@asm-agent/coding-agent 0.8.7 → 0.9.0

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## [0.9.0] - 2026-09-03
+
+- Added native callable tools for MCP servers supplied by ACP clients. ([#2002](https://github.com/PrimeIntellect-ai/prime-agent/pull/2002))
+- Fixed `bash()` to capture all foreground command output before finalizing results by using an ordered per-command completion marker; output written after the marker (e.g. by `EXIT` traps or background jobs) is not in the awaited result but stays visible via `handle.output()`/`tail()`.
+Agent messages now use core session admission to choose immediate or queued delivery.
+- Fixed concurrent `execute_bash_and_wait` commands sharing one bash abort controller: each `executeBash` invocation now gets its own controller, so a finishing command no longer clears a still-running command's abort state and `abortBash` cancels every in-flight command.
+- Namespaced kernel host handler results so handler fields cannot overwrite host reply protocol metadata.
+- Render Mermaid code blocks in assistant messages as inline Unicode diagrams, with a "Mermaid diagrams" setting (off/final/streaming, default streaming).
+- Fixed graceful Python kernel disposal so timed-out final snapshots are cancelled before teardown.
+- Reduced kernel memory spikes during namespace snapshots: the payload now pickles straight into the staged file instead of building serialized copies in memory (peak snapshot overhead ~3.9x payload -> ~1x; ENG-5819).
+- Made cross-worker agent lists current without broadcasting duplicate peer rosters.
+- Fixed invalid kernel protocol frames hanging requests by rejecting the affected request and replacing the kernel from its latest state snapshot.
+- Fixed remote agent messages being delivered twice when the daemon request timed out or the response was lost: the message is now sent exactly once per call, and post-send failures surface as errors instead of triggering a resend.
+- Fixed kernel teardown so session cleanup and signal handling share one bounded graceful shutdown path.
+
+## [0.8.8] - 2026-09-03
+
+- Fixed selected Ollama models failing runtime authentication before requests were sent.
+
 ## [0.8.7] - 2026-09-03
 
 - Added automatic Ollama model discovery and selection from the `/model` menu.

package/README.md

@@ -154,7 +154,6 @@ Type `/` in the editor to trigger commands. [Extensions](#extensions) can regist
 | `/new`, `/clear` | Start a new session |
 | `/name <name>` | Set session display name |
 | `/session` | Show session info (file, ID, messages) |
-| `/traces [status\|on\|off\|preview\|upload-current\|upload-all\|login]` | Preview traces, run one-shot current/all uploads, and manage automatic sharing (`upload` aliases `upload-current`) |
 | `/usage` | Show token, cost, and context usage |
 | `/tree` | Jump to any point in the session and continue from there |
 | `/fork` | Create a new session from a previous user message |
@@ -258,7 +257,7 @@ See [docs/settings.md](docs/settings.md) for all options.
 
 ### Update checks
 
-ASM Agent stable builds fetch `https://pub-728493de92a943e2a9b2d17b4719f318.r2.dev/latest.json` to check whether a newer version exists. Beta builds fetch `beta.json` and remain on the beta channel. Override the base URL with `ASM_AGENT_DOWNLOAD_BASE_URL`. Disable version checks with `PI_SKIP_VERSION_CHECK=1`.
+ASM Agent stable builds fetch `https://pub-ca377e94504d4b9cb997babbbc998159.r2.dev/latest.json` to check whether a newer version exists. Beta builds fetch `beta.json` and remain on the beta channel. Override the base URL with `ASM_AGENT_DOWNLOAD_BASE_URL`. Disable version checks with `PI_SKIP_VERSION_CHECK=1`.
 
 Use `--offline` or `PI_OFFLINE=1` to disable startup network operations, including update checks and package update checks.
 
@@ -676,14 +675,10 @@ asm-agent --thinking high "Solve this complex problem"
 | `PI_PACKAGE_DIR` | Override package directory (useful for Nix/Guix where store paths tokenize poorly) |
 | `PI_OFFLINE` | Disable startup network operations, including update checks and package update checks |
 | `PI_SKIP_VERSION_CHECK` | Skip the ASM Agent version update check at startup. This prevents the release manifest request |
-| `ASM_AGENT_TELEMETRY` | Override pseudonymous aggregate usage analytics with `1`/`true`/`yes` or `0`/`false`/`no` |
-| `ASM_AGENT_TELEMETRY_ENDPOINT` | Override the aggregate analytics ingestion endpoint |
 | `DO_NOT_TRACK` | Disable aggregate usage analytics when set to `1`/`true`/`yes` |
 | `ASM_AGENT_DOWNLOAD_BASE_URL` | Override the ASM Agent release manifest and tarball base URL |
 | `PI_CACHE_RETENTION` | Set to `long` for extended prompt cache (Anthropic: 1h, OpenAI: 24h) |
-| `PRIME_API_KEY` | Prime Inference API key; also used for trace sharing if it has `agent_traces` scope |
-| `ASM_AGENT_TRACES_API_KEY` | Prime API key used only for opt-in trace sharing |
-| `ASM_AGENT_TRACES_BASE_URL` | Override the ASM Agent trace upload API base URL |
+| `PRIME_API_KEY` | Prime Inference API key |
 | `ASM_AGENT_KERNEL_PYTHON` | Use an existing Python environment with `asm-agent-runtime` instead of auto-bootstrapping `~/.asm-agent/kernel-venv` |
 | `VISUAL`, `EDITOR` | External editor for Ctrl+G |
 

