@kodax-ai/kodax 0.7.96-alpha.3 → 0.7.96-alpha.7

package/CHANGELOG.md

@@ -4,6 +4,354 @@ All notable changes to this project will be documented in this file.
 
 > Full history for versions prior to v0.7.0: [CHANGELOG_ARCHIVE.md](docs/CHANGELOG_ARCHIVE.md)
 
+## [Unreleased]
+
+## [0.7.96-alpha.7] - 2026-09-03
+
+### Fixed
+
+- Clarified the sandbox diagnostic boundary across the CLI, setup guide,
+  `kodax_manual`, and public documentation: run `kodax sandbox doctor` directly
+  in a host terminal or use `/sandbox` inside the REPL, rather than invoking the
+  host control-plane doctor through the sandbox-first Bash tool. This prevents a
+  healthy Windows sandbox from being misreported when its restricted account is
+  correctly denied access to host-owned ASRT state; shell routing and sandbox
+  permissions are unchanged.
+- Added cold-start self-healing for stale Windows sandbox setup generations.
+  A bare interactive CLI startup, including `kodax -r`, now checks the
+  installed generation before creating the REPL Runtime and reuses the existing
+  setup-only UAC boundary when migration is required. Concurrent startups
+  converge on one setup operation; followers recheck the completed generation
+  instead of installing again. Current state stays silent, and print-mode,
+  daemon, SDK, and ordinary tool execution never elevate automatically or wait
+  on the setup lock. A current marker now takes the same coarse fast path as
+  Codex; when recovery is actually required, the unchanged setup operation runs
+  in a child process while `kodax -r` and new-session startup display a live
+  elapsed-time indicator instead of freezing the last picker frame.
+- Require the setup/onboarding boundary to complete one no-side-effect native
+  target-start/exit probe before reporting Windows sandbox recovery as ready.
+  The released setup-generation-9 marker migrates in place to generation 10,
+  retaining a healthy account SID and filesystem capability nonce. This closes
+  the state where verify-only metadata looked ready while real Bash still fell
+  back to host execution, without adding a command-path lock, queue, or retry.
+
+## [0.7.96-alpha.6] - 2026-09-02
+
+### Fixed
+
+- Aligned the universal npm release audit with Windows native shell protocol
+  10. The release workflow now validates the same manifest contract emitted by
+  `build:native`, so a valid protocol-10 Windows artifact is not rejected as an
+  incompatible protocol-9 package during GitHub pre-release assembly.
+- Current native protocol 10 keeps isolated Skill Script execution POSIX-only
+  on Windows because per-command denyRead remains unsupported.
+- Moved broad Windows profile-root ACL convergence fully into versioned setup.
+  Protocol/setup generation 10 marks those roots as setup-owned; ordinary
+  admission only verifies their stable capability ACEs and returns a typed
+  setup-required error when one is missing. Command-specific small roots retain
+  additive convergence. This removes recursive `AppData` DACL propagation from
+  target start without adding a lock, queue, per-root timeout, or command retry.
+- Expanded the existing ASRT Windows proxy range to 64 ports and removed KodaX's
+  process-local broker-capacity/idle-eviction gate. Up to 32 exact network
+  authorities now rely on OS bind arbitration across Runtime processes; broker
+  pooling, reference ownership, and bounded idle cleanup remain unchanged.
+- Made explicit CLI and public SDK sandbox doctor execute one no-side-effect
+  identity probe with host fallback disabled. `ready: true` now proves a real
+  target start and successful exit, while internal startup/admission readiness
+  remains verify-only. The explicit probe can republish a missing exact-hash
+  native cache object from its pinned packaged bytes, but never runs setup or
+  repairs ACL policy. Native request diagnostics retain protocol, setup/broker
+  generation, artifact hashes, failure phase, and final sandbox failure evidence.
+- Kept unlowerable nested shell commands opaque, matching Codex's host-policy
+  boundary. Recognized `cmd` and PowerShell forms are still recursively checked,
+  explicit outer/interpreter rules still apply, and concrete critical effects
+  remain fail-closed. Command complexity never changes sandbox selection: these
+  calls remain sandbox-first, and parser uncertainty is considered by Edits or
+  Auto[LLM] only after a genuine sandbox pre-start failure reaches the host
+  boundary instead of becoming a synthetic non-overridable forbid.
