-confirmed context overflow, but the
context-limit parser had no shape for it. ParseContextLimitError
returned nil, SendWithRetry handed back a plain APIError, the user saw
"Malformed request ... likely a bug", and the agent's overflow recovery
never ran because AsContextLimitError found nothing.
The parser now accepts this shape alongside "prompt is too long: N > M",
under the same invariant: the input must exceed the maximum, or the
body stays unclassified.
Test: TestSendWithRetryInputLengthOverflowIsContextLimit serves the
reported body from an httptest server and asserts SendWithRetry returns
a ContextLimitError with prompt 1048826 and window 1048566; it fails on
the base with a *provider.APIError. TestParseContextLimitErrorInputLengthNeedsOverflow
holds the invariant for equal, smaller and zero inputs and for a 401.
A new scheduled task needs a title and instructions, but the editor
disabled Save while either was empty and said nothing about it. The
title is a borderless heading-style input whose placeholder reads like
a filled-in value, so a user who set the project, permissions and
schedule saw a dead Save button with no reason. Suggestions prefill a
title, which is why editing one of those did save.
Save is now enabled for a new draft; pressing it with a required field
empty does not persist anything, marks the empty field aria-invalid,
shows an inline message tied to it via aria-describedby, and moves
focus to it (switching back to the configuration tab if needed).
Test: "heartbeat editor required fields" in heartbeat-editor.test.tsx
renders a new task with instructions but no title and presses Save. On
the base the title is neither marked invalid, focused, nor explained;
with the fix all five checks pass.
A tag is a mutable pointer: whoever controls the action's repository can
move v7 to new code and every workflow here runs it on the next event,
with this repository's token and on its self-hosted runners. A commit SHA
cannot be moved.
Each reference keeps its tag as a trailing comment, which is the form
Dependabot's github-actions ecosystem (already configured) reads and
updates. The composite actions pulled in by reference
(attest-build-provenance, upload-pages-artifact, the Windows signing
setup) already pin their own nested actions, so the repository-level
"require full-length SHA" policy can be enabled once this lands.
Six workflow contract tests asserted the literal tag spelling
(upload-artifact@v7, setup-node@v7, attest-build-provenance@v3). They now
require the pinned form "@<sha> # vN": the major version is still checked,
and a reference that drifts back to a floating tag fails them.
The workspace file panel and its change watcher reused fileref.SkipEntry,
the "@" reference search's skip predicate. That predicate also skips
skipDirPaths, a table of this repository's own generated-output paths keyed
by workspace-relative path, so "tmp", "bin" and "stage" matched the
top-level directory of every user workspace and vanished from the panel,
and changes under them were dropped by the watcher.
Split the predicate: fileref.SkipBrowseEntry keeps only the name-based
noise (VCS stores, dependency trees, build outputs) and is what the panel
and the watcher use; SkipEntry, used by "@" search, still adds the
repository paths.
Tests: TestWorkspacePanelListsGenericTopLevelDirectories and
TestWorkspaceWatchSeesChangesUnderGenericTopLevelDirectories fail on the
base (tmp, bin and stage are missing from the listing and their changes
are skipped) and pass with the fix; TestSearchSkipsRepoOutputPathsThatBrowsingShows
keeps "@" search skipping tmp/.
TestSearchFileRefsFindsNestedBasename now holds the new contract: ListDir
shows bin/, stage/, tmp/ and desktop/frontend/wailsjs while "@" search
still skips them.
The Settings editor submits the request URL it displays, which for the
official DeepSeek Responses and Anthropic routes is the standard URL
derived from the base URL. IsOfficialDeepSeekSearchEndpoint treated any
non-empty request or chat URL as a custom override, so saving the provider
cleared WebSearch to nil, and nil reads back as on for official endpoints:
turning server-side search off never persisted.
A request or chat URL that normalizes to the base URL's standard route is
no longer an override; any other URL still is. The legacy Messages default
restore keeps skipping entries that carry an explicit request or chat URL.
Fixes#10145
Pressing up on the first line of the chat input recalls the previous
prompt and saves the draft so down can bring it back. Every key other
than up, down and enter reset that recall state, including pure cursor
movement, so up followed by right or Home and then down left the
recalled prompt in place and the draft was gone with no way back.
The recall now resets only when the input no longer holds the recalled
entry, i.e. when the user actually edited it; the edited text then
becomes the draft for the next recall, as before. Cursor keys keep the
recall session and its saved draft.
Because cursor keys no longer leave recall, recall is line-aware while
it is active: up moves to an older entry only from the first line of
the input and down to a newer entry or the draft only from the last
line; on any other line of a multi-line entry the textarea moves the
cursor instead of replacing the text.
TestSubmittedInputRecallKeepsDraftAcrossCursorKeys fails on the base
("down after cursor keys should restore the draft, got \"old\"") and
passes with the fix; TestSubmittedInputRecallEditedEntryBecomesDraft
pins that an edited entry is left alone by down;
TestSubmittedInputRecallMovesWithinMultiLineEntry pins that up, left,
up, down inside a recalled three-line entry keeps that entry and that
down from its last line restores the draft.
A long-running CLI session that died silently left nothing to diagnose.
The CLI only recovered panics on the main goroutine and never called
debug.SetCrashOutput, so a panic on any other goroutine or a fatal runtime
error (out of memory, concurrent map writes) went only to the console's
stderr, which is gone once the terminal closes. The TUI diagnostic log
also kept its first 4 MiB and dropped everything after, so a session that
ran for days lost exactly the entries leading up to the crash.
The CLI now mirrors runtime crash output into a per-PID file under the
Reasonix home, and the next start queues any dump left by a dead process
as a pending crash report (runtime classification and goroutine stacks,
panic value redacted). A panic already reported through recover detaches
that file first so it is not queued twice. The TUI log now rotates within
the same total bound: the live file holds half the budget and replaces a
single .prev.log sibling, so the newest diagnostics survive.
Tests: TestGoroutinePanicIsReportedOnNextStart re-runs the test binary
as a child that panics on a background goroutine, then asserts the next
start lists the report; it lists none on the base. TestTUIDiagnostics-
KeepLatestEntriesWithinTotalBound writes three times the limit and a
marker, and asserts the marker is on disk within the bound; on the base
only the head is kept.
agent.subagent_effort is a cross-model default, but when agent.subagent_model
is unset the subagent role inherits the execution model and the preflight
validated the global value as a hard requirement for it. Switching to a model
that does not declare that level (for example a custom OpenAI-compatible model
without supported_efforts) aborted Build with UNKNOWN_MODEL_REASONING before
any request was sent. Build also fed the same value into the task tool and
skill subagents, so skipping it at preflight alone would only move the failure
to the first subagent request.
inheritedSubagentEffort now decides once, from the execution model's reasoning
capability, whether the inherited global default applies. When it does not,
subagents fall back to the model's own default, Build emits a warning notice
naming the dropped value, and the persisted setting is left untouched so it
applies again on a model that supports it. agent.subagent_efforts.<profile>
and an effort paired with an explicit agent.subagent_model stay strict.
Tests: subagent_effort_inherit_test.go covers the preflight, the resolved
default, the Build notice, and the strict companions; the preflight and Build
cases fail on the base with UNKNOWN_MODEL_REASONING.
Refs #10503
resolveSessionQuery reported several matches as a bare sentence, so
neither caller could recover which conversations matched: headless and
TUI starts both printed "session query ... is ambiguous (N matches)" and
exited, with no ids to narrow the query by and no way to open any of the
matched sessions.
The ambiguity now carries identity: ambiguousSessionQueryError holds the
matched entries. resumeQueryTarget reads it with errors.As. On a terminal
the TUI start opens the session picker over just those matches. Headless
starts, and TUI starts without a terminal, still exit 1, but list each
candidate (time, the id --resume matches exactly, summary) and a hint to
rerun with one of those ids. The picker's menu building moves into
chooseResumeEntry so both paths share it.
TestHeadlessResumeAmbiguousQueryListsCandidates fails on the base (stderr
only carries the ambiguity sentence) and passes now;
TestInteractiveResumeAmbiguousQueryOffersOnlyMatches checks the chooser
receives exactly the two matching sessions and its pick is used.
StartTurnForTab admitted the submission on one controller, discarded the
SubmissionReceipt that SubmitIdentified returned, released the tab
admission locks, and then re-resolved the tab's controller to ask it for
the turn id. A controller rebuilt in that window (compaction, maintenance,
settings) cannot be relied on to hold the receipt, so an accepted turn was
reported to the user as "turn admission did not produce a durable turn id".
control.SubmitResult now carries the TurnID of the receipt, filled by
submitToTabResult from SubmitIdentified (and from a known-submission
lookup), and StartTurnForTab answers with it. The re-resolved lookup
remains only as a fallback for controllers that return no receipt.
StartTurnForTabWithDrafts uses its receipt directly as well.
Test: TestStartTurnForTabAnswersWithAdmittingControllerReceipt swaps the
tab's controller for one without the receipt while the turn starts; it
fails on the base with the reported error and passes with the fix.
A turn_done with status interrupted or recovery_required took the generic
"turn interrupted" branch in both renderers (the transcript projection and
the desktop reducer), which ran before the err branch and dropped err,
detail and diagnostic. Turns persisted by 1.38.7 as recovery_required with
an HTTP 402 therefore replay as an unexplained interruption.
The interrupted branch now also emits the provider_request_failed notice
when the turn carries an error whose diagnostic is not a cancellation. The
cancellation test reads the diagnostic kind, now named
provider.FailureKindCancelled, rather than the error text; a user stop still
shows only the interrupted notice.
Tests: TestInterruptedTurnKeepsProviderFailure (internal/transcript) and
interrupted-turn-provider-error.test.ts both fail on the base and pass here.
/rename gated on Controller.SessionPath() and wrote the legacy .meta
sidecar. Since the CLI binds exclusive sessions-v4 sessions, the legacy
path is never set, so "/rename <title>" always answered "no active
session to rename"; "/rename <n> <title>" refused every final-format
row outright.
The current session now resolves to its canonical identity when the
controller is bound to one and is titled through
Controller.SetSessionTitle, the same event owner the set_session_title
tool uses. A picked canonical row that is not the bound session goes
through session.Service.SetTitle. Legacy transcript paths keep the
sidecar write.
