@kodax-ai/kodax 0.7.95 → 0.7.96-alpha.1

package/CHANGELOG.md

@@ -4,7 +4,170 @@ All notable changes to this project will be documented in this file.
 
 > Full history for versions prior to v0.7.0: [CHANGELOG_ARCHIVE.md](docs/CHANGELOG_ARCHIVE.md)
 
-## [Unreleased]
+## [0.7.96-alpha.1] - 2026-08-28
+
+### Fixed
+
+- FEATURE_296 replaces the local tool-result capacity hard gate with
+  capacity-debt admission plus a bounded recovery ladder (ADR-067). Executed
+  `tool_use`/`tool_result` pairs always commit; an over-budget batch records
+  `capacityDebt` metadata with its artifact pointer instead of aborting the
+  Run. The next iteration's compaction relieves the debt (a still-over
+  compacted transcript commits best-effort with `stillOverCapacity`), the
+  output reserve shrinks floor-bounded (3000) while over capacity — both in
+  the post-compaction judgment and on the wire-level request — and an
+  irreducibly oversized fresh user input degrades to a preview head plus a
+  run-scoped volatile pointer the model pages in slices, on the request copy
+  only; the full input stays behind an unguessable in-memory capability that
+  is removed when the Run ends and leaves no filesystem residue. A
+  transient compaction-summarizer failure fails open until the existing
+  circuit breaker opens; repeated failures or reducible still-over-capacity
+  results then produce a typed capacity terminal instead of repeatedly
+  invoking the summarizer. An irreducibly oversized fresh input does not spend
+  that summary-failure budget, and paging its transient capability cannot be
+  re-spilled into the global tool-result store. Provider output-token and
+  reasoning self-heal state is likewise request-local, so concurrent Runs
+  sharing a cached provider cannot alter one another. Runner final recounts
+  stamp capacity debt even when only the final
+  assembled batch crosses the budget. Local capacity terminals now classify as
+  `failureKind: "context_capacity"` with structured `contextTokens`
+  (`required`/`available`) — never masked as a provider credential failure,
+  classified by isolated class identity rather than message text — and the
+  daemon schema plus resume round-trip preserve the new fields.
+
+- Classified Runtime failures now expose one credential-safe `failureDetail`
+  across failure events (or settlement `run.updated`), Run result/status, and
+  Session diagnostics. The stable
+  KodaX `providerErrorCode` is kept separate from bounded upstream codes and
+  request metadata; KodaX-owned `safeMessage` templates never copy provider
+  response text, credentials, prompts, headers/bodies, URLs, local paths,
+  stacks, or raw errors.
+
+- Unified text diffs now use budget-capped anchored LCS matching, grouping
+  replacement blocks as removals followed by additions without duplicating
+  shared context. REPL diff context stays legible, and add/remove backgrounds
+  span the full terminal row while preserving selection highlighting.
+
+- FEATURE_295 separates cross-platform trusted text transactions from shell
+  containment. On Windows, Linux, and macOS, `write`, `edit`, `multi_edit`, `insert_after_anchor`, and
+  `undo` no longer enter ASRT/workspace-session/helper state; final identity,
+  per-slot kernel locking, revision CAS, flushed atomic replacement, and
+  stale-safe undo are enforced in the trusted Runtime; Unix uses a fixed
+  per-UID coordination root shared across Runtime config homes, a separate
+  protected addon cache, descriptor-bound loading, no-follow walking,
+  kernel `flock`, file/parent `fsync`, atomic rename, and ownership/mode/xattr/
+  Linux inode-flag and macOS extended-ACL/file-flag preservation.
+  Atomic replacement is now an explicit commit point: Windows performs no
+  fallible cleanup afterward, while Unix post-rename durability/rollback
+  uncertainty carries a complete receipt as `text_mutation_commit_uncertain`
+  and forbids blind retry. Windows preserves effective DACL entries; the
+  filesystem may canonicalize DACL inheritance/protection control during
+  replacement. Linux ZFS remains fail-closed until its case and
+  normalization semantics can be proven from a descriptor. Unix commits now
+  derive their namespace slot before locking without reading the target; all
+  target bytes and identity are observed under the slot lock, so a concurrent
+  atomic replace becomes the intended stale result instead of a false hard-link
+  rejection (Issue 320).