package/dist/asm-agent-runtime/src/rlm/__init__.py

@@ -57,7 +57,7 @@ def _spawn_handle_from_payload(payload: Any) -> RLMSpawnHandle:
 def _parse_host_reply(request_type: str, reply: dict[str, Any]) -> dict[str, Any]:
     status = reply.get("status")
     if status == "ok":
-        return {k: v for k, v in reply.items() if k != "status"}
+        return reply["result"]
     if status == "error":
         raise RuntimeError(str(reply.get("error") or f"host request {request_type} failed"))
     raise RuntimeError(f"host request {request_type} returned unexpected status: {status!r}")

package/dist/asm-agent-runtime/src/rlm/bash.py

@@ -6,6 +6,7 @@ import asyncio
 import atexit
 import json
 import os
+import secrets
 import selectors
 import shutil
 import signal
@@ -36,6 +37,9 @@ _READ_CHUNK = 65536
 # Fixed child-side fd for the status channel; POSIX shells (notably dash) only
 # guarantee single-digit fds in redirection syntax.
 _STATUS_FD = 9
+_OUTPUT_FD = 8
+_COMPLETION_PREFIX = b"\x1easm-agent-complete:"
+_COMPLETION_SUFFIX = b"\x1f"
 # Cancelled one-shot awaits: TERM grace before the group KILL, then the bounded
 # wait for a confirmed group exit before CancelledError propagates.
 _CANCEL_TERM_GRACE = 0.5
@@ -117,6 +121,10 @@ class BashHandle:
         self._buffer = _BoundedBuffer()
         self._done = threading.Event()
         self._eof = threading.Event()
+        self._completion_terminal = threading.Event()
+        self._completion_output: str | None = None
+        self._completion_lock = threading.Lock()
+        self._completion_pending = b""
         self._status: int | None = None
         self._status_known = threading.Event()
         self._reaped = False
@@ -134,6 +142,7 @@ class BashHandle:
         # True only while the pump moves a chunk from the pipe into the buffer.
         self._pump_transfer = False
         self._job: int | None = None
+        self._completion_marker: bytes | None = None
         status_write = -1
         if _IS_POSIX:
             # Full-duplex status channel: the child end rides in as stdin (fd 0)
@@ -151,9 +160,19 @@ class BashHandle:
                 os.close(self._status_read)
                 os.close(status_write)
                 raise
-            script = _status_script(_with_prefix(command))
+            completion_token = secrets.token_hex(32)
+            # Halves stop passive echoes; a deliberate forgery freezes only this call while later bytes stay live.
+            token_midpoint = len(completion_token) // 2
+            self._completion_marker = (
+                _COMPLETION_PREFIX + completion_token.encode("ascii") + _COMPLETION_SUFFIX
+            )
+            script = _status_script(
+                _with_prefix(command),
+                completion_token[:token_midpoint],
+                completion_token[token_midpoint:],
+            )
         else:
-            # Windows: the child is created suspended, atomically inside the kill-on-close job.
+            # Windows lacks a foreground-status channel, so its exit drain stays best-effort.
             script = _with_prefix(command)
             self._job = _winjob.create_job()
             if self._job is None:
@@ -304,8 +323,6 @@ class BashHandle:
         stdout = self._proc.stdout
         assert stdout is not None
         if not _IS_POSIX:
-            # Windows: no FIONREAD fence; the drain keeps its quiescence
-            # heuristic (best-effort parity).
             try:
                 while chunk := stdout.read1(_READ_CHUNK):
                     self._buffer.write(chunk)
@@ -314,9 +331,6 @@ class BashHandle:
             stdout.close()
             self._eof.set()
             return
-        # POSIX: select-gate the read and flag the read->commit window, so the
-        # drain fence never sees "pipe empty + buffer quiescent" while a chunk
-        # is in flight between the pipe read and the buffer commit.
         fd = stdout.fileno()
         try:
             with selectors.DefaultSelector() as sel:
@@ -328,17 +342,54 @@ class BashHandle:
                         chunk = os.read(fd, _READ_CHUNK)
                         if not chunk:
                             break
-                        self._buffer.write(chunk)
+                        self._consume_output(chunk)
                     finally:
                         self._pump_transfer = False
         except (OSError, ValueError):
             pass
+        self._abandon_completion()
         try:
             stdout.close()
         except OSError:
             pass
         self._eof.set()
 
