@kodax-ai/kodax 0.7.94 → 0.7.95

package/CHANGELOG.md

@@ -8,6 +8,70 @@ All notable changes to this project will be documented in this file.
 
 ---
 
+## [0.7.95] - 2026-08-23
+
+### Fixed
+
+- KodaX-created linked worktrees now join the Session's exact sandbox policy
+  before the tool returns them to the model. The Runtime persists that bounded
+  root set, revalidates each Git common-directory backlink on later Runs, and
+  revokes it after worktree removal. A background Bash process in such a
+  worktree can therefore coexist with `write`/`edit` without authorizing
+  arbitrary sibling directories or weakening namespace fences. Atomic root
+  updates remain authoritative over stale full-Session snapshots, so an old
+  non-empty list cannot overwrite a newer registration or resurrect a revoked
+  root. Older Sessions migrate only retained successful `worktree_create`
+  evidence after the same Git relationship is revalidated. Session roots that
+  are real Git submodules use their byte-bounded `core.worktree` backlink as
+  the repository identity, so creating a linked worktree from a submodule does
+  not regress while forged `.git/modules` paths remain rejected.
+- Windows sandbox cleanup now keeps every ACL-mutating helper and command owner
+  in a recoverable machine-global Job, persists only self-healing recovery
+  tickets, and retries process drain, ACL reset, and filesystem-effect fence
+  release in the background without blocking unrelated work. Runtime shutdown
+  also verifies exact daemon and supervisor process generations, so PID reuse or
+  an interrupted exit cannot strand a manual-recovery requirement. Same-boot
+  `unconfirmed-owner` tickets are retried automatically and cleared only after a
+  sandbox-user SID probe proves the account idle; probe failure remains
+  fail-closed and diagnosable without blocking non-sandbox work. Text cleanup
+  recovery records each completed phase and retains a consumed
+  sandbox attestation across retries. Transient workspace cleanup, policy-reset,
+  or outer lease-release failures therefore retry without losing evidence or
+  repeating already completed phases.
+- Learning-store coordination now reclaims a stale zero-byte owner lock left by
+  a crash between exclusive creation and owner-record publication, plus stale
+  malformed or truncated owner records, using an unchanged-byte/stat compare
+  before deletion; valid live owners and successor records remain protected.
+  Fullscreen TUI
+  teardown also performs an exit-safe terminal restore from the renderer's
+  guaranteed unmount boundary, including when final rendering or React cleanup
+  throws; terminal write backpressure no longer disables cleanup (Issue 301).
+- Explicit Skill execution now keeps the exact user query as the canonical
+  transcript/title input while carrying expanded instructions and host hook
+  context only in the execution overlay. Multiple known Skill references are
+  rejected consistently in Classic, Ink, immediate, and queued paths, and a
+  failed or malformed `PreToolUse` hook fails closed instead of authorizing the
+  guarded tool. The shared command-dispatch check also covers leading
+  `/<skill>` and legacy `/skill:<name>` forms before either Skill executes.
+- Terminal Run persistence failure now converges to `unknown` before the public
+  result resolves. If neither status nor event journal can publish that state,
+  active `sessions.observe()` consumers are invalidated and must resnapshot,
+  preventing a stale terminal projection. The additive SDK contracts advance to
+  `runtimeExitSettlement:2` and Windows `sandboxRuntime:5`; release/version
+  assignment remains a maintainer step. If terminal status commits but its
+  status-lock cleanup reports failure, the exact committed proposal is reread
+  and its terminal event is still published once; a different authoritative
+  status is never overwritten or republished.
+- The coding runtime now delays its public `onComplete` completion signal until
+  extension completion and asynchronous result finalization have produced the
+  authoritative `KodaXResult`. A2A responses and other completion subscribers
+  can no longer observe an empty successful answer before the coding result
+  settles, including the lost-executor-Promise fallback path (Issue 302). A
+  completion observer that throws after finalization is diagnosed without
+  rewriting the persisted terminal facts.
+
+---
+
 ## [0.7.94] - 2026-08-21
 
 ### Changed

package/README.md

@@ -726,6 +726,40 @@ permission UI, and recovers stale prepared Session tails through an
 authoritative merge. Background persistence failures are surfaced as
 diagnostics rather than hidden.
 
