@kodax-ai/kodax 0.7.96-alpha.5 → 0.7.96-alpha.7

package/CHANGELOG.md

@@ -4,6 +4,119 @@ All notable changes to this project will be documented in this file.
 
 > Full history for versions prior to v0.7.0: [CHANGELOG_ARCHIVE.md](docs/CHANGELOG_ARCHIVE.md)
 
+## [Unreleased]
+
+## [0.7.96-alpha.7] - 2026-09-03
+
+### Fixed
+
+- Clarified the sandbox diagnostic boundary across the CLI, setup guide,
+  `kodax_manual`, and public documentation: run `kodax sandbox doctor` directly
+  in a host terminal or use `/sandbox` inside the REPL, rather than invoking the
+  host control-plane doctor through the sandbox-first Bash tool. This prevents a
+  healthy Windows sandbox from being misreported when its restricted account is
+  correctly denied access to host-owned ASRT state; shell routing and sandbox
+  permissions are unchanged.
+- Added cold-start self-healing for stale Windows sandbox setup generations.
+  A bare interactive CLI startup, including `kodax -r`, now checks the
+  installed generation before creating the REPL Runtime and reuses the existing
+  setup-only UAC boundary when migration is required. Concurrent startups
+  converge on one setup operation; followers recheck the completed generation
+  instead of installing again. Current state stays silent, and print-mode,
+  daemon, SDK, and ordinary tool execution never elevate automatically or wait
+  on the setup lock. A current marker now takes the same coarse fast path as
+  Codex; when recovery is actually required, the unchanged setup operation runs
+  in a child process while `kodax -r` and new-session startup display a live
+  elapsed-time indicator instead of freezing the last picker frame.
+- Require the setup/onboarding boundary to complete one no-side-effect native
+  target-start/exit probe before reporting Windows sandbox recovery as ready.
+  The released setup-generation-9 marker migrates in place to generation 10,
+  retaining a healthy account SID and filesystem capability nonce. This closes
+  the state where verify-only metadata looked ready while real Bash still fell
+  back to host execution, without adding a command-path lock, queue, or retry.
+
+## [0.7.96-alpha.6] - 2026-09-02
+
+### Fixed
+
+- Aligned the universal npm release audit with Windows native shell protocol
+  10. The release workflow now validates the same manifest contract emitted by
+  `build:native`, so a valid protocol-10 Windows artifact is not rejected as an
+  incompatible protocol-9 package during GitHub pre-release assembly.
+- Current native protocol 10 keeps isolated Skill Script execution POSIX-only
+  on Windows because per-command denyRead remains unsupported.
+- Moved broad Windows profile-root ACL convergence fully into versioned setup.
+  Protocol/setup generation 10 marks those roots as setup-owned; ordinary
+  admission only verifies their stable capability ACEs and returns a typed
+  setup-required error when one is missing. Command-specific small roots retain
+  additive convergence. This removes recursive `AppData` DACL propagation from
+  target start without adding a lock, queue, per-root timeout, or command retry.
+- Expanded the existing ASRT Windows proxy range to 64 ports and removed KodaX's
+  process-local broker-capacity/idle-eviction gate. Up to 32 exact network
+  authorities now rely on OS bind arbitration across Runtime processes; broker
+  pooling, reference ownership, and bounded idle cleanup remain unchanged.
+- Made explicit CLI and public SDK sandbox doctor execute one no-side-effect
+  identity probe with host fallback disabled. `ready: true` now proves a real
+  target start and successful exit, while internal startup/admission readiness
+  remains verify-only. The explicit probe can republish a missing exact-hash
+  native cache object from its pinned packaged bytes, but never runs setup or
+  repairs ACL policy. Native request diagnostics retain protocol, setup/broker
+  generation, artifact hashes, failure phase, and final sandbox failure evidence.
+- Kept unlowerable nested shell commands opaque, matching Codex's host-policy
+  boundary. Recognized `cmd` and PowerShell forms are still recursively checked,
+  explicit outer/interpreter rules still apply, and concrete critical effects
+  remain fail-closed. Command complexity never changes sandbox selection: these
+  calls remain sandbox-first, and parser uncertainty is considered by Edits or
+  Auto[LLM] only after a genuine sandbox pre-start failure reaches the host
+  boundary instead of becoming a synthetic non-overridable forbid.
+- Pinned every loaded embedded Windows native manifest to its exact immutable
+  protected-cache generation. A long-lived npm-linked CLI or SDK process now
+  reuses the already verified executable for its embedded hash before consulting
+  a mutable rebuilt `dist/native` source, so overlapping builds cannot mix a
+  TypeScript host with another native evidence generation. A genuinely new hash
+  is still published atomically, without a command lock, queue, or retry loop.
+- Stopped per-command Windows cleanup from deleting the shared private-Temp
+  parent. The native command's lifecycle/Job-drain result is now authoritative
+  before its unique Temp leaf is removed; a bounded leaf cleanup failure emits
+  a diagnostic instead of turning an already proven exit into a Tool Error.
+  This fixes the intermittent `rmdir ...\\kodax-sandbox\\<root>: EPERM` seen
+  under concurrent packaged Electron smoke without adding a lock, queue, or
+  command replay.
+- Removed the two remaining Codex-alignment gaps that could make Bash unusable.
+  Windows roots use stable read/write/deny capability ACEs, while each command
+  token activates only its authorized capabilities. Setup owns broad profile
+  grants; admission accepts already-effective setup grants read-only and never
+  downgrades or clears a capability installed for another command. Windows
+  shell `%TEMP%`/`%TMP%`/`%TMPDIR%` now point to one empty private directory per
+  command under the system temporary directory, so ordinary admission never
+  recursively rewrites the shared system Temp/AppData tree. No lock, queue, or
+  command retry was added.
+- Restored SDK/daemon host-boundary fallback by forwarding
+  `authorizeShellHostExecution` through the Coding tool-execution context. A
+  cleanup-proven pre-start sandbox failure can therefore reach the existing
+  Auto[LLM]/Exec Policy decision instead of stopping at the misleading
+  "requires a new permission decision" message.
+- Advanced the Windows SDK/daemon sandbox contract to `sandboxRuntime:11`.
+  An idle same-version daemon from an earlier npm-link build is now replaced
+  through the existing authenticated upgrade path instead of silently reusing
+  its older admission behavior; busy daemons remain fail-closed and untouched.
+- Retire a shared Windows network-broker generation when a started native host
+  proves runner/controller-path loss. Existing holders remain untouched, while
+  the next command creates a fresh generation instead of reusing a controller
+  that is already exiting and waiting for target-start attestation to time out.
+- Preserved terminal input across bare `kodax -r` session selection in the
+  compiled Bun/Windows release. A successful picker hands raw-mode ownership to
+  the next owned renderer; cancellation, preparation failure, classic REPL, and
+  final terminal cleanup retain their existing behavior.
+- Closed two portable Bash lifecycle gaps without adding a command lock or
+  retry loop. Broker-control close/error/overflow now still runs the prepared
+  request cleanup before reporting failure, and background execution is not
+  reported as started until the wrapper has an OS PID; asynchronous spawn
+  rejection therefore cannot return `PID: undefined` or leak prepared state.
+  Process settlement and output capture are attached immediately after spawn,
+  so a fast target that exits during start attestation cannot lose its output,
+  completion footer, or request cleanup.
+
 ## [0.7.96-alpha.5] - 2026-09-01
 