+- Pinned every loaded embedded Windows native manifest to its exact immutable
+  protected-cache generation. A long-lived npm-linked CLI or SDK process now
+  reuses the already verified executable for its embedded hash before consulting
+  a mutable rebuilt `dist/native` source, so overlapping builds cannot mix a
+  TypeScript host with another native evidence generation. A genuinely new hash
+  is still published atomically, without a command lock, queue, or retry loop.
+- Stopped per-command Windows cleanup from deleting the shared private-Temp
+  parent. The native command's lifecycle/Job-drain result is now authoritative
+  before its unique Temp leaf is removed; a bounded leaf cleanup failure emits
+  a diagnostic instead of turning an already proven exit into a Tool Error.
+  This fixes the intermittent `rmdir ...\\kodax-sandbox\\<root>: EPERM` seen
+  under concurrent packaged Electron smoke without adding a lock, queue, or
+  command replay.
+- Removed the two remaining Codex-alignment gaps that could make Bash unusable.
+  Windows roots use stable read/write/deny capability ACEs, while each command
+  token activates only its authorized capabilities. Setup owns broad profile
+  grants; admission accepts already-effective setup grants read-only and never
+  downgrades or clears a capability installed for another command. Windows
+  shell `%TEMP%`/`%TMP%`/`%TMPDIR%` now point to one empty private directory per
+  command under the system temporary directory, so ordinary admission never
+  recursively rewrites the shared system Temp/AppData tree. No lock, queue, or
+  command retry was added.
+- Restored SDK/daemon host-boundary fallback by forwarding
+  `authorizeShellHostExecution` through the Coding tool-execution context. A
+  cleanup-proven pre-start sandbox failure can therefore reach the existing
+  Auto[LLM]/Exec Policy decision instead of stopping at the misleading
+  "requires a new permission decision" message.
+- Advanced the Windows SDK/daemon sandbox contract to `sandboxRuntime:11`.
+  An idle same-version daemon from an earlier npm-link build is now replaced
+  through the existing authenticated upgrade path instead of silently reusing
+  its older admission behavior; busy daemons remain fail-closed and untouched.
+- Retire a shared Windows network-broker generation when a started native host
+  proves runner/controller-path loss. Existing holders remain untouched, while
+  the next command creates a fresh generation instead of reusing a controller
+  that is already exiting and waiting for target-start attestation to time out.
+- Preserved terminal input across bare `kodax -r` session selection in the
+  compiled Bun/Windows release. A successful picker hands raw-mode ownership to
+  the next owned renderer; cancellation, preparation failure, classic REPL, and
+  final terminal cleanup retain their existing behavior.
+- Closed two portable Bash lifecycle gaps without adding a command lock or
+  retry loop. Broker-control close/error/overflow now still runs the prepared
+  request cleanup before reporting failure, and background execution is not
+  reported as started until the wrapper has an OS PID; asynchronous spawn
+  rejection therefore cannot return `PID: undefined` or leak prepared state.
+  Process settlement and output capture are attached immediately after spawn,
+  so a fast target that exits during start attestation cannot lose its output,
+  completion footer, or request cleanup.
+
+## [0.7.96-alpha.5] - 2026-09-01
+
+### Fixed
+
+- Completed the Windows sandbox concurrency correction without adding a
+  machine-global command lock or queue. Every command owns its runner pipes,
+  exact process handle, creation-time kill-on-close Job, cancellation state,
+  and terminal evidence; cancellation is observed before synchronous launch
+  preparation and all abort paths finish Job drainage before host exit.
+- Removed the remaining startup/termination race: a command that has not
+  published a nonce-bound Resume record may use the one-second pre-start
+  cleanup path, while a Resume discovered during that window extends the wait
+  to the normal terminal-attestation budget instead of being killed early.
+- Restored fail-closed admission ordering in the Windows native host: policy
+  boundary validation (protected control-state overlap, restricted-account,
+  and terminal-record checks) runs before the host consumes controller
+  bootstrap input, so a forged or policy-opaque request is rejected with its
+  structured error instead of stalling until the operation deadline. Valid
+  commands still observe termination control before setup and launch.
+- Treated the Runtime daemon `0.0.0` development sentinel as having no
+  provable SemVer ordering. Such an owner attaches in place instead of being
+  classified as an older daemon for the version boundary, so SDK test and
+  development harnesses reconnect without a forced replacement, while every
+  documented versioned-capability boundary, the never-downgrade guard, and
+  the non-SemVer fail-closed path are unchanged.