+    def _consume_output(self, chunk: bytes) -> None:
+        marker = self._completion_marker
+        assert marker is not None
+        with self._completion_lock:
+            if self._completion_terminal.is_set():
+                self._buffer.write(chunk)
+                return
+            data = self._completion_pending + chunk
+            marker_at = data.find(marker)
+            if marker_at >= 0:
+                self._buffer.write(data[:marker_at])
+                self._completion_pending = b""
+                self._completion_output = self._buffer.text()
+                self._completion_terminal.set()
+                self._buffer.write(data[marker_at + len(marker) :])
+                return
+            retained = 0
+            for size in range(min(len(data), len(marker) - 1), 0, -1):
+                if data.endswith(marker[:size]):
+                    retained = size
+                    break
+            self._buffer.write(data[:-retained] if retained else data)
+            self._completion_pending = data[-retained:] if retained else b""
+
+    def _abandon_completion(self) -> None:
+        with self._completion_lock:
+            if self._completion_terminal.is_set():
+                return
+            self._buffer.write(self._completion_pending)
+            self._completion_pending = b""
+            self._completion_terminal.set()
+
+    def _wait_for_completion(self) -> str | None:
+        self._completion_terminal.wait()
+        return self._completion_output
+
     def _report(self) -> None:
         # Finalize at foreground completion (status channel), not EOF, so
         # `cmd &` does not hang the await; the shell then `wait`s for its
@@ -355,8 +406,10 @@ class BashHandle:
             # (parsed status, EOF, garbage, exception) must set it.
             self._status_known.set()
         if status is not None:
-            self._drain_grace()
-            self._finalize(status)
+            output = self._wait_for_completion()
+            if output is None:
+                self._drain_grace()
+            self._finalize(status, output)
 
     def _watch(self) -> None:
         # Observe shell death independently of the status socket: an early
@@ -377,6 +430,7 @@ class BashHandle:
         with self._callback_lock:
             delivered = self._status
         if delivered is None and not self._done.is_set():
+            self._abandon_completion()
             self._drain_grace()
             self._finalize(exit_code)
         with self._kill_lock:
@@ -439,10 +493,7 @@ class BashHandle:
             os.close(self._wake_read)
 
     def _drain_grace(self) -> None:
-        # Bounded wait so the result includes foreground output still in the pipe:
-        # EOF arrives immediately without background jobs, otherwise stop once the
-        # buffer is quiescent for one tick AND the pipe holds no unread bytes (a
-        # slow pump must not lose output the shell wrote before its status).
+        # Best-effort fallback when process exit/EOF arrives without a sentinel.
         deadline = time.monotonic() + 0.5
         size = self._buffer.size()
         while time.monotonic() < deadline:
@@ -472,13 +523,13 @@ class BashHandle:
             return False
         return pending > 0
 
-    def _finalize(self, exit_code: int) -> None:
+    def _finalize(self, exit_code: int, output: str | None = None) -> None:
         with self._callback_lock:
             if self._done.is_set():
                 return
             self._result = BashResult(
                 exit_code=exit_code,
-                output=self._buffer.text(),
+                output=self._buffer.text() if output is None else output,
                 duration=time.monotonic() - self._started,
             )
             self._done.set()
@@ -641,6 +692,9 @@ def bash(command: str) -> BashHandle:
     POSIX; a kill-on-close job object on Windows entered while the child is
     still suspended, so no descendant can escape it and kill()/crash cleanup
     are unconditional -- bash() raises if containment cannot be established.
+    Output written after the completion fence (e.g. by an EXIT trap or a
+    background job) is not in BashResult.output but stays visible via
+    handle.output()/tail().
     """
     if not isinstance(command, str) or not command:
         raise TypeError("command must be a non-empty str")
@@ -674,26 +728,35 @@ def _with_prefix(command: str) -> str:
     return f"{prefix}\n{command}" if prefix else command
 