+**v0.7.95 release:** stale learning locks with zero-byte,
+malformed, or truncated owner records self-recover after an unchanged
+bytes/stat check. Same-boot Windows `unconfirmed-owner` cleanup retries until
+the sandbox-user SID is proven idle, without requiring marker deletion.
+Windows sandbox cleanup keeps every ACL-mutating helper and command owner in a
+recoverable machine-global Job and retries process drain, ACL reset, and
+effect-fence release in the background; Runtime shutdown verifies exact daemon
+and supervisor process generations. Text cleanup retains its execution
+attestation and retries transient workspace cleanup, policy reset, and
+effect-lease release automatically.
+Canonical history stores the exact explicit-Skill query, multiple Skill
+references are rejected, and failed/malformed `PreToolUse` hooks deny the tool.
+Terminal persistence uncertainty publishes `unknown` or invalidates live
+Session observers for resnapshot. A status-lock cleanup failure after a
+committed terminal is reconciled only when the reread status exactly matches
+the local proposal, then publishes one terminal event; different authority
+still wins. The coding runtime finalizes its authoritative result before
+emitting the public completion signal, so A2A cannot publish an empty
+successful answer (Issue 302). This release advertises Windows
+`sandboxRuntime:5` and `runtimeExitSettlement:2`. See the
+[v0.7.95 release checklist](docs/release.md#v0795-release-preparation).
+
+**v0.7.95 dynamic-worktree correction:** KodaX-created linked
+worktrees join the exact Session shell/text sandbox policy before their paths
+are returned, persist across later Runs, and are revalidated against the same
+Git common directory. Removal revokes the root; unrelated siblings remain
+fenced. A real submodule Session root proves that identity through its bounded
+`.git/modules/...` `core.worktree` backlink; candidates still require ordinary
+linked-worktree backlinks. For an older Session without the registry field, a retained successful
+`worktree_create` result is migrated once only after the same Git relationship
+passes validation. If that exact evidence is unavailable, stop the background
+process and remove/recreate the worktree through KodaX once. Do not delete
+ProgramData coordination files for this migration.
+
 **v0.7.94 release:** Runtime text tools may overlap a compatible live Bash
 lease because snapshot and commit run through the same ASRT workspace policy.
 Hard-linked workspace targets are rejected. Windows sandboxed git trusts
@@ -742,8 +776,8 @@ Runtime advertises `conversationHistory:2`. Explicit Skill invocation
 still runs if an embedder result observer throws. Every Run
 finalization and sandbox/managed-child termination rejection is observed. If
 neither terminal record can be persisted, the Run resolves `unknown` with
-`run_settlement_not_persisted` and keeps the Session fenced. Daemon connection
-loss exposes a typed code, `connectionId`, and `reconnectable` fact. Once a
+`run_settlement_not_persisted` and keeps the Session fenced.
+Daemon connection loss exposes a typed code, `connectionId`, and `reconnectable` fact. Once a
 host receives a `runId`, it must retain it and, after reconnecting, call
 `runs.get(runId)` then `runs.await(runId)` on the replacement Runtime. It must
 never replay `runs.start()` for that admitted Run. Capability versions

package/README_CN.md

@@ -266,6 +266,35 @@ SDK 系统代码契约更新，但没有放宽 shell/sandbox 的 fail-closed 边
 `handleRuntimePermissionRequest()` 管理 SDK 权限 UI，并在 prepared Session 尾部遇到
 `data_changed` 时通过权威 delta 合并恢复；后台持久化失败会显示为诊断，不再静默丢失。
 
+**v0.7.95 发布**：零字节、畸形或截断 owner 的过期 learning lock
+会在字节与 stat 二次确认未变后自动恢复。同一次 Windows 启动内的
+`unconfirmed-owner` 会持续自动重试，只有精确 sandbox-user SID 探针证明空闲后
+才清理，不要求用户删除 marker。Windows 沙箱清理将每个修改 ACL 的 helper 与命令
+owner 保存在可恢复的机器级 Job 中，并在后台重试进程 drain、ACL reset 和
+effect fence 释放；Runtime 关闭会校验精确的 daemon 与 supervisor 进程代际。
+显式 Skill 的 canonical 历史保留用户原始 query，
+多个 Skill 引用会被拒绝，失败或畸形的 `PreToolUse` 会拒绝工具。终态持久化不确定
+时发布 `unknown`，或让 live Session observer 失效并重新取快照。若终态已经提交、
+随后 status-lock 清理失败，只在重读状态与本地 proposal 完全一致时继续且只发布
+一次 terminal event；不同的权威终态仍然优先。coding runtime 会在发出公开完成
+信号之前先收敛出权威结果，A2A 不会再发布空的成功答复（Issue 302）。
+本版本广告 Windows `sandboxRuntime:5` 与 `runtimeExitSettlement:2`。详见
+[v0.7.95 发布清单](docs/release.md#v0795-release-preparation)。
+
+**v0.7.95 动态 worktree 修正**：KodaX 创建的 linked worktree 会在路径
+返回给模型前加入该 Session 的精确 shell/text sandbox 策略，跨后续 Run 持久化，
+并按同一 Git common-dir 关系重新校验。删除 worktree 时立即撤销；未登记的
+sibling 目录仍保持门禁。若 Session 根本身是真实 Git submodule，只接受其有界
+`.git/modules/...` `core.worktree` 对精确工作区的反向绑定；候选仍须通过普通
+linked-worktree backlink 校验。旧版本创建的 worktree 没有持久化登记：Session 若仍
+保留成功的 `worktree_create` 结果，会在同一 Git 关系重新校验通过后
+一次性迁移；若该精确证据已不存在，请先停止后台进程，再通过 KodaX 删除并重新
+创建一次。迁移时不要删除 ProgramData 协调文件。
+
+**v0.7.95 自动清理修正**：文本清理会跨重试保留已经读取的执行
+attestation，并对瞬时 workspace cleanup、策略 reset 与 effect lease 释放失败自动
+重试；已经完成的阶段不会重复执行，也不会留下必须人工删除的恢复标记。
+
 **v0.7.94 发布**：Runtime 文本工具可以与兼容的长驻/后台 Bash 并发，因为
 snapshot 与 commit 走同一套 ASRT workspace 策略。硬链接工作区目标会被拒绝。
 Windows 沙箱 git 只信任已授权的仓库根，不再发出 `safe.directory=*`（Issue 300）。