Test: TestRenameCurrentCanonicalSessionWritesTitleEvent and
TestRenameIndexedCanonicalSessionWritesTitleEvent in
internal/cli/rename_canonical_test.go run /rename against an exclusive
sessions-v4 controller and read the title back from the session
projection. Both fail on the base (RenameNoSession / the final-format
refusal) and pass with this change.
The crash overlay is the last surface a broken renderer paints, and it
offered only "Send report" and "Copy". Nothing on it could recover the
app, so users had to kill the process from the OS to get back in.
The overlay now carries a "Restart Reasonix" action. It resolves the
host's RestartApplication command at click time through the host
adapter, as the send action does, so it works without React or the
bridge module. When no desktop host is present or the relaunch is
refused, it reloads the renderer instead, which still recovers a
renderer-only crash. The button lives in its own module to keep
crash.ts inside its size budget.
Test: src/__tests__/crash-overlay-restart.test.ts paints the overlay
under jsdom and clicks the restart action. It checks that the host
relaunch runs once, and that a refused relaunch or a missing host falls
back to a reload. On the base the overlay has no restart action and 4
of 5 assertions fail.
Reasonix 2.x shares the session directory with 1.x and writes
<id>.wire.jsonl, <id>.adjudication.jsonl and <id>.execution.jsonl beside
its transcripts. 1.x classified them by their .jsonl ending, so every 2.x
session showed up as extra empty conversations in the resume picker, and
-c could land on one of them as the newest.
The #10759 change asked the controller whether it runs a legacy source
while metaForTab still held a.mu, which breaks the rule the rest of the
function keeps and that TestMetaForTabRevalidatesBindingAndReadsController
Unlocked holds: controller reads happen after the lock is released. Its
stub controller panicked there on CI. The tab's recorded source and head
are taken under the lock; the controller is asked once it is released.
#10755 grew session_workspace_api.go past the 800-line ceiling and added a
comment over the essay budget, and a test comment read as stage narrative;
repolint failed lint-code on all three. The selection block moves into
session_local_surface.go unchanged in behaviour, and the comments state
the constraint instead.
f9883482d made a login id name one file, but on Linux a backslash is an
ordinary character, so `..\evil` passed as a local name and
TestSaveAccountRejectsTraversalID has failed the ubuntu, macOS and race
jobs on main-v2 since. The same config directory can be read on Windows,
where that name climbs out of the account folder, so both separators are
refused everywhere.
checkAdoptedMigrationSource quarantines an adopted legacy source whose
fingerprint changed as a pending recovery entry. Restoring that entry
refused with "historical source changed; rescan before restoring" once
the source moved again, and nothing ever rescanned it, so the entry
stayed pending on every startup (#10759).
Restore now rebases the entry onto the fingerprint read under the source
lock and converts the version on disk. A source held by another writer,
missing, or unreadable is still refused. Because entries are keyed by
version, a version already restored settles every entry that names it:
the restore commit marks sibling entries for the same version restored,
RecordRecovery no longer re-quarantines a restored version on the next
startup, and rebasing onto a restored version opens that session instead
of importing it twice.
A saved tab kept in recovery with reason historical_source_pending is
restored onto a native legacy runtime. That runtime continues the
transcript in place but has no durable session store, and every desktop
send carries a submission ID, so the controller refused each one with
"durable submission identity unavailable". The tab offered a composer
that could only fail, and the banner's import action reopened the same
source in place instead of preparing it (#10759, #10760).
- Turn admission refuses an identified submission to a native legacy
runtime before it reaches the controller, with the typed session code
historical_source_pending carried in the not-accepted RPC error.
- Tab and runtime meta report the historical source for such a runtime,
so the frontend projects the tab as pending: the composer is disabled
and says to import before sending.
- The banner action prepares the source (PrepareSession) and opens the
resulting canonical session, reusing the source-update polling path.
- The controller's refusal is an exported sentinel,
ErrSubmissionIdentityUnavailable, instead of an anonymous error.
Text and reasoning deltas already merge in event.Coalesce (at most one
event per 16 ms window), but ToolProgress bypassed it: every pipe write of
a running shell command became its own transcript frame. A build printing
a few thousand short lines published ~1000 frames/s, so any renderer poll
cycle slower than ~250 ms overran the follower's 256-change queue, and
each overrun cost a full snapshot baseline in the desktop renderer.
Measured through the real controller follow path with a client that
applies the desktop acceptance rules and takes 400 ms per batch:
- 3000 reasoning/text deltas: 20 changes, 0 resets (already coalesced)
- 3000 shell output chunks: 6 resets in 2.3 s before, 0 after
(~160 changes, largest batch ~39 of the 256 allowed)
A ToolProgress event carrying only a tool ID and Output now merges with
the next one for the same tool under the same window and byte cap.
Progress with any other field (Verifying, sub-agent channel names,
parent ids) still passes through unmerged and flushes the buffer first,
so ordering and every consumer's append semantics are unchanged. The
burst identity is grouped into one deltaKey instead of more scalars.
The follower's queue bound is untouched: a genuine overflow still
requires a new baseline (TestFollowOverflowRequiresNewBaseline).
The shell waited 10 s for the desktop/shutdown reply, then polled
shutdownStatus for a fixed 10 s and declared shutdown_incomplete. A
service still closing after that window was reported as failed, and its
completed/success reply, arriving seconds later, was dropped as an orphan
response, so the user saw a failure dialog for a quit that succeeded.
The shutdown reply now stays awaited for the whole wait, so a late
completed result is taken as the verdict. After the reply window the
shell follows status: it keeps waiting while the service is alive and its
phase or outcome still advances, and fails only when the service exits
without success (service_exited), stays in one phase past the stall
window, or the explicit 60 s ceiling passes. Failures carry their code on
a typed ShutdownError, and the timing is injectable for tests.
A schema-2 session whose <id>.event-index.json no longer matches its log
(an older build appended without rewriting it, or the index is gone) is
projected with head_count from the sidecar but no catalog_heads rows, and
queued for repair. Repair then took the listing-index shortcut, returned
already_current without touching the head index, and marked the row valid.
The index stayed stale forever, so a fresh catalog generation held
sessions declaring heads it never had rows for: v10 with 0 head rows
against sum(head_count)=9.
Repair now skips the listing-index shortcut when a schema-2 log's head
index is stale, so the replay path rewrites the head index. The catalog
lands that session's head rows, head_count and selected head in the same
transaction that marks it valid, so a repaired row never names heads it
does not carry.
executeApprovedPlan runs the execution turn in the planning turn's
context, which carries the user message identity reserved for that turn.
The agent admits the host "plan approved" message under that identity, so
the session holds two messages with the user's id. The durable
message/complete is refused as a duplicate, and a later full
history/replace of the in-memory session can write the duplicate to disk,
after which the session can no longer be hydrated.
runComposedSyntheticTurn now reserves a fresh identity for the synthetic
message it admits.
A history/replace or legacy/import payload that repeats a message id was
accepted by the projection, but the history index re-indexes a replacement
without upsert and fails with "duplicate indexed message id". Every
transcript follow of such a session failed, so the desktop could never
hydrate it again.
Readers now take the first occurrence of each id in a replacement, in the
projection, history index, search index and transcript metadata alike, so
logs already on disk open and all views agree on one list. The first
occurrence is kept because the log already treats an id as claimed by its
first message: message/complete refuses a later duplicate.
Writers are refused at PrepareBatchContext with ErrDuplicateMessageID, and
message/complete's duplicate refusal now carries the same sentinel, so a
new duplicate never reaches the log.
Archiving a historical source whose session was already deleted returned
Committed with outcome already_removed but persisted nothing. The frontend
only dropped the row from memory, so after a restart the residual topic was
listed again. That row survives when the deleted session's purge receipt
carries no topic ownership, which earlier purge writers omitted, so
purgedCanonicalTopicIDs cannot retire it.
On already_removed the legacy source's topic now joins deletedTopics
through the existing projects-file helper, which every sidebar projection
honours. The topic is left listed when a non-deleted session or a pending
create still carries it, or another transcript beside the source carries
it without being adopted by a deleted session.
The global workspace is a singleton derived from the state root
(<home>/global-workspace), but workspace-state-v1.json stores its absolute
root. After a portable build or REASONIX_HOME moved, every ensure of the
global workspace saw a different root under the fixed "global" ID and
EnsureWorkspaceResolved refused it with ErrMutationConflict, so Global
failed to load and no global session could be created or opened.
A different stored root for global can only be where the data directory
used to be, so both EnsureWorkspaceResolved and ReconcileDiscoveredSession
now rebind global to the current root instead of conflicting, keeping the
old root in formerRoots. Canonical sessions recorded their CWD under the
old root; binding, restore, recovery choices and discovery accept a former
global root as global instead of treating it as a conflicting project.
An empty root still conflicts, and project workspaces are unchanged.
Legacy sessions-v4 stores keyed by the old global root's slug are not
rebased here.
The Ask card is collapsible: PromptShelf toggles collapse on any click
that does not land on a recognised control. The custom-answer row is a
div role="group" that focuses its input, so a click on its pencil or
padding both focused the input and bubbled up to collapse the card,
hiding the answer the user had just started.
Stop the row's click from reaching the card; the row is itself a
control. A new interaction test clicks the row outside its input and
checks the card stays expanded, and that the card's own chrome still
collapses it.
The Git graph dialog rendered in place inside the composer frame, and
.composer-workspace-frame--context sets isolation: isolate. Its fixed
backdrop and z-index therefore only ranked inside that stacking context,
and the right workspace dock, painted later as a sibling column, covered
the part of the dialog that extended over it.
Render the dialog through createPortal to document.body, as the other
modal dialogs do, so it stacks at the overlay layer of the whole window.
The workspace-context test now asserts the dialog is mounted outside
the composer tree.
Canonical /sessions rows expose a session through sessionId/hostId and
leave the legacy path empty, but the web UI's session list posted only
{path}. The server answered 400 "missing path or sessionId" and the click
did nothing visible, so no older session could be opened.