 
-def _status_script(command: str) -> str:
-    # The status socket arrives as stdin (fd 0); the prologue dups it to the
-    # single-digit _STATUS_FD (dash rejects multi-digit fds in redirections at
-    # parse time) and points stdin at /dev/null, so no other copy remains. The
-    # gate read blocks until the parent has journaled the pid; EOF (parent died
-    # first) exits without running the command. The brace group runs the command
-    # with the status fd closed so `&` children do not inherit it; the trailing
-    # `wait` keeps the shell alive as group leader until its own jobs exit
-    # (double-forked daemons stay out of scope).
+def _fence_printf() -> str:
+    # `\command -p printf` defeats alias expansion but not a user-defined shell
+    # function named `command`, which would swallow both fence frames and leave
+    # the await hanging until the shell dies (wedged behind background jobs). A
+    # slash-qualified command name bypasses function and alias lookup for
+    # ordinary command names, so resolve printf on the system default utility PATH.
+    path = shutil.which("printf", path=os.confstr("CS_PATH") or os.defpath)
+    if path and "'" not in path:
+        return f"'{path}'"
+    return "\\command -p printf"
+
+
+def _status_script(command: str, completion_a: str, completion_b: str) -> str:
+    # Closed control fds preserve background behavior; supported shells atomically write the frame.
+    emit = _fence_printf()
     return (
-        f"exec {_STATUS_FD}>&0 0</dev/null\n"
+        f"exec {_STATUS_FD}>&0 {_OUTPUT_FD}>&1 0</dev/null\n"
         f"read -r _asm_agent_gate <&{_STATUS_FD} || exit 127\n"
         "{\n"
         f"{command}\n"
-        f"}} {_STATUS_FD}>&-\n"
-        "__prime_status=$?\n"
-        f"printf '%s\\n' \"$__prime_status\" >&{_STATUS_FD}\n"
-        f"exec {_STATUS_FD}>&-\n"
+        f"}} {_OUTPUT_FD}>&- {_STATUS_FD}>&-\n"
+        "__asm_status=$?\n"
+        "\\set +x\n"
+        f"{emit} '\\036asm-agent-complete:%s%s\\037' "
+        f"'{completion_a}' '{completion_b}' >&{_OUTPUT_FD} || exit \"$__asm_status\"\n"
+        f"{emit} '%s\\n' \"$__asm_status\" >&{_STATUS_FD}\n"
+        f"exec {_OUTPUT_FD}>&- {_STATUS_FD}>&-\n"
         "wait\n"
-        'exit "$__prime_status"\n'
+        'exit "$__asm_status"\n'
     )
 
 

package/dist/asm-agent-runtime/src/rlm/repl.md

@@ -3,7 +3,7 @@
 `python -m rlm.repl` starts a CPython REPL runtime that executes code cells in
 one persistent `__main__` namespace on a single asyncio event loop. The wire
 format is newline-delimited JSON: one object per line, UTF-8, no other framing.
-The current protocol version is `2`; the runtime announces it in the `ready`
+The current protocol version is `3`; the runtime announces it in the `ready`
 event.
 
 ## Channels
@@ -29,7 +29,7 @@ event.
 |---|---|
 | `execute` | `{"type":"execute","id":str,"code":str}` |
 | `interrupt` | `{"type":"interrupt","id"?:str}` — no reply |
-| `host_reply` | `{"type":"host_reply","id":str,"data":{...}}` — no reply |
+| `host_reply` | `{"type":"host_reply","id":str,"data":{"status":"ok","result":{...}}}` or an error envelope — no reply |
 | `snapshot` | `{"type":"snapshot","id":str,"path":str,"manifest_path":str,"max_bytes"?:int,"max_variable_bytes"?:int,"prune_oversized"?:bool}` |
 | `restore` | `{"type":"restore","id":str,"path":str}` |
 | `list_names` | `{"type":"list_names","id":str}` |
@@ -42,7 +42,7 @@ runtime keeps serving. Closing stdin is equivalent to `shutdown`.
 
 ## Events
 
-- `{"event":"ready","protocol":2,"python":"3.13.11"}` — sent once at startup;
+- `{"event":"ready","protocol":3,"python":"3.13.11"}` — sent once at startup;
   the handshake. No banner precedes it.
 - `{"event":"stdout"|"stderr","id":str|null,"text":str}` — captured output.
   `id` is the cell whose Python execution context performed the write; asyncio

package/dist/asm-agent-runtime/src/rlm/repl.py

@@ -31,7 +31,7 @@ from typing import Any
 
 from .bash import _kill_live_handles
 
-PROTOCOL_VERSION = 2
+PROTOCOL_VERSION = 3
 
 DEFAULT_SNAPSHOT_MAX_BYTES = 256 * 1024 * 1024
 DEFAULT_SNAPSHOT_MAX_VARIABLE_BYTES = 16 * 1024 * 1024
@@ -607,20 +607,19 @@ class _SnapshotSizeLimitExceeded(Exception):
     pass
 