package/dist/chunks/agent-XXZMXKKA.js

@@ -0,0 +1,2 @@
+// @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
+import{$a as j,Bc as k,La as g,Na as h,_a as i,a as c,ta as d,ua as e,va as f}from"./chunk-Q5VRWSKG.js";import"./chunk-7QBWHCIZ.js";import"./chunk-7JXA3533.js";import"./chunk-XWRPOGJN.js";import"./chunk-SRIJX5ZP.js";import"./chunk-2PEDBGKN.js";import"./chunk-BHE66SP3.js";import{Mb as a,Nb as b}from"./chunk-BNVSKIAB.js";import"./chunk-77PNP27P.js";import"./chunk-ONUPGMER.js";export{e as bucketProviderPayloadSize,g as buildAutoRepoIntelligenceContext,f as checkPromiseSignal,b as cleanupIncompleteToolCalls,h as describeTransientProviderRetry,c as emitResilienceDebug,d as estimateProviderPayloadBytes,k as runKodaX,j as saveRequiredSessionSnapshot,i as saveSessionSnapshot,a as validateAndFixToolHistory};

package/dist/chunks/argument-completer-KCYDGTQW.js

@@ -0,0 +1,2 @@
+// @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
+import{Na as a,Oa as b}from"./chunk-6ABQJUK6.js";import"./chunk-C4DTUKTR.js";import"./chunk-OK4AXDC5.js";import"./chunk-DSMONSVB.js";import"./chunk-2TM3W3GK.js";import"./chunk-Q5VRWSKG.js";import"./chunk-7QBWHCIZ.js";import"./chunk-JS452J2F.js";import"./chunk-7JXA3533.js";import"./chunk-XWRPOGJN.js";import"./chunk-SRIJX5ZP.js";import"./chunk-2PEDBGKN.js";import"./chunk-BHE66SP3.js";import"./chunk-BNVSKIAB.js";import"./chunk-77PNP27P.js";import"./chunk-ONUPGMER.js";export{a as ArgumentCompleter,b as createArgumentCompleter};