+- Restored the portable shell adapter's protected-read gate that the
+  sandbox-first routing restructure dropped: on POSIX, a model Bash read
+  carve-back that targets the trusted text native state roots fails
+  preparation with the structured protected-state error before any broker
+  spawn, matching the SDK executor and Windows control-state gates.
+- Made content-addressed Windows native artifacts self-healing on execution.
+  A missing new-version artifact is published atomically, concurrent publishers
+  converge without a global mutex, and ordinary commands verify stable file
+  identity, physical cache containment, and content hash without launching a
+  PowerShell verifier. Owner/DACL construction remains part of atomic
+  publication; `sandbox doctor` remains verify-only.
+- Made Runtime daemon upgrades version-safe. An alpha.5 execution client
+  replaces an idle older daemon on first connection, leaves a busy older daemon
+  running with a recoverable error, never downgrades a newer daemon, and never
+  mutates an owner whose version is not comparable SemVer.
+- Completed sandbox self-healing at the process facts that own it. Failed
+  target-start/controller generations roll out of reuse without stopping live
+  holders; an unconfirmed process remains in fixed-port capacity accounting
+  until `close`, while spawn failure without an OS process cannot leak capacity.
+  Native-host bootstrap delivery failure does not blame or retire a healthy
+  shared broker. No command lock, queue, or new permission restriction was
+  introduced.
+- Made simultaneous and staggered npm-linked/`kodax -r` upgrade clients
+  converge on one idle incompatible-daemon replacement, including a peer that
+  attaches between preflight and settlement or after the durable prepared
+  ticket but before its revision CAS. One authenticated follower resumes that
+  exact durable ticket after detaching while the first client and any other
+  followers only observe the owner change; active or untrusted work remains untouched.
+## [0.7.96-alpha.4] - 2026-08-30
+
+### Changed
+
+- Replaced the legacy Plan/Edits/Auto[RULES]/Auto[LLM] permission shape with
+  four canonical profiles: Plan, Edits, Auto[LLM], and Full Access. Legacy
+  `auto-in-project` and Rules selections migrate to Auto[LLM]; `/auto-engine`
+  and auto-rules loading are removed.
+- Made shell containment sandbox-first. Successful sandbox execution is silent;
+  only a proven pre-start denial or unavailable backend reaches Exec Policy and
+  the Edits user boundary or Auto reviewer. Started or uncertain commands are
+  never replayed, and an approved boundary has at most one host attempt.
+- Added JSONC Exec Policy (`~/.kodax/exec-policy.jsonc`, plus explicitly trusted
+  repository policy) with deterministic `allow`/`prompt`/`forbidden` prefix
+  rules, strictest-match evaluation, administrator forbids, narrow critical
+  fallbacks, and the non-executing `kodax execpolicy check` command.
+- Auto review now runs only at an exact host boundary, uses fixed 90-second and
+  one 180-second retry deadlines, fails closed on reviewer infrastructure
+  errors, stops a turn after the bounded denial thresholds, and never opens an
+  automatic approval prompt. A later informed natural-language instruction is
+  reviewed again.
+- Aligned the workspace sandbox with normal development use: inherit the host
+  environment except fixed KodaX/Electron execution controls, allow external
+  network and system temporary writes, permit broad reads including Agent Home,
+  credentials, and global Git configuration, and stop disabling global Git.
+  The obsolete `sandbox.envPass` input is inert.
+- Advanced the public Runtime contract to `runtimeAutoModeGuardrail:5` and
+  `sharedSessionSettings:2`, with exact canonical/input permission types,
+  host-owned Exec Policy/Auto-review options, ACP mode exports, and safe daemon
+  replacement so an alpha.4 client cannot silently attach to alpha.3 routing.
+  An idle older daemon is replaced automatically; a busy older daemon is left
+  intact and reported as a recoverable upgrade boundary, while a newer daemon
+  is never downgraded by an older client. A non-SemVer/unknown daemon version is
+  likewise left untouched because its ordering cannot be proven.
+- Synchronized README, PRD/HLD/DD/ADR, feature and release records, public
+  configuration/SDK guides, config templates, package contents, test guide,
+  and `kodax_manual` with the same sandbox-first contract.
+
+### Fixed
+
+- Removed the shell-tool fallback that could execute unsandboxed after native
+  sandbox bootstrap and termination both failed. The boundary is now explicit,
+  policy-reviewed, and single-attempt.