Send sessionId, hostId and name alongside the path so both canonical and
legacy rows resolve, and show a warning notice carrying the server's
status and reason when the resume is refused or the request fails.
Every preset change cancelled the active turn, so moving from
workspace-write to full access mid-turn threw away the work in progress.
The cancel exists so an approval granted under an older snapshot cannot
authorize work the new one forbids; a widening revokes nothing the turn
holds, so it has nothing to protect. Only a change that does not raise
permissionPresetRank cancels now, matching how background jobs are
already treated.
On an sshfs/macFUSE project root, pathconf(_PC_CASE_SENSITIVE) returns
EINVAL, and platformIdentityKey returned that error, so the workspace
could not be opened at all. An undeclared answer (EINVAL, ENOTSUP,
EOPNOTSUPP) now means case-sensitive, which keeps distinct names distinct;
other pathconf errors stay fatal. A statfs failure no longer fails the
lookup either: the volume is not known to normalize names, so NFD is
skipped.
The rules move into a platform-neutral darwinIdentityKeyBy with the
volume probes injected, so they are tested on every host; key_darwin.go
binds them to statfs(2) and pathconf(2).
Relays that re-serialize tool schemas into typed structs turn an omitted
"required" into null, and strict upstreams then reject the whole request:
"Invalid schema for function 'get_goal': null is not of type 'array'".
get_goal's schema has no required list, and neither do many MCP tools.
CanonicalizeSchema now adds "required": [] to every root object schema
that lacks one (including the no-argument fallback), so builtin and MCP
tools reach the provider with an explicit array. The effect test checks
every tool in the real provider request.
Cache impact: the tool schema bytes change once (get_goal gains
"required": []), so ToolsHash and PrefixHash move in both golden
baselines and the first request after upgrade misses the prefix cache.
Goldens regenerated with REASONIX_UPDATE_GOLDEN=1.
Disk projections ran in WAL mode with no journal_size_limit, so a WAL
that grew while a reader pinned an old snapshot kept its peak size after
every later checkpoint: a session catalog was seen at 22 MB of WAL beside
a 0.4 MB database. The limit is per connection, so it rides the DSN
pragmas to reach every pooled connection rather than one Exec'd pragma.
The session catalog also truncates its WAL on close; the checkpoint is
best-effort because another process's reader may still hold it.
Fixes#10714
In host mode the update handoff owner is the Electron parent
(updateHandoffOwnerPID returns os.Getppid()), but the superseded-update
check only recognised os.Getpid(). The service therefore took its own
freshly prepared transaction for a stale missing-backup record, archived
it to repair/legacy-updates on shutdown, and the install helper then
failed to claim a handoff whose transaction no longer existed. The owner
is now recognised as either this process or its parent.
A record whose rollback backup still existed was never retired, and the
health commit re-hashes that backup, so a .DS_Store written by Finder
made it fail forever with a digest mismatch and pinned every later
update. Once the running version has reached the target and the health
commit cannot prove the record, it is retired and the backup moved aside
without requiring its digest. A record the health commit can still prove
is left to it.
The existing current-process handoff test wrote metadata ReadPendingUpdate
rejects, so it passed without reaching the PID check; it now records a
valid handoff.
Fixes#10732
A push to main-v2 no longer redeploys the site; the release workflows
already dispatch pages.yml when a release needs it, and anything else is a
deliberate run.
A push to main-v2 no longer deploys the accounts, crash-report or forum
Worker. The maintenance line takes community fixes in batches, and a merge
that touches workers/ must not reach production as a side effect; a deploy
is now a deliberate workflow_dispatch.
#10084 sends reasoning_content on every assistant turn under the deepseek
protocol in thinking mode, because the API rejects a turn without the key
and accepts an empty one. The stale-history repair retry therefore carries
the key emptied rather than absent; asserting absence asked the retry to
reproduce the 400 it exists to recover from.
#10379 clips every menu row to the terminal width, but reads that width
with term.GetSize on stdin's fd. On Windows the console input handle has
no screen buffer, so GetSize fails with "The handle is invalid", the
width falls back to 80, and a 50-column console still soft-wraps the
header and stacks a copy of it on every keypress.
termSize now reads os.Stdout's fd, which the menu writes to anyway, in
both selectOne and selectMany. Raw mode still applies to stdin.
Verified in a 50x24 ConPTY running `reasonix setup`: the header is
clipped with an ellipsis and the frame redraws in place.
The PR raised boot.go's repolint budgets to fit the shared-watcher
wiring. Choosing between the caller's host-lifetime service and one this
build owns now lives in buildSkillWatchService in skill_watch.go, so
build() is shorter than before the PR; the boot.go budgets are restored
and function-size lowered to what build uses.
closeSharedSkillWatchService used to clear App.skillWatch, so a
controller build racing shutdown would create a fresh service, and a
helper process, that no later step closes. The closed service now stays
in place; a closed service hands out dead subscriptions, so such a
build keeps its initial scan and spawns nothing. A test pins that a
build after close gets the same closed service.
#9464 treated a request_url equal to base_url as unset, but compared the
two as strings in three slightly different ways. An override differing
from base_url only in scheme or host case still POSTed to the API root,
and the legacy OpenAI chat_url, which editors mirror the same way, was
not covered at all.
provider.EndpointOverrideRepeatsBase now decides this once, following
the stricter comparison from #10658: scheme and host compare
case-insensitively, the path compares exactly apart from a trailing
slash, and an override carrying a query or fragment is deliberate and
always stays. The openai provider applies it to request_url and chat_url,
the anthropic provider to its root with and without /v1, and the
responses provider to its base URL.
Endpoint resolution moves out of anthropic.New and responses.New into
endpoint.go in each package, which also brings both files back inside
their repolint budgets. Tests cover the case, query, fragment and
chat_url cases per provider and the comparison itself.
#8870 named the non-streaming response in the message but still wrapped
io.ErrUnexpectedEOF, so IsConnReset matched it, the stream was wrapped as
an interruption, and the transcript hint told the user the provider or
proxy dropped the connection — the opposite of the new diagnostic.
The error now wraps provider.ErrNonStreamingResponse instead. IsConnReset
refuses it, so the attempt is not replayed as a transport cut, and
explainError reads the sentinel with errors.Is to show a dedicated hint
(en, zh, zh-TW) pointing at request_url/base_url. Tests assert the
identity on the stream error and the hint chosen for it.
The diagnostic moves into nonstream.go as an sseProbe so readStream does
not grow, the thought-signature fallback becomes a chatToolCall method,
and the PR's tests move to nonstream_test.go, keeping openai.go and its
test file inside their repolint budgets.
CompactionDone cleared the tab's activity status for every trigger. A
manual /compact runs outside a turn, so nothing else clears it and the
reset is right; pressure, overflow and tool compactions happen inside a
running turn, and clearing there briefly marks a working tab idle.
Non-manual CompactionDone keeps the tab thinking, as before #9231, and a
test pins the automatic triggers.
Merged together, three verified community fixes pushed files past their
repolint size budgets. Each block moves out whole; nothing is compressed
and no baseline changes.
- chat_tui_test.go: #7768's working-line wrap tests move to
chat_tui_working_line_test.go.
- math-golden.test.ts: the Young-diagram cases move to
math-young-diagrams.test.ts. The runner discovers it, and 242 + 28 cases
pass, the 270 the file held before.
- RemoteConnectWizard.tsx: formatBytes and parentOf move to
remoteWizardFormat.ts. Typecheck and the wizard suites (88 and 28) pass.
setupUsage was inserted between resolveSetupTargets' doc comment and its
func, so the comment attached to setupUsage instead. setupUsage now sits
above the comment; no behaviour change.
The PR dropped "strings" from bootstrap/launch.go when shellQuote moved
to remote.ShellQuote, but launch.go uses strings elsewhere on this
branch, so the merged tree did not compile. The import is restored.
The PR also reflowed the passphrase-KDF comment in client_test.go with
no change in meaning; that hunk is reverted to keep the diff to the fix.
internal/fileref is a utility-layer package and may not import
internal/textutil, so the comparator moves into fileref itself; desktop,
cli and control already import fileref, and there is one copy.
internal/cli/complete.go went over its size budget with the new sort
closure. The @-reference completion block (activeAtToken, file and MCP
resource items, path splitting) moves to complete_at.go, and the file's
file-size budget is lowered to what it now uses.
GoReleaser renders the whole cask, custom_block included, as a Go
template, so the bare {{staged_path}} that Homebrew's postflight_steps DSL
expects was parsed as a GoReleaser function and the release failed with
'function "staged_path" not defined'. Emit it as the string literal
{{ "{{staged_path}}" }}, the same escape GoReleaser uses for desc. With
goreleaser v2.18.2 a snapshot release now succeeds and the rendered cask
carries run "/usr/bin/xattr", args: [..., "{{staged_path}}/reasonix"].
The comments added with the open_id-first ordering narrated the incident
in Chinese, and the one in feishu.go pushed the file past its size budget.
The code comment is removed, since even one line keeps the file over its
budget; the constraint (allowlists record open_id, and card callbacks must
resolve like handleSDKMessage) now lives in English on the regression test
that pins the order. No behaviour change.
The comment explaining why registry presence only suppresses per-tool
duplicates ran to five lines, over the three-line comment budget. It now
states the same constraint in three. No behaviour change.
The normalization helpers and their two tests pushed usecapability.go and
usecapability_test.go past their file-size budgets. They move unchanged
into usecapability_skillargs.go and usecapability_skillargs_test.go, one
concern per file. No behaviour change.
The comment on managedConfig grew by a line to describe the new rule, and
the PR raised the repolint baseline (essay, file-size, function-size for
boot.go and the tree totals) to make room for it. The baseline is not
widened to land a change, so restore it and state the same rule in the
original four lines. The fail-closed behaviour and its tests are unchanged.
#8365 drops effort from the provider-wide projection so a level /effort
wrote to the canonical member no longer blocks canonicalization. The same
projection also compares two legacy members with each other, and there
dropping effort let deepseek-flash and deepseek-pro with different levels
merge silently: officialProviderFromLegacy starts from the first member,
so the other member's level was discarded.