+  The Windows native
+  shell runner keeps framed stdin/process containment but drops the
+  command-lifetime filesystem-effect owner, uses a nonce-bound per-policy private desktop,
+  and suppresses final-target modal faults while preserving exit status, allowing independent policies,
+  Sessions, and Runtime processes to execute concurrently. `CloseStdin` no
+  longer closes the host control stream: cancellation and timeout send a
+  distinct `Terminate` frame over authenticated directional control/event
+  pipes, wait for the runner to prove the Job empty through a nonce-bound
+  terminal record, and preserve the original stop reason; generic PID-tree
+  cleanup is emergency-only. The incompatible native shell protocol advances
+  to v5. Request and terminal state now lives under a verified no-reparse,
+  protected host/SYSTEM-only control directory. SDK policy validation and the
+  native host independently reject overlapping allow roots and deny roots at or
+  below this boundary before ACL authorization or target creation. Doctor is
+  verify-only; explicit setup creates missing state or repairs only an empty,
+  no-reparse, host-owned direct child after proving the sandbox SID idle.
+  Packaged Electron Node targets consume and scrub `ELECTRON_RUN_AS_NODE` before
+  target or descendant code loads. The incompatible
+  authority split advances Windows `sandboxRuntime` to v6 so clients cannot
+  silently reuse a daemon that still implements the v5 graph. Existing
+  installations perform a one-time idle-account SID rotation through
+  `kodax sandbox setup`; native shell admission validates the resulting
+  machine protocol/SID generation before broker launch. Both native artifacts
+  are checked against an embedded manifest and loaded/executed only from a
+  protected content-addressed store whose immutable-image verification remains
+  shareable across concurrent Runtime processes. Packaged Electron hosts now
+  resolve only explicitly unpacked physical native files before applying those
+  checks; the release smoke asserts both KodaX native files and the Windows ASRT
+  runner are present under `app.asar.unpacked` (Issue 319). Linux/macOS shells remain
+  per-command ASRT bubblewrap/Seatbelt calls with no KodaX workspace-session
+  owner (Issues 304–306). Public POSIX sandbox calls now require target-start
+  attestation over a broker-only bounded control pipe. A proven pre-target exit
+  returns structured `backend_launch_failed`; a missing, malformed, or
+  mismatched control frame returns `execution_uncertain` and forbids blind
+  retry instead of misreporting that the command did not run. The ASRT-owned
+  runner's pre-main creation window is
+  recorded separately as Issue 307; final targets remain creation-time Job
+  contained. Runner loader/pre-main modal faults are part of that same upstream
+  bootstrap residual; it does not reach trusted text tools.
+
+- Bundled Windows binaries (Bun `--compile`) no longer resolve the Windows
+  sandbox runtime binary onto Bun's virtual `B:\` drive: the build ships a
+  `vendor/srt-win/<arch>/srt-win.exe` sidecar next to the executable,
+  `resolveSrtWinSourcePath()` prefers it in bundled builds, and
+  `kodax sandbox setup` installs through the prepared runner's resolved
+  descriptor instead of the library's module-relative lookup (Issue 303).
+
+- Windows ASRT import now accepts a package-store hardlink only in a bundled
+  build, after a handle-bound bounded read matches the embedded release
+  SHA-256. Development manifests and sources remain single-link. KodaX still
+  copies it into the protected content-addressed cache, whose executable must
+  remain single-link, ACL-protected, and hash-correct. Valid package layouts no
+  longer make model-issued Bash silently use the declared normal-permission
+  fallback (Issue 317). The repository now declares npm as its package manager;
+  alternate local package metadata remains outside the project contract.