+- Closed administrator Exec Policy bypasses through recognized nested Windows shells.
+  `cmd /C` and `/K`, PowerShell command selectors/abbreviations, and strict
+  UTF-16LE `EncodedCommand` payloads are recursively evaluated. Unlowerable
+  bodies remain opaque full-argv operations for exact outer policy and the
+  normal Edits/Auto[LLM] boundary; only explicit matched forbids and concrete
+  critical effects are non-bypassable.
+- Corrected the Windows shell concurrency regression at its setup/admission
+  boundary. Protocol 9/setup generation 9 removes every machine-global ACL
+  mutex from ordinary admission. Each canonical root receives one
+  policy-independent stable ACE set for `AllowRead`, `AllowWrite`, and
+  `DenyWrite`; the command token activates only its exact capabilities. Missing
+  ACEs converge additively with `SET_ACCESS` plus DACL readback, without
+  revocation, a cross-process target mutex, or a serialized command lifetime.
+  This removes both the observed 240-second global-mutex stall and the
+  deterministic 75-second failure caused by applying a separate five-second
+  mutex wait to each of 15 roots. Generation 8 remains the proof boundary for
+  the one-time legacy ACL removal; generation 9 upgrades a healthy account in
+  place, preserving its SID/group and filesystem nonce without replaying that
+  cleanup. Setup first publishes a protected non-ready `installing` marker; the
+  elevated parent validates that exact digest-bound marker and synchronously
+  converges NUL compatibility plus profile read capabilities. The caller
+  publishes the ready marker only after the parent succeeds. No helper or
+  migration overlaps ordinary admission, system TMP is not prewarmed, and
+  native protocol/setup advance to `9`, while the published Runtime capability
+  is `sandboxRuntime:10`;
+  so a newly linked CLI replaces an idle daemon that still carries the setup-8
+  ACL behavior and refuses a busy one instead of mixing generations.
+- Fixed first-launch policy construction when a custom `KODAX_HOME` is below the
+  system temporary write root. KodaX now creates only its fixed protected
+  `sandbox-runtime`, `native-text-state-v1`, `runtime`, `processes`, and `learned`
+  directories before passing them as Windows deny-write roots, so native
+  validation never rejects a missing host-owned root. This adds no lock, queue,
+  ACL mutation, or command-lifetime coordination.
+- Preserved failed managed-turn history across `kodax -r`. The run-end failure
+  path now commits the already-rendered Assistant summary, Sidecar Verifier
+  verdict, and terminal error in their original order. The JSON load guard also
+  accepts the typed `sidecar` item, including a save/load/save/load round trip;
+  a first failed turn containing only this presentation history remains
+  resumable and visible in the session index. If its first durable write fails,
+  the retry reuses the already-staged snapshot instead of appending the
+  Assistant/Sidecar/error batch a second time.
+  Sessions already overwritten by an older build cannot reconstruct text that
+  was never committed to their session file.
+- Moved control-directory provisioning and legacy ACL recovery out of the
+  command hot path. Setup owns those machine changes. Native executable images
+  use a content-addressed self-healing boundary instead: ordinary admission
+  verifies stable file identity, physical cache containment, and the protected
+  hash locally, without a PowerShell subprocess. A newly installed or
+  `npm link`ed hash is atomically published once if and only if its destination
+  is missing; publication constructs and verifies owner/DACL state. Concurrent
+  publishers share the immutable winner without a global mutex, and corrupted
+  content remains fail-closed rather than being silently repaired. Protocol 9
+  requires a hash-bound protected
+  setup marker, and the native host holds its non-delete-sharing handle until
+  the target's `Started` record is durable. Setup therefore cannot rotate a
+  generation across an admitted target-start window. Protocol-8 and older marker
+  retirement is setup-only and does not impose the former 301-second admission
+  drain; a healthy fixed account is reused so existing sessions keep their
+  identity while the new protected marker is published.
+- Closed the remaining native-host termination gaps. The host consumes its
+  bootstrap and begins cancellation observation before synchronous ACL/desktop
+  preparation, binds the runner process handle before protocol decoding, and
+  waits for the winning abort path to durably publish Job-drain evidence before
+  exiting. Before the nonce-bound Resume record exists, confirmed host-tree
+  termination proves that no target ran and avoids an extra 12-second terminal
+  attestation wait.