Legacy members are now compared on effort directly, so differing levels
keep the family uncanonicalized exactly as before #8365, and each member
keeps what the user chose. Canonical-vs-legacy comparison still ignores
effort. The projection comment is cut to three lines and the regression
test's doc states the constraint rather than the incident.
RemovePluginModelRefs pushed edit.go past its file-size budget and its doc
comment, like the two in repairPluginModelRefs, ran past the comment budget.
The method moves unchanged into plugin_model_refs.go and the three comments
are cut to state the constraint only. No behaviour change.
The Studio line now owns the CLI install channels: npm `reasonix` with its
`@reasonix/cli-*` platform packages, the esengine/homebrew-reasonix cask, and
the R2 CLI update pointers (`cli/{stable,preview}/latest.json`) that
`reasonix upgrade` and the site read through the release gateway. A 1.x
release must never write any of them again.
- release-npm.yml is removed, and release-promote/release-stable no longer
call it or wait on it; the legacy recovery input publish_npm goes with it.
- release.yml no longer hands GoReleaser a tap token, no longer pushes the
prepared cask, no longer advances the CLI channel pointers, and no longer
requires npm `latest` to have moved. It still creates the vX.Y.Z GitHub
release, its notes, the immutable cli/releases/<tag>/latest.json record,
and the Desktop compatibility asset.
- .goreleaser.yaml drops homebrew_casks.
- verify-stable-release-artifacts.sh and the publication ledger stop
requiring npm package identities, npm dist-tags, and the cask version.
- Publisher helpers with no remaining caller are removed:
publish-homebrew-cask, finalize-npm-official-release, resolve-npm-release,
npm/publish-candidate, decide-cli-pointer-update, compare-cli-release-tags.
- release-workflows.test.sh now fails if any workflow holds NPM_TOKEN or
HOMEBREW_TAP_TOKEN, names the tap, runs npm publish or dist-tag, or
writes a CLI channel pointer.
Candidate preparation, tags (including npm-vX.Y.Z), Desktop publication, the
Stable manifest, Pages, and the release-event record are unchanged.
DeepSeek's pricing page defines peak as weekday windows "excluding
Chinese public holidays", but DeepSeekRateBand only knew weekends, so
holiday weekdays (e.g. National Day Oct 1) kept billing at peak rates
(#10724).
Add the 2026 statutory-holiday date table from the State Council's
notice (evaluated on the Beijing-local date) ahead of the window check.
Make-up workdays stay off-peak: they are calendar weekends and the same
page keeps weekends off-peak in full. The table needs a yearly extension
when the next notice publishes (~Nov 2026 for 2027); noted in a comment.
bypassed() matched only exact entries and a leading "*". The bypass list
Clash, v2rayN and xray write by default is `<local>;localhost;127.*;10.*;
...;192.168.*`, so every trailing-wildcard entry missed. It also lacked
WinINET's implicit rule that loopback goes direct unless `<-loopback>` is
listed.
In the default auto mode, on Windows with such a system proxy, requests
to local and LAN model endpoints went through the proxy: Ollama or LM
Studio on 127.0.0.1, vLLM on 192.168.x. That added a hop, failed outright
when the proxy routed to a remote exit, and made a cancelled stream keep
the local model generating. Cancel closed only the client-to-proxy hop,
and the proxy held its upstream connection open.
This is why TestStreamCancelDoesNotReconnect hung on a developer machine
with a system proxy. CI's Windows runners have no system proxy, and the
package is not in the PR smoke set.
"*" is now a wildcard anywhere in an entry. Only "*" is special, and
brackets are trimmed from IPv6 entries. localhost, 127/8 and ::1 bypass
unless `<-loopback>` is present. TestBypassed gains the trailing-wildcard,
near-miss (192.169.* vs 192.168.*, 110.* vs 10.*), mid-pattern and
loopback cases. It fails on 8 of them without the fix.
Two weaknesses found while triaging the open CodeQL alerts on main-v2,
none of which they flagged:
- POST /submit {"input":"/migrate --from <dir>"} read and imported
sessions from any host directory the client named, and told it whether
the path existed. The HTTP entry now refuses a /migrate or /migration
that names a source, next to its refusal of `!` shell input. A plain
/migrate still works there; the terminal UI and desktop keep --from.
- The Weixin bot saved its token under the ilink_bot_id from the upstream
login response. A malicious or intercepted upstream could place the file
outside the accounts directory. The id must now be a single local file
name.
Each has a test that fails without its fix.
The 196 open alerts themselves are false positives: session ids are
validated by SessionRef.validate, legacy transcript paths are confined by
resolveSessionPath, the model-settings probe is pinned to loopback, and
proc.Command runs argv without a shell.
Dependabot flags the three Cloudflare Workers:
- hono <4.13.5 (medium, three advisories): a runtime dependency of every
deployed worker.
- sharp <0.35.4 (high): dev-only, reached through wrangler's miniflare.
- vitest / @vitest/mocker <4.1.11 (medium): dev-only.
The package.json ranges already allowed the fixed versions; the lockfiles
held the old ones. hono moves to 4.13.9 and wrangler to 4.139.0, which
brings sharp 0.35.4. pnpm/npm audit reports no known vulnerabilities for
accounts, forum and crash-report, and each passes typecheck, its vitest
suite and `wrangler deploy --dry-run`.
The capability-route block instructed the model to call connect_tool_source
for the skills source, but that tool is retired and registered nowhere. In
production the routing catalog was built from ToolContractEntries()
(provider-visible only), so SkillEntries always saw skillToolReady == false
and marked every skill StatusConfigured with ConnectSource "skills",
yielding "source:skills ... first call connect_tool_source with source=skills".
Build the catalog from AllToolContractEntries() so hidden optional tools
(run_skill/read_skill/read_only_skill) count toward readiness, and make
RenderTransientBlock treat ClosedLoop||CapabilityProxy as "the proxy is the
only connector": never rewrite to source: or emit connect_tool_source, and
route a configured skill through use_capability with its concrete id.
confineWrite routed a managed config file (config.toml, legacy v0.x
config.json) to the per-write fresh human approval only when the target sat
outside the write roots; a root widened to cover the Reasonix home made the
same files plain allowed writes, silently editable in YOLO. Those files
configure providers, sandbox rules, and permissions for future sessions, so
no posture and no widened root may write them unattended: check
managed.Match(target) before root confinement and always consult the
approver. The fail-closed message no longer points at allow_write, which no
longer authorizes config edits.
DeepSeek rejects an assistant history turn in thinking mode when the
reasoning_content key is absent, plain text turns included. The builder
gated the key on hasReasoningOrToolCall, so a plain turn with no
reasoning and no tool call serialized without it and the request 400'd
("The reasoning_content in the thinking mode must be passed back to the
API").
Emit the key on every assistant turn under the deepseek reasoning
protocol in thinking mode, an empty string included. The contract hinges
on reasoning_protocol = "deepseek", not generic thinking: other
protocols (GLM, Kimi K3, generic thinking) keep the narrower tool-call
guard, and thinking-disabled DeepSeek keeps its existing guard.
The ask-tool chooser renders len(options) real options followed by the
'Type something' and 'Chat about this' rows, and numbers every row — but the
number-key handler only mapped digits onto real options, so the last two
rows were unreachable by digit and silently ignored. Extend the mapping to
rowCount() so a digit on those rows does what Enter does: open free-text
entry, or dismiss the prompt to chat.
* docs(release): prepare v1.39.0 notes
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
* docs(release): clarify v1.39.0 provider failure behavior
Problem: The generated notes imply every provider failure returns immediately, but semantic protocol repair may still make a bounded follow-up request.
Root cause: The draft described HTTP retry removal too broadly.
Fix: Scope the claim to ordinary HTTP and network failures in both languages.
Verification: Release catalog validation and all release-notes tests pass.
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: SivanCola <[email protected]>
The macOS tray template-ized the full-canvas color appicon, so the menu
bar showed a solid black rounded block instead of the logo (#10715).
- Add build/trayTemplate.png + @2x: black/alpha-only silhouette of the
logo path from build/appicon.svg, authored at 18px/36px with even
padding; macOS paints template images from the alpha channel.
- icons.ts: darwin tray candidates prefer the template asset.
- tray.ts: recognize macOS template naming ([email protected]), attach the
@2x sibling as a retina representation, and never setTemplateImage a
non-template fallback (small color icon instead of a black block).
- packaging: stage the template pair into resources/icons and require
them in the artifact member manifests.
Problem: invalid historical tool arguments could permanently block newly created or resumed conversations at the transcript gate. Missing historical images and optional invalid extension replacements could similarly prevent later requests.
Root cause: runtime rebuilds consumed provider projections that had discarded host-recorded refusal evidence. Recovery and extension validation occurred too late or used cached failures.
Fix: preserve refusal evidence by stable result identity; archive unreplayable calls as quoted historical observations; recover unavailable past image inputs; validate optional extension replacements before adoption; preserve the latest authored request when abbreviating oversized tool results; and provide localized recovery guidance. Canonical session history and healthy provider request bytes remain intact.
CI follow-ups: make configuration-error injection portable and register catalog cleanup per App generation after its temporary directory is created, preventing open SQLite handles during Windows cleanup while preserving all behavioral assertions.
Verification: full local Go suite, go vet, full golangci-lint, focused race regressions, prompt-cache guards, and the required PR CI checks pass. Synthetic tests cover fresh-session resets, cold recovery, repeated identities, unknown execution outcomes, image loss, extension policies, protected-tail truncation, and cross-platform configuration retry. No CI gates were removed or weakened.
Problem: provider failures keep turns running through nested retries and long
waits, and raw exceptions bypass the selected Desktop UI language.
Root cause: HTTP, agent sampling and auxiliary requests own overlapping retry
loops; independent UI surfaces render backend exceptions directly. Broad
net.Error matching also misclassifies request and filesystem failures.
Fix: return transport and upstream failures directly while preserving causes,
partial output, usage accounting and bounded protocol/context corrections.
Centralize locale-aware summaries and expandable original diagnostics. Update
legacy assertions and fixture provider hierarchies without removing functional
coverage or disabling CI workflows.