package/dist/chunks/{chunk-BVV3IA5W.js → chunk-2PEDBGKN.js}

@@ -1,2 +1,2 @@
 // @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
-import{$a as o}from"./chunk-UNRHTOT5.js";import{a as r}from"./chunk-ONUPGMER.js";var p=Object.freeze({".ts":"typescript",".mts":"typescript",".cts":"typescript",".tsx":"typescriptreact",".js":"javascript",".mjs":"javascript",".cjs":"javascript",".jsx":"javascriptreact",".py":"python",".pyi":"python",".go":"go",".rs":"rust",".java":"java"});function f(e){let t=e.lastIndexOf(".");if(t<0)return;let s=e.slice(t).toLowerCase();return p[s]}r(f,"languageIdForPath");var a=process.platform==="win32";function v(e){let t=e.replace(/\\/g,"/");return a?t.toLowerCase():t}r(v,"normalizeFsPath");import{spawn as c}from"child_process";function u(e){return process.platform==="win32"&&e!==process.execPath&&!/\.exe$/i.test(e)}r(u,"needsShell");function I(e,t,s,i=e===process.execPath?"javascript":"native"){if(u(e)){let n=[l(e),...t].join(" ");return c(n,{...s,shell:!0,windowsHide:!0})}if(i==="javascript"){let n=o({args:t,env:s.env??process.env,isElectron:process.versions.electron!==void 0,executable:e});return c(n.command,n.args,{...s,env:n.env,shell:!1,windowsHide:!0})}return c(e,[...t],{...s,shell:!1,windowsHide:!0})}r(I,"spawnLspProcess");function l(e){return/[\s"]/.test(e)?`"${e.replace(/"/g,'""')}"`:e}r(l,"quoteIfNeeded");export{f as a,v as b,I as c};
+import{$a as o}from"./chunk-BNVSKIAB.js";import{a as r}from"./chunk-ONUPGMER.js";var p=Object.freeze({".ts":"typescript",".mts":"typescript",".cts":"typescript",".tsx":"typescriptreact",".js":"javascript",".mjs":"javascript",".cjs":"javascript",".jsx":"javascriptreact",".py":"python",".pyi":"python",".go":"go",".rs":"rust",".java":"java"});function f(e){let t=e.lastIndexOf(".");if(t<0)return;let s=e.slice(t).toLowerCase();return p[s]}r(f,"languageIdForPath");var a=process.platform==="win32";function v(e){let t=e.replace(/\\/g,"/");return a?t.toLowerCase():t}r(v,"normalizeFsPath");import{spawn as c}from"child_process";function u(e){return process.platform==="win32"&&e!==process.execPath&&!/\.exe$/i.test(e)}r(u,"needsShell");function I(e,t,s,i=e===process.execPath?"javascript":"native"){if(u(e)){let n=[l(e),...t].join(" ");return c(n,{...s,shell:!0,windowsHide:!0})}if(i==="javascript"){let n=o({args:t,env:s.env??process.env,isElectron:process.versions.electron!==void 0,executable:e});return c(n.command,n.args,{...s,env:n.env,shell:!1,windowsHide:!0})}return c(e,[...t],{...s,shell:!1,windowsHide:!0})}r(I,"spawnLspProcess");function l(e){return/[\s"]/.test(e)?`"${e.replace(/"/g,'""')}"`:e}r(l,"quoteIfNeeded");export{f as a,v as b,I as c};

