@kodax-ai/kodax 0.7.85 → 0.7.86

package/CHANGELOG.md

@@ -6,7 +6,99 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
-No changes yet.
+---
+
+## [0.7.86] - 2026-08-14
+
+> Git tag and GitHub Release are created by the release workflow. npm
+> publication remains a separate manual operator step.
+
+### Fixed
+
+- Windows sandbox doctor and required Shell calls now surface actionable ACL
+  crash-recovery guidance for legacy or corrupt owner markers instead of a
+  generic unavailable result. Sandbox setup is serialized with owner admission
+  and cannot mutate account, guard, or WFP state while any sandbox owner or
+  unresolved poison marker exists for the shared Windows sandbox account. New owner markers
+  remain readable by older runtimes, while atomic-write staging files are kept
+  outside the legacy marker directory.
+- Windows workspace Shell sessions now derive bounded read grants from each
+  command's final PATH and shell executable. Existing lexical and canonical
+  directories are admitted exactly; junction targets receive only the minimum
+  traversal ancestors below their profile application root, so version managers,
+  shims, virtual environments, and sibling runtime files work without naming
+  individual tools or exposing broad Documents/AppData vendor trees. Windows
+  shares one effective policy scope across compatible commands and confirms ACL
+  reset before switching to an incompatible scope. Standalone SDK calls,
+  workspace sessions, and duplicate SDK module copies use the same machine-wide
+  policy-owner protocol across Runtime profiles and KodaX homes, so incompatible
+  grants cannot combine through the shared Windows sandbox identity. The
+  target receives a case-normalized environment and preserves the Windows
+  verbatim-argument contract, so
+  profile-managed executables and quoted path arguments survive both broker layers.
+- Auto-started Runtime clients now require sandbox execution capability v3, so
+  an idle daemon from KodaX 0.7.85 or the earlier v2 execution policy is replaced only after its durable shutdown
+  outcome and Windows Job supervisor prove the old process tree is empty. A
+  daemon without that verification contract remains fail-closed and must be
+  stopped explicitly before the repaired Shell chain is exposed.
+- The first upgrade from a Runtime that predates the machine-wide Windows
+  sandbox-owner protocol requires all unmanaged legacy KodaX/Space processes
+  (including standalone SDK processes using another KodaX home) to be stopped.
+  Those binaries cannot participate in the new global owner lock; current and
+  future runtimes are serialized machine-wide after the transition.
+- Clean Windows workspace-session shutdown now honors the sandbox runtime's full
+  ACL reset budget before escalating to process-tree termination, while unclean
+  or unverified exits remain durably fail-closed.
+- Windows Shell sessions now share one ACL policy group when their normalized
+  workspace, Agent Home access, additional filesystem permissions, toolchain
+  scopes, and network policy are identical. Compatible commands can run in
+  parallel across independent KodaX processes; the last policy-group member confirms
+  reset before releasing its owner. Different policies fall back immediately
+  to the already-authorized ordinary execution path instead of blocking on a
+  machine-wide sandbox fence. Preparation failures use the same fallback, while
+  a command that started or may have started is never replayed implicitly.
+- Filesystem-effect coordinator handoff now waits through the lock protocol's
+  30-second stale-owner safety window. Slow or rapid cross-process handoffs no
+  longer fail at five seconds, while real cross-category effect conflicts keep
+  their existing one-second fail-closed admission boundary.
+- Runtime Shell containment is now sandbox-first rather than sandbox-required.
+  Auto[LLM] remains the single authorization decision, successful allow results
+  are cached only for the same Runtime-session intent revision, and unavailable
+  sandbox infrastructure uses normal permission enforcement without another
+  classifier call. Catastrophic root deletion, disk formatting/raw disk writes,
+  fork bombs, and Agent Home root/control-plane destruction remain deterministic
+  hard denials. The obsolete public `failClosed` switch has been removed.
+- The packaged Electron regression smoke now runs 20 Runtime Shell commands
+  through a profile-added junction toolchain, resolves the packaged Node binary
+  through its version-manager ancestry, exercises a quoted `cmd.exe` path, and
+  keeps its probe I/O inside the admitted workspace.
+- Packaged Electron hosts on Windows now keep Electron's Node bootstrap mode
+  across the internal filesystem-effect gate without leaking it to user
+  commands. Sandbox readiness uses KodaX's staged runner outside ASAR, failed
+  workspace sessions are retired, stale ACLs are recovered before startup and
+  after the last compatible sandbox owner exits, and an execution with missing
+  attestation is reported without replaying a possibly side-effecting command.
+- Sandbox stop now waits for process-tree termination proof before ACL recovery;
+  undrained Shell effects and spawn/cleanup failure combinations are reported as
+  lifecycle safety errors. Windows ACL owner markers admit only an exact shared
+  policy group for the machine sandbox identity, and crash recovery is serialized
+  across Runtime profiles.
+- Inline Runtime owner recovery now removes only a provably abandoned inline
+  owner fence before restoring daemon policy. Live, unreadable, legacy-kind,
+  daemon-kind, and unverifiable owners remain fail-closed, while a failed
+  inline-owner release remains retryable.
+- Runtime owner records and learning-file locks now retain an OS process-start
+  identity, so a reused PID cannot keep stale ownership alive.
+- Windows sandbox lifecycle failures now wait for termination proof, preserve
+  cleanup evidence, fence later filesystem effects, and never replay a command
+  whose effect process was not proven drained.
+- POSIX sandbox workspace sessions now latch an unconfirmed process-tree or
+  cleanup failure and reject replacement sessions until the safety state is
+  reset, matching the fail-closed lifecycle contract across platforms. Fresh
+  `KODAX_HOME` policy roots are initialized before policy identity is captured,
+  concrete admissions wait only for their workspace-local warm-up within the
+  existing Shell abort/deadline, and a failed lease cleanup retires the invalid
+  cached session before replacement.
 
 ---