+
+- Windows native shell admission no longer writes traversal ACEs to every
+  allow-root ancestor. The restricted target's enabled traverse privilege
+  reaches an exact capability-protected root without directory-list/content
+  authority, while explicit deny-ancestor conflicts remain rejected. This
+  avoids unbounded profile-DACL propagation and restores cold `%TEMP%` shell
+  startup within the existing deadline (Issue 318).
+
+### Added
+
+- Custom providers can opt into image / vision input with a single
+  `"imageInput": true` field (typical for self-hosted multimodal models on
+  vLLM / SGLang OpenAI-compatible endpoints, e.g. Qwen-VL). The flag forces
+  `capabilityProfile.multimodalSupport: "image-input"` on every surface —
+  provider instance, keyless capability queries, media routing, and the
+  provider-policy gate — so image artifacts pass `MODEL_INPUT_UNSUPPORTED`
+  validation and are forwarded as standard `image_url` blocks. Leaving it
+  unset changes nothing; text-only models keep the pre-send rejection.
+- DeepSeek vision model `deepseek-v4-flash-vision-exp` is registered on the
+  `deepseek` provider (selectable via `/model`). It reuses the existing
+  OpenAI-style `image_url` wire path, so pasted/read images are forwarded on
+  user turns, while `deepseek-v4-flash` / `deepseek-v4-pro` stay text-only via
+  per-model media routing (ark-coding mixed-capability convention). Cost
+  accounting uses flash pricing — images bill as size-derived tokens (≤384 per
+  image) at text-token rates.
+- `glm-5.3-flash` (published 2026-08-26) is registered on `zhipu`,
+  `zhipu-coding`, and `zai-coding` (selectable via `/model`). It is the first
+  natively multimodal GLM: image input is routed and validated end-to-end
+  (Anthropic-compat image blocks on the coding routes, `image_url` on the
+  public route), video stays provider-native-unwired, and file input remains
+  unwired end-to-end. 1M context, 131K output, cannot disable thinking (same
+  `zai-glm-5.3` effort mapping as `glm-5.3`), and priced from the official
+  announcement at $0.15 input / $0.50 output / $0.03 cached input per million
+  tokens. Defaults stay on `glm-5.3`; `glm-5.3` / `glm-5.2` remain text-only
+  image-unsupported.
+- Release publication now ships CI-built bytes. The npm package embeds
+  prebuilt native authorities for five platforms, which only the Release
+  workflow's cross-platform matrix can assemble, so the universal tarball is
+  built by its `npm-package` job and attached to the GitHub Release as
+  `kodax-ai-kodax-<version>.tgz` + `kodax-ai-kodax-npm.sha256`. `node
+  scripts/release.mjs` (no arguments) downloads those exact assets, verifies
+  the sha256 checksum and sidecar audit, and publishes them; on a local
+  machine `--pack-only` produces a host-only LOCAL TEST TARBALL that keeps
+  `private: true` (npm refuses to publish it) for `npm install <path>` SDK
+  consumer testing.
 
 ---
 

package/LICENSE

@@ -1,158 +1,158 @@
-KodaX-AI Fair Core License (KAI-FCL) 1.0
-
-Copyright (c) 2026 icetomoyo <icetomoyo@gmail.com> <icetomoyo@163.com>
-
-All rights reserved except as expressly granted in this License.
-
-This License applies to KodaX releases and files that include this LICENSE file
-or otherwise identify KAI-FCL as their governing license. Earlier KodaX
-releases or files that were distributed under the Apache License, Version 2.0
-remain licensed under Apache-2.0 for those released copies. Third-party
-components remain governed by their own license terms.
-
-Effective Version Notice
-
-KodaX-AI intends KAI-FCL to govern official KodaX distributions for version
-0.7.70 and later when those distributions are provided by KodaX-AI with this
-LICENSE file, a KAI-FCL notice, or accompanying customer terms.
-
-Historical Git tags, source archives, binaries, npm packages, or other copies
-of KodaX that were already distributed with Apache-2.0 license text remain
-licensed under Apache-2.0 for those specific copies. This notice does not
-retroactively revoke rights that were already granted under Apache-2.0.