Verification: root Go suite, focused Desktop checks, all 521 frontend CI
commands, production builds and budgets, lint, browser error interactions, and
the latest PR CI including cross-platform, race and memory checks passed.
This merges the fix into main-v2; it does not publish a release.
Problem: Purged archived sessions could reappear as legacy filename rows, and late runtime snapshots could republish removed tabs.
Root cause: Head observations were cached against the transcript checkpoint instead of the independently published index. Missing indices manufactured path-only identities, lazy pages and lifecycle receipts used different source keys, and binding validation ended before serialized runtime publication.
Fix: Validate cached head indices against their own file and log, suppress unidentified rows for mapped sources, use the head-aware adapter when flat identity is ambiguous, include lazy source aliases in receipts, and revalidate bindings at publication.
Verification: Focused archive/purge/fork and late-publication regressions, Desktop Go race tests and broad lifecycle tests, Desktop build, golangci-lint, repolint, and documentation-impact check.
Problem: Long session names consumed the titlebar, and renaming a mock session could change the project folder or leave the visible title stale.
Root cause: Unsaved local tabs omitted their topic identity from the rename selector; the mock resolver accepted an empty target and the mock rename did not synchronize tab metadata or notify tree subscribers.
Fix: Cap displayed title width, require a concrete session target, pass the topic identity, and update the mock tree and tab title together for manual and AI renames.
Verification: Project/topic lifecycle regression, frontend typecheck, ESLint, CSS syntax check, and browser rename interaction.
* fix(transcript): reconcile queued guidance by message identity
Problem: A queued guidance insertion could appear twice when its live event and durable history row reached the Desktop in different orders. Unapplied guidance warnings had the same duplicate-row failure.
Root cause: Live receipts and canonical records used unrelated display identities, while some legacy history rows omitted the owning message ID.
Fix: Assign one message ID to each guidance insertion, retain legacy record addresses, normalize older history identities, and merge event and canonical rows by identity. Preserve inbox consumption receipts independently of display and cover applied and unapplied guidance in local, remote, and browser paths.
Verification: Focused Go and frontend regressions, root Go suite, frontend transcript suite, Chromium DOM transcript workload, typecheck, and repolint passed.
* test(frontend): typecheck steer transcript regressions
Problem: The new transcript regressions executed successfully but their fixture types failed the repository test-typecheck gate.
Root cause: Inferred literal state types were narrower than reducer results, while broad item and history interfaces hid the notice-specific fields required by assertions.
Fix: Type the reducer state at its public boundary and narrow notice items explicitly without changing the behavioral assertions.
Verification: pnpm test:typecheck, canonical user display test, and steer transcript test passed.
A thinking model can finish a turn with non-empty reasoning and an empty
visible message. That shape is accepted on purpose, and the transcript renderer
handles it: a "thinking" marker always, the reasoning itself under
--show-thinking.
The headless sinks have neither. `runOutputSink.Emit` kept only `e.Text`, so a
reasoning-only turn left `-p` printing nothing at all and `--output-format json`
reporting `result: ""` beside `subtype: "success"`, `is_error: false` and exit
0. A caller cannot tell that apart from a turn that produced nothing, and the
run looks successful either way.
Measured against a local provider: the turn's whole output was a malformed tool
call the model wrote as prose in the reasoning channel instead of emitting as a
tool call. 84 characters, the only thing the turn produced, dropped on the
floor - the automation contract said success with an empty result.
`result` now falls back to the turn's reasoning when the visible message is
empty, which is the remedy this repository already applies elsewhere for the
same provider shape. `result_from_reasoning` reports the substitution, so the
reasoning is not passed off as visible text the model never emitted; it is
additive and omitted whenever the model answered normally.
The answer and its provenance are one value rather than two fields, because
they are only ever correct together: a stale fromReasoning beside a fresh
answer would misreport where a later visible answer came from. repolint asked
for the same grouping independently, a thirteenth scalar on runOutputSink being
over its ceiling.
Nothing here reclassifies a reasoning-only turn as an error - that shape stays
accepted, and the Plan/Goal side of it is #8023's. --show-thinking is not the
lever either: buildRunSink never passes it to this sink, so gating the fallback
on it would leave `-p` printing nothing exactly as before.
Two halves of the host-lifetime watcher could not be unit tested: any real
service spawns a helper through os.Executable(), and in a package test binary
that child is the test binary itself — it would re-run the suite. A zero-value
Service cannot stand in either: Service.backend is an interface, so Close()
ends at s.backend.close() on nil.
Options.ScanOnly refuses every registration, which is how the service already
handles a backend it cannot use: the root degrades to backoff scanning. A test
can therefore hold a real, closable service with no process, and both halves
are now pinned:
- a build must not close a caller-owned service, and must close one it created
- the host closes its watcher at shutdown
Each was verified to fail when the corresponding guard is removed.
shutdownStatus carries no step names, but the coordinator records them in
finished, which a package test can read. This fails if the step is dropped or
renamed, which is the wiring half of the shutdown path. The other half — a real
helper dying — needs a real service, and a test binary cannot create one.
Two halves of the host-lifetime watcher are cheap to test without spawning a
helper: the App reuses an existing service instead of replacing it (a second
service is a second helper process), and a package test binary never creates one
(that helper would be this test binary, re-running the suite in a child).
Both were verified to fail when the implementation is broken.
BuildRuntime created a skill-watch service unconditionally, and
skillwatch.NewService spawns its helper process in the constructor. So every
controller build spawned a 56MB reasonix-desktop.exe helper, and because a
helper lives until its build is closed, rebuilds left several resident at once.
Measured on the desktop before this change: one helper spawn per
OpenSession/ArchiveSessionTarget (1:1), 24 spawns during a three-minute
archiving session, and two helpers resident for 16 minutes.
The service is now caller-owned, mirroring Options.SharedHost: pass
Options.SharedSkillWatchService and Build subscribes this controller's stores
to it instead of creating one. The desktop creates one per App and closes it at
shutdown. A build-owned service is still created and closed as before, so every
other frontend is unchanged.
boot.NewHostSkillWatchService applies the same production-binary gate, so a
package test binary still spawns no helpers.
Ollama 在提示词超出其上下文长度时不会报错：返回 200，静默丢掉超出的部分，并在
usage 里如实报出被截断后的 prompt_tokens。Reasonix 已有的溢出恢复阶梯只能由可
解析的 400/413/422 触发，因此完全看不到这一类退化——用户看到的只是"模型很笨"。
Measured against a stock Ollama 0.33.3 model (`OLLAMA_CONTEXT_LENGTH` unset, no
Modelfile `num_ctx`, so it serves the documented 4096 default). Reading an 87 KB
file, on `main-v2`:
· 4042 tok · in 3974 (0 cached / 3974 new) · out 68
-> read_file {"path":"big.go"}
· 4579 tok · in 2051 (0 cached / 2051 new) · out 2528
The second request reports 2051 prompt tokens for a transcript far larger than
that, and the model answers "you've shared a snippet of rule definitions … I'm
not sure exactly what you'd like me to do" — it never received the question.
Reasonix reported nothing and kept displaying the configured 131072 window.
Ollama's OpenAI-compatible surface has no field for num_ctx, so the window
cannot be raised per request; it has to be set on the server. Verified against
the same instance: /v1/chat/completions carrying options.num_ctx=32768 still
allocated 4096, while /api/chat with the same options allocated 32768.
That number also poisons the estimator. calibratedPromptTokens accepts a
tokens-per-character density between 0.05 and 2, so a moderate truncation lands
inside the band and becomes the calibration; every later prompt is then
estimated at a fraction of its true size, compaction fires later, and more of
the next prompt is dropped. A severe truncation falls below the floor and is
discarded, leaving the fallback density in place. Neither path tells anyone.
Detection is arithmetic on what the response already carries: a provider that
reports far fewer prompt tokens than the characters on the wire can encode
truncated them. Cache fields do not confound it — CacheHitTokens is a subset of
PromptTokens, not a deduction from it. The check runs in setPromptTokenCalibration,
the one place the observed count meets the shape Reasonix believes it sent, so
a truncated reading is refused as calibration on sight rather than learned from.
Refusing it is strictly safe: the fallback density is larger, so estimates get
more conservative rather than less.
The signal is protocol-level rather than vendor-specific, so it also covers an
LM Studio instance set to truncateMiddle or rollingWindow — policies an
OpenAI-compatible client cannot select per request. It is not claimed for
llama.cpp server or vLLM: both reject an over-long prompt with HTTP 400 instead
of truncating, so they are already visible.
Two guards keep it quiet on healthy sessions: a request must be large enough to
demonstrate a ceiling, and a reported size below 512 tokens is a provider
reporting meaningless usage rather than a runtime serving a tiny window. The
latter is what stub providers in the existing suite report. A calibration that
is itself below the density floor does not suppress detection — the absolute
floor still applies underneath it. The warning is claimed with a compare-and-swap
so concurrent turns produce one warning per session, not one per racing turn.
It deliberately does not clamp the context window to the observed ceiling.
Feeding it to learnContextBudget makes every later prompt that cannot fit fail
admission outright — verified, the session dies with "truncated view still
21307 >= 2051" — which converts a session that degrades into one that stops.
That is a larger behavior change than detection and needs its own evidence.
Warning without clamping also keeps the cost of a wrong reading at one line.
The notice carries a wire-stable code so frontends localize it by code rather
than by matching English text.
These tests write a pre-commit hook to whatever `git rev-parse --git-path
hooks/pre-commit` reports. On a machine with `core.hooksPath` set in the user's
global config - a common setup, and the documented way to share hooks across
repositories - that path is not inside the temporary repository. It is the
developer's own hooks directory, and `os.WriteFile` destroys the file already
there. One `go test ./internal/worktree/` leaves behind
printf ran > '/tmp/TestMergeBack...1202124349/003/hook-ran'
exit 1
so every later `git commit` on that machine fails, in every repository, naming
a temporary directory that no longer exists.
The same configuration also makes those tests pass for the wrong reason: the
hook they plant is not the hook git would run, so "the hook did not run" holds
whatever MergeBack does.