+- Removed the cross-process command-lifetime filesystem-effect coordinator from
+  Bash, trusted text tools, and worktree lifecycle. Same-file text mutations
+  retain their narrow kernel/CAS ordering; same-path worktree calls retain a
+  process-local queue, while different worktrees and Runtime processes use
+  Git's own locks. Deprecated lease exports remain inert for source/ABI
+  migration and old coordinator files are ignored, so stale alpha state cannot
+  block a new KodaX process.
+- Made each native shell independently own its request, pipes, restricted
+  token, Job, resume/started records, and terminal proof. Windows per-command
+  `denyRead` now fails closed as structured `unsupported_policy` before doctor,
+  setup, DACL mutation, or target start: `WRITE_RESTRICTED` does not enforce a
+  restricting capability SID for reads, so claiming containment was incorrect.
+  Consequently, isolated Skill Script execution on current native protocol 9
+  is POSIX-only; `createAsrtSkillScriptRunner` rejects Windows as unavailable
+  instead of weakening its required per-command `denyRead` policy.
+  The field remains wire/API compatible, and setup alone can retire legacy
+  execution receipts and ACEs.
+  Terminal/termination proof failures now propagate through cleanup instead of
+  being reported as a successful command. Crash-left atomic-publication staging
+  files are removed only after an exact dead-PID and age proof. Network brokers
+  are reused by exact authority, retire failed readiness attempts, and use the
+  bounded five-broker pool without a one-second idle teardown race. A broker
+  remains referenced while starting or leased and detaches from the Node event
+  loop only when idle, preventing independent Runtime processes from exiting
+  with an unsettled top-level command.
+- Closed the controller-loss reuse race without waiting for unrelated commands.
+  Any broker generation implicated by target-start or terminal-proof failure is
+  removed from the reusable map immediately; existing leases finish on that old
+  generation, while the next same-authority command creates a fresh generation.
+  Detached generations remain in live-capacity accounting until their process
+  exits, so rolling replacement cannot overrun ASRT's fixed proxy ports. No
+  holder is stopped and no lock or queue is added. A caller-local timeout or
+  abort still leaves a healthy shared startup intact.
+- Capped each Windows native startup/control phase at 15 seconds without
+  replacing the caller's command deadline, matching Codex's phase-local runner
+  startup bound. If termination then proves that the nonce-bound Resume record never
+  existed, Bash reports pre-start unavailability through the existing permission
+  boundary; started or uncertain commands remain non-replayable.
+- Made simultaneous npm-linked clients self-heal one idle incompatible daemon.
+  Token-authenticated temporary upgrade identities elect one inventory leader;
+  followers detach and reconnect after the existing fenced replacement. This
+  adds no ordinary command lock, queue, permission restriction, or daemon kill
+  of active work.
+- Closed prepared-invocation leaks in foreground Bash and the public sandbox
+  SDK. Generation validation now runs immediately before native host spawn;
+  synchronous spawn failure and other proven pre-start exits remove the native
+  request and release the broker lease exactly once. Git Job-binding failure
+  keeps durable child tracking until process-tree drain is proved by background
+  recovery instead of unregistering an unknown tree.
+- Preserved an already wrapped Windows `cmd /S /C` command tail across the
+  native runner boundary. The runner no longer adds a third quote layer that
+  made a successfully attested background shell immediately exit with “path
+  not found” before running its requested program, including when a quoted
+  executable is followed by an unquoted final argument.
+- Legacy execution-scoped denyRead receipts are read only by explicit setup for
+  one-time migration. Ordinary admission never scans or repairs them.
+- Native requests also stop adding the protected artifact cache as a redundant
+  `denyWrite` root; setup generation 8 removes only provable obsolete
+  sandbox-account guards and preserves ambiguous administrator ACLs. Real
+  Windows coverage holds one command active for up to 120 seconds while a
+  second Runtime must start and complete in under 15 seconds, and exercises
+  stale control staging, broker pressure, timeout/Job drain, and parallel
+  workspace writes.
+
+### Removed
+
+- Removed the public `/repl` export `allowsAcceptEditsClassifierFallback` with
+  no replacement. The Runtime now owns the only shell-boundary route;
+  embedders must not install a second Accept Edits classifier fallback.
+- Removed the stale public `createAgentHomeShellBoundaryGuardrail` helper and
+  its options type. It imposed a second Agent Home/opaque-shell block outside
+  the Runtime-owned sandbox-first route and has no replacement.
+
 ## [0.7.96-alpha.3] - 2026-08-29
 
 ### Added