-
-For avoidance of doubt, current and future official enterprise/customer
-packages for KodaX 0.7.70 and later should be delivered with KAI-FCL or
-separate KodaX-AI customer terms.
-
-1. Definitions
-
-"Software" means KodaX, including its source code, object code, documentation,
-configuration, examples, official npm packages, binaries, and other materials
-distributed by KodaX-AI under this License.
-
-"KodaX-AI" means the copyright owner, licensor, or license steward for the
-Software.
-
-"You" means the individual or legal entity exercising permissions under this
-License.
-
-"Community Use" means use by an individual for personal learning, individual
-non-commercial work, classroom instruction, non-production research, or
-developing and testing changes for contribution to public open-source
-projects.
-
-"Commercial or Managed Use" means any use by or for a company, school, lab,
-institution, government agency, or other organization for administration, IT
-operations, team research and development, production work, intranet hosting,
-managed-device deployment, paid service delivery, customer redistribution,
-hosted or managed services, or other business purposes.
-
-"Customer Agreement" means a written agreement with KodaX-AI, including
-evaluation terms, an order form, an enterprise agreement, partner terms, or
-another commercial authorization document.
-
-"License Entitlement" means a signed offline entitlement file, commonly using
-the `.kodax-license` extension, that identifies product, edition, license
-kind, customer, expiry, enabled features, binding claims, and signature. A
-License Entitlement proves technical authorization; it is not by itself the
-complete legal contract.
-
-2. Community Grant
-
-Subject to this License, KodaX-AI grants You a limited, non-exclusive,
-non-transferable, no-charge license to download, install, run, inspect, and
-modify the Software solely for Community Use.
-
-You may make copies of the Software as reasonably necessary for Your own
-Community Use, backup, testing, and contribution preparation. You may submit
-changes, patches, issues, and documentation improvements to KodaX-AI. Unless a
-separate written contribution agreement says otherwise, You grant KodaX-AI a
-perpetual, worldwide, irrevocable, royalty-free license to use, reproduce,
-modify, distribute, sublicense, and otherwise exploit contributions You submit
-for inclusion in the Software.
-
-3. Commercial and Managed Use
-
-Commercial or Managed Use is not permitted under the Community Grant.
-
-Enterprise evaluation, enterprise production, intranet deployment,
-managed-device deployment, commercial redistribution, partner distribution,
-paid service delivery, or any other Commercial or Managed Use requires a
-Customer Agreement with KodaX-AI and, where the Software requires it, a valid
-License Entitlement.
-
-All production customer License Entitlements must include an expiry date unless
-a Customer Agreement expressly says otherwise. Longer commercial terms are
-renewals or replacements, not perpetual local secrets.
-
-4. Restrictions
-
-Except as expressly allowed by this License or a Customer Agreement, You must
-not:
-
-- use the Software for Commercial or Managed Use;
-- sell, rent, lease, sublicense, host, provide, or redistribute the Software to
-  third parties;
-- remove, disable, bypass, tamper with, or misrepresent license enforcement,
-  entitlement checks, signatures, expiry checks, binding checks, or related
-  technical controls;
-- remove or alter copyright, license, attribution, trademark, or third-party
-  notices;
-- use KodaX-AI names, logos, product names, or trademarks except to describe
-  the origin of the Software accurately;
-- violate applicable law or use the Software to infringe third-party rights.
-
-5. Separate Agreements
-
-If You have a Customer Agreement with KodaX-AI, that Customer Agreement
-controls for the Software, edition, term, users, sites, features, and use cases
-it covers. This License controls only where the Customer Agreement does not
-grant additional rights or impose different obligations.
-
-6. Ownership
-
-KodaX-AI and its licensors retain all right, title, and interest in and to the
-Software. No rights are granted except those expressly stated in this License
-or a Customer Agreement.