package/dist/chunks/{chunk-NGOPE4KK.js → chunk-2TM3W3GK.js}

@@ -1,5 +1,5 @@
 // @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
-import{D,J as F}from"./chunk-6BATYA47.js";import{n as q,o as j,p as N,q as C,sa as P}from"./chunk-ZGZLSKN6.js";import{Pa as E,gb as O,m as v,n as T}from"./chunk-BHE66SP3.js";import{Id as W,Jd as M,Od as I,rg as $,sg as k,tg as y,wg as _,xg as b,yg as x}from"./chunk-UNRHTOT5.js";import{a as o}from"./chunk-ONUPGMER.js";import{join as Le}from"node:path";var ae=["You generate KodaX Dynamic Workflow scripts.","Return JSON only. Do not wrap the answer in prose.","For simple tasks that do not benefit from multiple agents, return:",'{"action":"decline","reason":"..."}',"For complex tasks, return:",'{"action":"generate","manifest":{...},"source":"async function run(wf, args) { ... }","approvalSummary":"..."}',"Generated source may only coordinate agents through wf and args.","Generated source must return displayable final text for the user.","Never use import, require, process, fs, child_process, network APIs, shell commands, or direct file access."].join(`
+import{D,J as F}from"./chunk-JS452J2F.js";import{c as q,d as j,e as N,f as C,ha as P}from"./chunk-7JXA3533.js";import{Pa as E,gb as O,m as v,n as T}from"./chunk-BHE66SP3.js";import{Ag as b,Bg as x,Ld as W,Md as M,Rd as I,ug as $,vg as k,wg as y,zg as _}from"./chunk-BNVSKIAB.js";import{a as o}from"./chunk-ONUPGMER.js";import{join as Le}from"node:path";var ae=["You generate KodaX Dynamic Workflow scripts.","Return JSON only. Do not wrap the answer in prose.","For simple tasks that do not benefit from multiple agents, return:",'{"action":"decline","reason":"..."}',"For complex tasks, return:",'{"action":"generate","manifest":{...},"source":"async function run(wf, args) { ... }","approvalSummary":"..."}',"Generated source may only coordinate agents through wf and args.","Generated source must return displayable final text for the user.","Never use import, require, process, fs, child_process, network APIs, shell commands, or direct file access."].join(`
 `),G=12e4,le="KODAX_WORKFLOW_GENERATION_TIMEOUT_SEC",ce="KODAX_WORKFLOW_GENERATION_TIMEOUT_MS",ue=64,fe=2,de=2e3,pe=[{name:"default"},{name:"variant-results",finalText:o((e,n)=>`Variant smoke child report from ${e} (${n}).`,"finalText"),synthesizeText:"Variant smoke synthesis report."},{name:"unverified-success",status:o(()=>"completed_unverified","status"),finalText:o(e=>`Smoke result for ${e}: completed with verification warnings.`,"finalText"),synthesizeText:"Smoke synthesis: completed with verification warnings."},{name:"empty-args-rerun",args:o(()=>({}),"args")}],me=[{id:"import",pattern:/\bimport\s*(?:\(|['"*{]|\w+\s+from\b)/},{id:"require",pattern:/\brequire\s*\(/},{id:"process",pattern:/\bprocess\s*(?:\.|\[)/},{id:"fs",pattern:/\b(?:node:)?fs\b/},{id:"child_process",pattern:/\bchild_process\b/},{id:"shell",pattern:/\b(?:exec|spawn|execFile)\s*\(/},{id:"fetch",pattern:/\bfetch\s*\(/},{id:"Deno",pattern:/\bDeno\s*(?:\.|\[)/},{id:"Bun",pattern:/\bBun\s*(?:\.|\[)/},{id:"globalThis-index",pattern:/\bglobalThis\s*\[/}];function we(e=process.env,n){let t=v(n?.workflow?.generationTimeoutSec,"timeouts.workflow.generationTimeoutSec");if(t!==void 0)return t;let r=T(e[le]);if(r!==void 0)return r;let s=e[ce];if(s===void 0||s.trim().length===0)return G;let i=Number(s);return!Number.isFinite(i)||i<=0?G:Math.floor(i)}o(we,"resolveWorkflowGenerationTimeoutMs");function he(e,n){if(typeof e!="object"||e===null)throw new Error(`${n} must be an object`);return e}o(he,"readRecord");function K(e,n){let t=e[n];if(typeof t!="string"||t.trim().length===0)throw new Error(`workflow generation ${n} must be a non-empty string`);return t}o(K,"readNonEmptyString");function ge(e){let n=e.trim(),t=/^```(?:json)?\s*([\s\S]*?)\s*```$/i.exec(n);if(t?.[1])return t[1].trim();let r=n.indexOf("{"),s=n.lastIndexOf("}");if(r>=0&&s>r)return n.slice(r,s+1);throw new Error("workflow generation output did not contain a JSON object")}o(ge,"extractJsonText");function ke(e){let n=ge(e);return he(JSON.parse(n),"workflow generation output")}o(ke,"parseGenerationJson");function ye(e){if(typeof e=="string"){let t=e.trim();return t.length>0?t:void 0}if(typeof e!="object"||e===null)return;let n=e;for(let t of["name","id","title","phase"]){let r=n[t];if(typeof r=="string"&&r.trim().length>0)return r.trim()}}o(ye,"normalizePhaseEntry");function be(e){return e.split(/(?:->|\u2192|,|\n)/).map(n=>n.trim()).filter(n=>n.length>0)}o(be,"splitPhaseString");function xe(e){if(typeof e!="object"||e===null)return e;let n=e,t=n.phases,r;if(Array.isArray(t)){let s=t.map(ye);s.every(i=>i!==void 0)&&(r=s)}else if(typeof t=="string"){let s=be(t);s.length>0&&(r=s)}return r?{...n,phases:r}:e}o(xe,"normalizeGeneratedManifestCandidate");function ve(e){return e.match(/\bwf\.(?:runAgent|spawnAgent|synthesize)\s*\(/g)?.length??0}o(ve,"estimateDirectAgentCalls");function Se(e,n){let t=e.maxConcurrency*Math.max(1,e.phases.length)+2,r=ve(n)+2,s=Math.min(ue,Math.max(e.maxAgents,t,r));return s>e.maxAgents?{...e,maxAgents:s}:e}o(Se,"reserveGeneratedWorkflowAgentCapacity");function w(e){let n="",t=0,r=["code"],s=[0];for(;t<e.length;){let i=e[t],a=e[t+1];if(r[r.length-1]==="template"){if(i==="\\"){n+="  ",t+=2;continue}if(i==="`"){n+=" ",t+=1,r.pop(),s.pop();continue}if(i==="$"&&a==="{"){n+="  ",t+=2,r.push("code"),s.push(0);continue}n+=i===`
 `?`
 `:" ",t+=1;continue}if(i==="/"&&a==="/"){for(n+="  ",t+=2;t<e.length&&e[t]!==`