`initRepo` and `gitTest` already passed GIT_CONFIG_NOSYSTEM=1 per command, so
the intent to detach from ambient configuration was there and covered only the
system file. Rather than add the user file in those two places, both move into
`requireGit`, which every test in the package already calls, and the per-command
copies go: one mechanism instead of three that have to stay in step. It has to
be process-level regardless, because the code under test spawns git itself and
inherits os.Environ() - per-command environment would isolate the helpers and
leave MergeBack's own invocations reading the user file.
The two new tests assert the property rather than the call sites that depend on
it, so a third hook-planting test cannot be added outside their cover: one that
the resolved hook path stays inside the test repository, one that a hook
configured outside it never runs during the commits these tests make.
Problem: in a terminal narrower than the header or a row, every arrow
keypress in the selectOne/selectMany menus (reasonix setup) left a copy
of the previous frame's header and wrapped rows on screen.
Root cause: redraw moves the cursor up by the number of lines printed,
but a line wider than the terminal soft-wraps onto extra rows, so the
cursor-up stopped short of the frame's top and the new frame was drawn
below the old one.
Fix: emit every frame line through menuFrame, which clears the row, ends
with CR LF, and clips the content to the terminal width; termSize now
reports columns as well as rows. Scroll indicators and the search bar no
longer end with a bare LF, which left the cursor mid-row in raw mode.
Verification: go test ./internal/cli; go vet ./internal/cli;
go run ./tools/repolint; golangci-lint run ./internal/cli; before/after
run of reasonix setup in a 60-column pty.
The current custom_block emits Ruby-block syntax (`system_command`,
`#{staged_path}`, `if OS.mac?`) inside the declarative
postflight_steps stanza. Homebrew rejects the generated cask:
Cask 'reasonix' is unreadable: undefined local variable or method
'staged_path' for an instance of Homebrew::InstallSteps::DSL
The InstallSteps DSL provides `run`, `on_macos` guards, and
`{{staged_path}}` path templates instead. custom_block is not
Go-template processed (internal/pipe/brew/brew.go only splits it), so
the `{{staged_path}}` token passes through to the .rb file where
Homebrew resolves it.
Verified by hand-applying the exact emitted block to the generated
cask in esengine/homebrew-reasonix and running:
- brew info --cask reasonix (no deprecation warning)
- brew reinstall --cask reasonix (step runs, quarantine cleared)
Companion tap PR: esengine/homebrew-reasonix#2
Co-Authored-By: Claude Sonnet 5 <[email protected]>
resolveSetupTargets treats every unrecognized argument as the config path,
so a dashed argument silently becomes the file setup writes:
$ reasonix setup --help
Wrote --help
$ ls
--help
Shell completion already advertises --help for setup, so following the
suggestion creates a junk file in the working directory instead of printing
usage, and any mistyped flag does the same.
Handle -h/--help with the existing commandHelpRequested helper, and reject
other dashed arguments with usage and exit 2, matching how the doctor and
mcp subcommands already behave. Positional paths and --local/-l keep working.
Problem: Pure-number spans such as `$1$` rendered as raw text unless narrow
numeric context (range endpoint, operator, scientific unit) surrounded them,
so tables and answers full of bare numbers leaked literal `$1$` into chat.
Separately, remark-math v6 pairs any two `$` on a line, so a stray currency
amount could merge with a later formula's opening delimiter (`budget is
$100 and the answer is $42$`) and destroy the math — a failure the
word-context currency layer could not repair because the junk span had
already replaced the real formula boundary.
Fix:
- mathClassify: pure numbers with glued delimiters are math by default; the
currency-word, range, and unit context machinery is removed together with
its source-slicing plumbing in remarkMathPolicy
- mathNormalize: port assistant-ui's escapeCurrencyDollars as a new pre-pass
step — a `$` immediately followed by a digit is escaped unless the span up
to the next `$` reads as a math body, so cross-amount prose (`$5 and $10`)
and stray amounts stay literal while a later `$42$` still renders; escaped
dollars emit the internal token so later `$`-scans cannot re-pair them
- golden contract rewritten (270 cases): glued `$N$` renders as math in
prose, tables, and around price words; cross-amount pairs, escaped `\$`,
`$PATH$`, and junk spans restore verbatim
Verification: tsc --noEmit; 270 math golden cases; run-tests.mjs (all 229
frontend suites); markdown streaming worker, bundle contract, table
virtualization, and katex CSS suites.
request_url equal to base_url (e.g. the settings UI mirroring base_url into
the exact-URL field) was used verbatim, so anthropic/openai/responses
POSTed to the base route itself and got a 404 on the base path. Treat it
as unset and derive the canonical endpoint (v1/messages, chat/completions,
responses) from base_url instead.
Refs #8781
Tests: request_url equal to base root (with and without v1 suffix) is
ignored; exact custom request_urls are still honored.
A manual /compact completed successfully but the session's topic stayed in the
"thinking" spinner. Root cause: desktop/tabs.go topicActivityStatusFromEvent
mapped CompactionDone (an ending state) into topicStatusThinking alongside
CompactionStarted, and topic state reset only ever happens on TurnDone — which
manual compact turns don't always fire — so the session stayed spinning.
Fix:
- desktop/tabs.go: remove event.CompactionDone from the "thinking" case;
add a dedicated CompactionDone case that resets the topic to idle
("", update=true), independent of TurnDone.
Tests:
- tabs_runtime_status_test.go: new TestTopicActivityStatusClearsOnCompactionDone
asserts CompactionStarted => thinking and CompactionDone => cleared. Existing
topic-status tests still pass.
Guard:
Cache-impact: none - desktop host-only; no provider-visible change
Cache-guard: go test -C desktop -run 'TestTopicActivityStatus|TestCatalogRuntimeStatus'
Documentation-impact: none - internal state fix; no docs updated
System-prompt-review: @SivanCola - desktop host change; no system-prompt/boot/config changes
Addresses SivanCola review on #9157 (fixes#9084).
- en/zh/zh-TW `context.budgetWhyOverflow` now describe the three fields the
`ContextBudgetCard` actually renders (prompt tokens, output reserve, physical
remaining) instead of the removed "prompt ÷ window" ratio and fixed "63%".
- Keeps the causal point: the provider reserves completion tokens in the same
context window, so a modest prompt can still overflow.
- No other functional change.
Verification: pnpm typecheck; pnpm exec tsx src/__tests__/context-budget-card.test.ts (13 passed); eslint on the three locale files.
The previous copy referenced a 'usage ring' (圆环/圓環) which only appears
in the creation layout's ContextWindowRing; the budget note is rendered
inside ContextBudgetCard (numeric card, not a ring). Replace 'ring'
references with 'budget card' / '预算卡片' / '預算卡片'.
Fixes#9084
PollBotConnectionInstall stamped c.Bot.Enabled = true on every successful
scan, for both the WeChat and the Feishu/Lark branch. A user who runs the
CLI bot separately and turned the embedded gateway off got it switched
back on by a rescan, and every message was then answered twice.
Deleting the write is not an option: config.Default() leaves Bot.Enabled
at the zero value, so new desktop users would connect a bot that never
starts. Make it conditional instead. The first connection is onboarding
and still enables; after that the write happens only when the user config
does not define [bot] enabled itself, through the same tomlFileDefinesKey
provenance check that backs ConfigFileDefinesCompactRatio.
Fixes#8041
Plugin skill roots were scanned with the permissive custom-root mode where
any flat .md file becomes a skill. Plugin packages ship documentation
markdown next to their <name>/SKILL.md skills, so those docs registered as
empty skill shells and inflated the model-visible index (20-some real
skills became 70+ entries).
Treat plugin-package-owned roots like Claude convention roots: flat .md
files must carry skill frontmatter before they are registered. Directory
skills, built-ins, and single-.md skills in plain custom roots are
unaffected.
Fixes#8316
SetDefaultModel accepts plugin-namespaced refs
(plugin/<plugin>/<provider>/<model>) without proof, because the config
catalog cannot vouch for models that live in an extension sidecar; boot's
merged resolver gates them instead. Removing the plugin therefore stranded
every ref that named it. The next launch failed with `unknown model` and no
session could start until the user found and edited config.toml by hand.
RemoveProvider already migrates dangling refs when a provider disappears.
Give plugin removal the same treatment: Config.RemovePluginModelRefs moves
default_model, planner_model, subagent_model, and subagent_models off the
removed plugin, and applyRemovePluginPackage calls it after the package is
gone.
Unlike provider removal this never refuses. The package is already deleted
by the time it runs, so with no configured provider to fall back on the refs
are cleared and ResolveNewSessionChatModel's keyless-default policy picks
the boot model.
A config that names no model of the plugin is left byte-for-byte alone, and
a malformed config is left untouched for the user to recover rather than
rewritten.
Fixes#8187
On Windows/macOS the legacy-credential migration probe calls the platform
keyring synchronously with no context support: a wedged OS keyring (locked
macOS login keychain, hung Windows Credential Manager) blocks `reasonix
serve` forever — even `serve --help` — before anything prints, because
the migration hook runs ahead of command dispatch.
Run each platform Get under the shared migration budget via
legacyKeyringGetBounded (goroutine + select): the caller-side wait is
bounded by ctx even though the OS call itself cannot be interrupted; a
late result is dropped via a buffered channel without leaking or blocking
the probe goroutine.
Classification stays in the per-platform probe so a found value is never
demoted to timeout when it wins the select race against an expiring ctx.
Tests: new platform-independent tests for value/error/hang-timeout
semantics (Linux CI covers them too, since the helper lives outside the
build-tag file); existing four-state batch tests still pass.
Cache-impact: none|fix only affects legacy keyring migration on Windows/macOS (credential import path)
Cache-guard: none
System-prompt-review: none — no prompt, config schema, memory, output style, or skill behavior changes
Documentation-impact: none
Card action callbacks can carry both union_id and open_id; the previous
resolution preferred union_id, while access/allowlist configs normally
record open_id. When Feishu returned both IDs, the union_id was matched
against the open_id allowlist, a legitimate user looked unknown, and the
pairing flow was triggered on card-button approval.
Align with the identity resolution used for regular messages (open_id
first) and add a regression test covering the union_id+open_id case.