-
-7. Third-Party Software
-
-The Software may include or depend on third-party software, packages, models,
-fonts, assets, or tools. Those materials are licensed by their respective
-owners under their own terms. This License does not change third-party license
-obligations.
-
-8. Termination
-
-Your rights under this License terminate automatically if You violate this
-License and do not cure the violation within 30 days after receiving notice
-from KodaX-AI. Rights also terminate immediately for intentional license
-enforcement bypass, unauthorized Commercial or Managed Use, or unauthorized
-redistribution. After termination, You must stop using and distributing the
-Software, and You must delete copies not otherwise authorized by a Customer
-Agreement or by another license that independently applies to a specific
-released copy.
-
-9. Disclaimer of Warranty
-
-THE SOFTWARE IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTIES OR
-CONDITIONS OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT,
-SECURITY, ACCURACY, OR AVAILABILITY.
-
-10. Limitation of Liability
-
-TO THE MAXIMUM EXTENT PERMITTED BY LAW, KODAX-AI AND ITS CONTRIBUTORS WILL NOT
-BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR
-PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST REVENUE, LOST DATA, BUSINESS
-INTERRUPTION, GOODWILL LOSS, OR PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES,
-ARISING OUT OF OR RELATING TO THE SOFTWARE OR THIS LICENSE, EVEN IF ADVISED OF
-THE POSSIBILITY OF SUCH DAMAGES.
-
-11. Contact
-
-For enterprise evaluation, production licensing, redistribution permission, or
-questions about this License, contact:
-
-icetomoyo <icetomoyo@gmail.com> <icetomoyo@163.com>
+KodaX-AI Fair Core License (KAI-FCL) 1.0
+
+Copyright (c) 2026 icetomoyo <icetomoyo@gmail.com> <icetomoyo@163.com>
+
+All rights reserved except as expressly granted in this License.
+
+This License applies to KodaX releases and files that include this LICENSE file
+or otherwise identify KAI-FCL as their governing license. Earlier KodaX
+releases or files that were distributed under the Apache License, Version 2.0
+remain licensed under Apache-2.0 for those released copies. Third-party
+components remain governed by their own license terms.
+
+Effective Version Notice
+
+KodaX-AI intends KAI-FCL to govern official KodaX distributions for version
+0.7.70 and later when those distributions are provided by KodaX-AI with this
+LICENSE file, a KAI-FCL notice, or accompanying customer terms.
+
+Historical Git tags, source archives, binaries, npm packages, or other copies
+of KodaX that were already distributed with Apache-2.0 license text remain
+licensed under Apache-2.0 for those specific copies. This notice does not
+retroactively revoke rights that were already granted under Apache-2.0.
+
+For avoidance of doubt, current and future official enterprise/customer
+packages for KodaX 0.7.70 and later should be delivered with KAI-FCL or
+separate KodaX-AI customer terms.
+
+1. Definitions
+
+"Software" means KodaX, including its source code, object code, documentation,
+configuration, examples, official npm packages, binaries, and other materials
+distributed by KodaX-AI under this License.
+
+"KodaX-AI" means the copyright owner, licensor, or license steward for the
+Software.
+
+"You" means the individual or legal entity exercising permissions under this
+License.
+
+"Community Use" means use by an individual for personal learning, individual
+non-commercial work, classroom instruction, non-production research, or
+developing and testing changes for contribution to public open-source
+projects.
+
+"Commercial or Managed Use" means any use by or for a company, school, lab,
+institution, government agency, or other organization for administration, IT
+operations, team research and development, production work, intranet hosting,
+managed-device deployment, paid service delivery, customer redistribution,
+hosted or managed services, or other business purposes.
+
+"Customer Agreement" means a written agreement with KodaX-AI, including
+evaluation terms, an order form, an enterprise agreement, partner terms, or
+another commercial authorization document.
+
+"License Entitlement" means a signed offline entitlement file, commonly using
+the `.kodax-license` extension, that identifies product, edition, license
+kind, customer, expiry, enabled features, binding claims, and signature. A
+License Entitlement proves technical authorization; it is not by itself the
+complete legal contract.