 
-class _SnapshotBuffer:
-    def __init__(self, limit: int) -> None:
-        import io
-
-        self._buf = io.BytesIO()
+class _CappedWriter:
+    def __init__(self, sink: Any, limit: int) -> None:
+        self._sink = sink
         self._limit = limit
+        self.written = 0
 
-    def write(self, chunk: bytes) -> int:
-        if self._buf.tell() + len(chunk) > self._limit:
+    def write(self, chunk: Any) -> int:
+        size = len(chunk)
+        if self.written + size > self._limit:
             raise _SnapshotSizeLimitExceeded()
-        return self._buf.write(chunk)
-
-    def getvalue(self) -> bytes:
-        return self._buf.getvalue()
+        self._sink.write(chunk)
+        self.written += size
+        return size
 
 
 def _snapshot_state(
@@ -655,9 +654,9 @@ def _snapshot_state(
             continue
         remaining = max_bytes - total
         limit = max_variable_bytes if prune_oversized else min(max_variable_bytes, remaining)
-        buffer = _SnapshotBuffer(limit)
+        buffer = io.BytesIO()
         try:
-            dill.dump(value, buffer)
+            dill.dump(value, _CappedWriter(buffer, limit))
             blob = buffer.getvalue()
         except _SnapshotSizeLimitExceeded:
             if not prune_oversized and remaining < max_variable_bytes:
@@ -706,39 +705,41 @@ def _snapshot_state(
     previous = None
     try:
         try:
-            def serialize(candidate: dict[str, bytes]) -> bytes | None:
-                buffer = _SnapshotBuffer(max_bytes)
-                try:
-                    dill.dump(candidate, buffer)
-                except _SnapshotSizeLimitExceeded:
-                    return None
-                return buffer.getvalue()
-
-            serialized_payload = serialize(payload)
-            if serialized_payload is None:
-                items = list(payload.items())
-                serialized_payload = serialize({})
-                if serialized_payload is None:
-                    return {"error": "write failed: snapshot exceeds aggregate snapshot size cap"}
-                # Keep the largest insertion-order prefix whose complete pickle fits.
-                # Prefix pickle size is monotonic because each prefix only adds a string key and bytes value.
-                low, high = 0, len(items) - 1
-                while low < high:
-                    mid = (low + high + 1) // 2
-                    candidate = serialize(dict(items[:mid]))
-                    if candidate is None:
-                        high = mid - 1
-                    else:
-                        low = mid
-                        serialized_payload = candidate
-                for name, _ in items[low:]:
-                    skipped.append({"name": name, "reason": "exceeds aggregate snapshot size cap"})
-                payload = dict(items[:low])
-
             fh, tmp = stage_temp(path, "wb")
             with fh:
-                fh.write(serialized_payload)
-            bytes_written = len(serialized_payload)
+                def dump_to_temp(candidate: dict[str, bytes]) -> int | None:
+                    writer = _CappedWriter(fh, max_bytes)
+                    try:
+                        dill.dump(candidate, writer)
+                    except _SnapshotSizeLimitExceeded:
+                        return None
+                    return writer.written
+
+                def redump_to_temp(candidate: dict[str, bytes]) -> int | None:
+                    fh.seek(0)
+                    fh.truncate()
+                    return dump_to_temp(candidate)
+
+                bytes_written = dump_to_temp(payload)
+                if bytes_written is None:
+                    # Prefix pickle size is monotonic because each prefix only adds a string key and bytes value.
+                    items = list(payload.items())
+                    if redump_to_temp({}) is None:
+                        return {"error": "write failed: snapshot exceeds aggregate snapshot size cap"}
+                    low, high = 0, len(items) - 1
+                    while low < high:
+                        mid = (low + high + 1) // 2
+                        if redump_to_temp(dict(items[:mid])) is None:
+                            high = mid - 1
+                        else:
+                            low = mid
+                    for name, _ in items[low:]:
+                        skipped.append({"name": name, "reason": "exceeds aggregate snapshot size cap"})
+                    payload = dict(items[:low])
+                    # The search's last attempt may have overflowed the temp; rewrite the chosen prefix.
+                    bytes_written = redump_to_temp(payload)
+                    if bytes_written is None:
+                        return {"error": "write failed: snapshot exceeds aggregate snapshot size cap"}
             saved = sorted(payload.keys())
             pruned = sorted(name for name in oversized if name in ns) if prune_oversized else []
             manifest = {