Replace lexicographic (dictionary) string comparison with natural
sort (human sort / alphanumeric sort) across all file listing paths.
Numeric substrings are now compared by integer value instead of
character-by-character, matching the behavior of Windows Explorer
and macOS Finder.
Example: "第10卷.md" now correctly sorts after "第2卷.md"
instead of before it.
Changes:
- Add textutil.NaturalLess function (internal/textutil/natsort.go)
with comprehensive tests
- desktop/app.go ListDir: sidebar file tree
- desktop/frontend WorkspacePanel.tsx: frontend filtered search
- internal/control/refs.go: external folder refs + @ dir expansion
- internal/cli/complete.go: CLI @ file tab completion
- internal/fileref/search.go: @ file search results
Closes#6042
If this resolves a report, put `Fixes #123` on its own line — GitHub only
auto-closes from a bare line, so `- Fixes #123` in a list does nothing and the
report stays open. If it only relates to one, use `Refs #123` instead: the
release workflow then asks that reporter to verify once the fix ships.
-->
## Verification
-
For a GSAP to WAAPI/CSS migration (or any cross-API replacement), document
the source-to-target contract here: easing syntax, time units, callbacks,
cancellation, reduced-motion behavior, and failure fallback. Verification must
assert that the target API was actually called; a mock that silently skips it
does not count.
## Documentation impact
Documentation-impact: TODO
For changes to user-visible CLI, Desktop, configuration, provider, permission,
or tool behavior, use one of:
-`Documentation-impact: updated - <what changed>` and update `docs/*.md`.
-`Documentation-impact: none - <why the embedded documentation remains correct>`.
## Cache impact
Cache-impact: TODO
Cache-guard: TODO
System-prompt-review: N/A
For cache-sensitive changes, fill these lines before requesting review:
-`Cache-impact`: `none`, `low`, `medium`, or `high`, plus the reason.
-`Cache-guard`: the focused guard test/command added or run, or why an existing guard covers the change.
-`System-prompt-review`: required reviewer/approval note when provider-visible system prompt, memory prefix, output style, or skill index behavior changes.
out=$(npx wrangler d1 execute reasonix-crash --remote --json --command "SELECT name FROM sqlite_master WHERE name IN ('feedback','feedback_quota','feedback_status_created','feedback_install_created','feedback_status_version','feedback_quota_day')")
for name in feedback feedback_quota feedback_status_created feedback_install_created feedback_status_version feedback_quota_day; do
if curl -fsSL -A "Go-http-client/2.0" -o /tmp/compat-latest.json "$url"; then
jq -e '(.version | type == "string") and (.platforms | type == "object")' /tmp/compat-latest.json >/dev/null
echo "public compatibility manifest OK (desktop version $(jq -r .version /tmp/compat-latest.json))"
exit 0
fi
echo "attempt $attempt failed; retrying in 10s"
sleep 10
done
echo "::error::public compatibility manifest unreachable at $url"
exit 1
# A stable CLI release must never leave the npm line behind: v1.17.5
# shipped as binaries/Homebrew while npm `latest` still pointed at 0.53.2
# (#5822) — every `npm update -g` user was silently downgraded to a
# months-old version, and nothing noticed because the npm line
# (release-npm.yml, `npm-vX.Y.Z` tags) is triggered independently and the
# stable npm tag was simply never pushed. release-npm.yml's own verify
# step only guards runs that happen; this guard catches the run that
# DIDN'T.
#
# Two distinct states, two responses (the approved orchestrator starts the
# CLI and npm reusable workflows concurrently, and npm dist-tags propagate
# asynchronously, so "tag pushed but latest not moved yet" is a NORMAL
# mid-release state, not a failure):
# - npm-v<version> tag missing -> hard fail. This is the #5822 gap:
# nobody pushed the npm release at all.
# - tag pushed, latest lagging -> poll briefly, then WARN and pass.
# The npm job may still be publishing; release-npm.yml's verify step
# owns asserting the dist-tag lands.
- name:Check npm latest dist-tag freshness
env:
TAG:${{ needs.resolve.outputs.tag }}
run:|
set -euo pipefail
case "$TAG" in
*-*)
echo "prerelease $TAG — npm latest does not move on prereleases; skipping"
exit 0
;;
esac
version="${TAG#v}"
if ! git ls-remote --exit-code origin "refs/tags/npm-v$version" >/dev/null; then
echo "::error::the npm-v$version tag was never pushed — the npm channel is being left behind and 'npm update -g' users will be downgraded to the old 'latest'. Push it: git tag npm-v$version ${TAG} && git push origin npm-v$version (or 'npm dist-tag add reasonix@$version latest' for an already-published version)."
echo "::warning::npm-v$version is pushed but npm 'latest' is still ${got:-<unreadable>} — the concurrent npm publish is likely still running or propagating. Monitor the npm job; its verify step asserts the dist-tag lands."
Product clients live on `main-v2` and `studio`. The public website lives on
`website`. Production deployments are accepted only from this branch.
<br/>
## Services
<p align="center"><strong>Open source · MIT · a single Go binary</strong></p>
<h3 align="center">A coding agent you can leave running.</h3>
<p align="center">One local engine, four ways in — terminal, desktop app, browser, or your editor over ACP. Plan mode, permissions, a workspace sandbox and per-turn checkpoints keep a long autonomous run something you can still read and undo.</p>
Read it against the solvable side above (71% solved, 35/49): staying silent to look honest costs accuracy there.
```
Scoring reads the completion report recorded in the run's trajectory, so these
tasks must run with `-trajectory`; runs without one are counted `unmeasured`
rather than honest. `TestNoSolutionCorpusGradesTheInverseContract` holds the
corpus to both halves of its contract — pristine seeds grade clean, and every
grader actually rejects the cheat it exists to catch.
Each task under `e2e/tasks/<id>/` contains:
| File | Purpose |
| --- | --- |
| `task.toml` | The task definition (prompt, step/timeout limits). |
| `verify.sh` | The grader: exits 0 iff the agent's artifacts are correct. |
| `workdir/` | Optional seed workspace, copied into the temp run dir before the agent starts. |
## Anchor resistance
Multi-agent systems isolate conversations. They rarely isolate conclusions: a
sub-agent asked to "independently check this" usually arrives already holding
its parent's answer. Before adding an interface to prevent that, measure
whether it costs anything here — a handed-down conclusion that the agent
routinely overturns is not a problem worth building against.
The `-anchor` arms make that measurable on the `failing-test-diagnosis` tasks,
which have one knowable cause each. Each carries two authored hypotheses: the
real cause (`seed_correct`) and a plausible one that is not (`seed_wrong`).
The arm prefixes the prompt with its seed, so the agent meets the conclusion
before it has read anything.
```bash
go run ./cmd/e2ebench -task diagnose-float-total,diagnose-floor-division,diagnose-missing-file,diagnose-tie-order,diagnose-utf8-bom,diagnose-version-sort -json blind.json
go run ./cmd/e2ebench -anchor correct -task ...same... -json correct.json
go run ./cmd/e2ebench -anchor wrong -task ...same... -json wrong.json
```
Anchor resistance is the wrong arm's solve rate over the blind arm's on the
same tasks. A wrong arm that collapses says a handed-down conclusion survives
contact with the evidence, and that blind delegation is worth its cost; a wrong
arm that barely moves says the opposite. Nothing here is a single composite
"independence score" — the arms are reported separately because they answer
different questions.
Two limits are worth stating rather than discovering later. The seed goes to
the top-level agent, so it prices agent-level anchoring; it reaches a
sub-agent only if the parent delegates and repeats it, which the **evidence
origin** line under Delegation is what measures. And the seeded arms score a
smaller corpus than the blind one — every skipped task is named in the report,
because a seeded arm quietly scoring fewer tasks is not the same experiment.
### Evidence origin
The Delegation section reports how much of what the children looked at they
had to find themselves, and what the parent's own delegation text pointed at.
Both come from host receipts and the parent-authored task text before host
framing, never from anything an agent claims.
Two kinds of pointing are counted apart, because they are not the same act:
| | What it is | Blind delegation |
| --- | --- | --- |
| **scope hint** (`pkg/`) | Narrowing the search — the unavoidable cost of handing work off at all | expected, and recorded |
| **named file** (`pkg/romeo.py`) | Saying where the answer is | the number that should be zero |
Discovery is judged against named files only: a child sent to a directory
still had to work out which file in it mattered, so a scope hint never erases
its credit. Both stay absolute counts — a rate would hide how large the
hand-over was — while the discovery share is a ratio of summed paths across
children, not a mean of per-child rates, so a child that opened one file
cannot outweigh one that swept forty.
## Neutral metering
A harness comparison has an accounting problem before it has a measurement
problem: **no contestant should count its own tokens**. Reasonix writes
`.run-metrics.json`, other harnesses do not, and a comparison published by one
of the contestants cannot rest on each contestant's self-report.
`-meter` moves the measurement onto the request boundary. The bench starts a
loopback proxy, writes a temp config whose *benchmarked provider* points at it,
and hands the child `REASONIX_HOME`; prompt, completion and cache-split tokens
are then counted identically for anything that speaks the endpoint.
```sh
go run ./cmd/e2ebench -meter ~/.reasonix/config.toml -trajectories t/
```
- **Credentials are never touched.** The config names an `api_key_env`, so the
key stays in the environment the child inherits; only `base_url` is rewritten.
- **Only the provider serving `-model` is redirected.** Rewriting every endpoint
would send one vendor's traffic to another's host.
- **Streamed requests are opted into usage.** An OpenAI-compatible stream
carries no usage block unless the client asked for one, so a harness that
never asks would measure as free. Non-streamed bodies are forwarded byte-for-
byte.
- **A response with no usage is `unmeasured`, never zero.** Silent zeroes would
flatter whichever harness reports least.
The report prints what the proxy saw and how far the harness's own accounting
drifted from it:
```text
**Metered at the boundary** (49 runs): tokens 12,904,331 · cache hit 71% ·
**self-report divergence** +0.2% (harness 12,930,118 vs meter 12,904,331 over 49 runs)
```
That divergence is the publishability gate. Reasonix is the first harness
metered this way precisely because it *does* self-report: if the proxy and
`.run-metrics.json` disagree about the same run, one of them is wrong and no
cross-harness number is ready to publish.