+
+2. Community Grant
+
+Subject to this License, KodaX-AI grants You a limited, non-exclusive,
+non-transferable, no-charge license to download, install, run, inspect, and
+modify the Software solely for Community Use.
+
+You may make copies of the Software as reasonably necessary for Your own
+Community Use, backup, testing, and contribution preparation. You may submit
+changes, patches, issues, and documentation improvements to KodaX-AI. Unless a
+separate written contribution agreement says otherwise, You grant KodaX-AI a
+perpetual, worldwide, irrevocable, royalty-free license to use, reproduce,
+modify, distribute, sublicense, and otherwise exploit contributions You submit
+for inclusion in the Software.
+
+3. Commercial and Managed Use
+
+Commercial or Managed Use is not permitted under the Community Grant.
+
+Enterprise evaluation, enterprise production, intranet deployment,
+managed-device deployment, commercial redistribution, partner distribution,
+paid service delivery, or any other Commercial or Managed Use requires a
+Customer Agreement with KodaX-AI and, where the Software requires it, a valid
+License Entitlement.
+
+All production customer License Entitlements must include an expiry date unless
+a Customer Agreement expressly says otherwise. Longer commercial terms are
+renewals or replacements, not perpetual local secrets.
+
+4. Restrictions
+
+Except as expressly allowed by this License or a Customer Agreement, You must
+not:
+
+- use the Software for Commercial or Managed Use;
+- sell, rent, lease, sublicense, host, provide, or redistribute the Software to
+  third parties;
+- remove, disable, bypass, tamper with, or misrepresent license enforcement,
+  entitlement checks, signatures, expiry checks, binding checks, or related
+  technical controls;
+- remove or alter copyright, license, attribution, trademark, or third-party
+  notices;
+- use KodaX-AI names, logos, product names, or trademarks except to describe
+  the origin of the Software accurately;
+- violate applicable law or use the Software to infringe third-party rights.
+
+5. Separate Agreements
+
+If You have a Customer Agreement with KodaX-AI, that Customer Agreement
+controls for the Software, edition, term, users, sites, features, and use cases
+it covers. This License controls only where the Customer Agreement does not
+grant additional rights or impose different obligations.
+
+6. Ownership
+
+KodaX-AI and its licensors retain all right, title, and interest in and to the
+Software. No rights are granted except those expressly stated in this License
+or a Customer Agreement.
+
+7. Third-Party Software
+
+The Software may include or depend on third-party software, packages, models,
+fonts, assets, or tools. Those materials are licensed by their respective
+owners under their own terms. This License does not change third-party license
+obligations.
+
+8. Termination
+
+Your rights under this License terminate automatically if You violate this
+License and do not cure the violation within 30 days after receiving notice
+from KodaX-AI. Rights also terminate immediately for intentional license
+enforcement bypass, unauthorized Commercial or Managed Use, or unauthorized
+redistribution. After termination, You must stop using and distributing the
+Software, and You must delete copies not otherwise authorized by a Customer
+Agreement or by another license that independently applies to a specific
+released copy.
+
+9. Disclaimer of Warranty
+
+THE SOFTWARE IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTIES OR
+CONDITIONS OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT,
+SECURITY, ACCURACY, OR AVAILABILITY.
+
+10. Limitation of Liability
+
+TO THE MAXIMUM EXTENT PERMITTED BY LAW, KODAX-AI AND ITS CONTRIBUTORS WILL NOT
+BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR
+PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST REVENUE, LOST DATA, BUSINESS
+INTERRUPTION, GOODWILL LOSS, OR PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES,
+ARISING OUT OF OR RELATING TO THE SOFTWARE OR THIS LICENSE, EVEN IF ADVISED OF
+THE POSSIBILITY OF SUCH DAMAGES.
+
+11. Contact
+
+For enterprise evaluation, production licensing, redistribution permission, or
+questions about this License, contact:
+
+icetomoyo <icetomoyo@gmail.com> <icetomoyo@163.com>