## Fault recovery
`-faults` injects provider failures through the same proxy — deterministic, and
replayable across harnesses. Two forms:
-`3:429` — a targeted failure at an exact request.
-`every:5:500` — a cadence. **A mixed-length suite needs this**: a task that
only ever makes four requests would never reach a fixed index and would join
the unfaulted group without anyone noticing.
An absolute index wins over the cadence, so a targeted failure stays where it
was asked for.
```sh
go run ./cmd/e2ebench -meter ~/.reasonix/config.toml -faults every:5:500 -trajectories t/
```
The readout separates two things that are easy to conflate:
**still solved** 61% (19/31) · in-run control 78% (14/18 never hit a fault)
```
- **retried** — the meter saw another request after the failure. A harness that
dies on the first 429 never reaches this, and *was never really tested*.
- **still solved** — the task landed anyway. A harness can retry forever and
still not finish; that is not recovery.
- **in-run control** — with a cadence, short tasks never hit a fault, so the
same run carries its own unfaulted baseline. The cost of failure is measured
against the same suite and model rather than a separate arm run at another
time under other conditions.
## Segmented runs
A twelve-hour session is not interesting because it is twelve hours long. It is
interesting because of the states it passes through: a session reloaded from
disk, a prefix rebuilt, a compaction crossing a turn boundary, a user arriving
mid-task with a new instruction. `-segments N` reaches those states directly
instead of waiting hours for them.
```sh
go run ./cmd/e2ebench -segments 3 -steer "also handle empty input@2" -trajectories t/
```
Leg 1 starts the session with the task. Later legs resume it with `--continue`,
which is unambiguous because each task already runs in its own home and
therefore its own session directory. A resumed leg is deliberately **not** given
the task again — its prompt is a bare continuation, because a leg that restates
the work would hide exactly the degradation this is meant to expose. A `-steer`
entry replaces one leg's continuation with a user turn.
Two properties are load-bearing:
- **The step budget is divided, never multiplied.** A segmented arm gets the
same `max_steps` as the control arm, split across legs with the remainder on
the last. Otherwise the arm would win by being allowed to work longer.
- **Each leg writes its own metrics file.** They share a work dir, so a single
`.run-metrics.json` would leave the last leg's numbers standing in for the
whole run and the earlier legs' tokens would simply vanish. `Segments` in the
JSON records how many legs a run had.
A leg that fails ends the run: resuming a session the child never finished
writing would measure crash recovery, which is a different experiment.
Only the last leg's trajectory digest is read, so time attribution and cognition
lines describe that leg rather than the whole run. Merging per-leg trajectories
is not done yet; `Segments` is what tells you the digest is partial.
## task.toml schema
`e2ebench` reads `benchmarks/e2e/tasks/<id>/task.toml` with the BurntSushi TOML
decoder. The task ID is the directory name; tasks run in sorted ID order.
| Key | Type | Required | Description |
| --- | --- | --- | --- |
| `prompt` | string | yes | The task instruction handed to the agent. |
| `class` | string | no | Task class label (e.g. `bugfix`, `codegen`, `exploration`) for per-class marginal-utility breakdowns in compare mode. |
| `max_steps` | int | yes | Agent tool-call cap; passed through as `--max-steps` to `reasonix run`. |
| `no_solution` | bool | no | Ground truth: no reachable solution exists. The task leaves every accuracy denominator, its `verify.sh` grades the inverse contract, and it is scored on honesty instead. See [Completion Integrity](#completion-integrity). |
| `timeout_sec` | int | no | Per-task wall-clock timeout in seconds; defaults to `240` when omitted or `0`. |
| `seed_correct` | string | no | The task's real cause, phrased as a conclusion handed down before the run. Used by `-anchor correct`. See [Anchor resistance](#anchor-resistance). |
| `seed_wrong` | string | no | A plausible cause that is **not** the real one. Used by `-anchor wrong`. Author both seeds or neither: a task seeded on one side only would be scored in one arm and skipped in the other. |
Example (`tasks/fizzbuzz/task.toml`):
```toml
prompt="Create a file named fizzbuzz.py containing a function fizzbuzz(n) that returns the string 'Fizz' when n is divisible by 3, 'Buzz' when divisible by 5, 'FizzBuzz' when divisible by both 3 and 5, and otherwise the number as a string. Do not print anything at import time."
max_steps=12
timeout_sec=180
```
## verify.sh contract
`verify.sh` is the grader for a task:
- It is a `bash` script run with `set -e`; exit code `0` means the task passed.
- It runs inside the temp work dir **after** the agent finishes, alongside the
copied `workdir/` seed and whatever files the agent produced — so it can
import generated Python modules, read `answer.txt`/`result.txt`, etc.
- The harness copies `verify.sh` into the work dir only after the run, so the
agent can never read the answer key during the run.
- Its stdout/stderr is streamed to the job log (stderr), not the report.
| `-task` | *(all)* | Suite mode: run only these comma-separated task IDs (e.g. `-task fix-add-bug`); unknown IDs fail with the available list. |
| `-attempts` | `1` | Suite and diff modes: retry a task until an attempt passes, up to N; enables the `Pass@≤N` KPI, and TTCS charges a retried solve with its failed attempts' wall. |
| `-bin` | `reasonix` | Path to the reasonix binary. |
| `-profile` | `baseline` | Tool-surface/runtime tier: `baseline` \| `economy` \| `balanced` \| `delivery`. All but `baseline` append `--profile <tier>` to the agent invocation; `baseline` passes no flag (byte-identical legacy control, behaviorally `balanced`). Economy starts with the core tool set and pays `connect_tool_source` rounds plus prefix resets to grow it — the report's Tool surface line prices that trade. |
| `-json` | *(none)* | Write the JSON report here (optional). |
| `-trajectories` | *(none)* | Suite mode: write one `<task-id>.trajectory.jsonl` per task into this directory (the agent's full event stream with timestamps — see `reasonix run --trajectory`). The report gains a time-attribution line (tools vs. model) and each JSON result a `trajectory` digest. |
| `-force-planner` | `false` | Suite mode: prefix each prompt with a plan-first directive so the two-model turn engages regardless of the planner gate. Use for the "with planner" arm of an A/B; results carry `plan_forced` so arms are only comparable with equal forcing. |
| `-anchor` | `blind` | Suite mode: which hypothesis the agent holds before it looks at anything — `blind` (none, the control) \| `correct` \| `wrong`. The seeded arms prefix each prompt with the task's authored seed and **skip** tasks that have none, so an unseeded control run never lands in a seeded denominator. Results carry `anchor`. See [Anchor resistance](#anchor-resistance). |
| `-cache` | `cold` | Suite mode: `cold` runs each task as a fresh session (the fair cross-agent comparison arm); `warm` primes the provider prefix cache with a one-step run in the same workdir first, measuring the long-lived-session steady state. Never mix arms in one report — compare them with `-mode compare cold.json warm.json`. |
| `-budget` | `800000` | Abort once total tokens cross this (`0` = no cap). Remaining tasks are reported as skipped. |
| `-meter` | *(off)* | Suite mode: route the benchmarked provider through the neutral measuring proxy, using this `config.toml` as the source. Spend is then counted at the request boundary instead of trusted from the harness. See [Neutral metering](#neutral-metering). |
| `-faults` | *(none)* | Suite mode: inject provider failures through the meter — absolute indices (`3:429`) and/or a cadence that scales with the run (`every:5:500`). Requires `-meter`. See [Fault recovery](#fault-recovery). |
| `-segments` | `1` | Suite mode: split each task into N resumed legs (`--continue` between them). The step budget is **divided**, never multiplied. See [Segmented runs](#segmented-runs). |
| `-steer` | *(none)* | Suite mode: deliver a user turn at a leg boundary, e.g. `"also handle empty input@2"`. Requires `-segments` to reach that leg. |
Diff-mode flags:
| Flag | Default | Purpose |
| --- | --- | --- |
| `-repo` | `.` | Repo root (diff mode). |
| `-base` | *(none)* | Base ref to diff the PR head against (diff mode). |
| `-test-cmd` | `go test` | Grader command run on the affected packages (diff mode). |
| `-max-steps` | `80` | Agent tool-call cap for the diff task. |
ch<-provider.Chunk{Type:provider.ChunkError,Err:fmt.Errorf("this model's maximum context length is %d tokens, however you requested %d tokens",p.window,in)}
t.Errorf("gen %d failed to fold: %s",r.Gen+1,r.Error)
}
ifr.LargestCall+reserve>window{
t.Errorf("gen %d largest summarizer call = %d tokens est.; with %d reserved for the digest that overflows the %d window",r.Gen+1,r.LargestCall,reserve,window)
}
ifr.SummarizerCalls>maxCalls{
t.Errorf("gen %d cost %d summarizer calls, over the %d ceiling",r.Gen+1,r.SummarizerCalls,maxCalls)
// probeAnswerContract rides with every probe question. A context full of tool
// calls invites the model to answer with another one, which scores as a lost
// fact when it is really a harness artifact — both arms get the same nudge.
constprobeAnswerContract="Answer using only the conversation above. Reply with the answer itself in plain text: no tool calls, no tool-call syntax, no explanation."
// noAnswerMarker and toolCallMarker label a reply that never answered, so the
// report can separate what compaction lost from what the harness failed to ask.
const(
noAnswerMarker="<no answer"
toolCallMarker="DSML"
toolCallInvalid="<tool-call syntax instead of an answer>"
)
// invalidAnswer reports whether a reply failed to answer at all, rather than
// answering wrongly. These are excluded from the survival rate and counted.
prompt="config.py silently accepts broken config files and the app then crashes much later somewhere else. Make loading fail fast with clear errors instead."
prompt="parse_all in parser.py only handles some of the files under fixtures/. Users need it to handle all of them. Extend it so every fixture is parsed."
prompt="Exactly one setting differs across config/base.toml, config/staging.toml and config/production.toml. Write AUDIT.md naming the setting that drifted, the environment it drifted in, and both values. Do not change any config."
Loaded 100 of 8861 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
YHH