 ### Fixed
@@ -57,7 +170,6 @@ All notable changes to this project will be documented in this file.
   ticket but before its revision CAS. One authenticated follower resumes that
   exact durable ticket after detaching while the first client and any other
   followers only observe the owner change; active or untrusted work remains untouched.
-
 ## [0.7.96-alpha.4] - 2026-08-30
 
 ### Changed
@@ -101,11 +213,12 @@ All notable changes to this project will be documented in this file.
 - Removed the shell-tool fallback that could execute unsandboxed after native
   sandbox bootstrap and termination both failed. The boundary is now explicit,
   policy-reviewed, and single-attempt.
-- Closed administrator Exec Policy bypasses through nested Windows shells.
+- Closed administrator Exec Policy bypasses through recognized nested Windows shells.
   `cmd /C` and `/K`, PowerShell command selectors/abbreviations, and strict
-  UTF-16LE `EncodedCommand` payloads are recursively evaluated; invalid or
-  policy-opaque nested execution fails closed where an administrator forbid
-  must remain absolute.
+  UTF-16LE `EncodedCommand` payloads are recursively evaluated. Unlowerable
+  bodies remain opaque full-argv operations for exact outer policy and the
+  normal Edits/Auto[LLM] boundary; only explicit matched forbids and concrete
+  critical effects are non-bypassable.
 - Corrected the Windows shell concurrency regression at its setup/admission
   boundary. Protocol 9/setup generation 9 removes every machine-global ACL
   mutex from ordinary admission. Each canonical root receives one
@@ -123,7 +236,8 @@ All notable changes to this project will be documented in this file.
   converges NUL compatibility plus profile read capabilities. The caller
   publishes the ready marker only after the parent succeeds. No helper or
   migration overlaps ordinary admission, system TMP is not prewarmed, and
-  `sandboxRuntime` advances to `9`,
+  native protocol/setup advance to `9`, while the published Runtime capability
+  is `sandboxRuntime:10`;
   so a newly linked CLI replaces an idle daemon that still carries the setup-8
   ACL behavior and refuses a busy one instead of mixing generations.
 - Fixed first-launch policy construction when a custom `KODAX_HOME` is below the

package/README.md

@@ -60,12 +60,15 @@ After setting the variable, close the current terminal, open a new one, and run
 KodaX opens the provider/model metadata setup. Use `kodax setup` to rerun the
 flow, `kodax setup --custom` for a guided custom provider, and
 `kodax setup --help` (or REPL `/setup --help`) for paths, provider variables,
-commands, and shortcuts. Interactive setup also checks the optional ASRT sandbox once:
-Windows requests UAC during activation (an existing v2 account rotation may
-require a second confirmation); macOS/Linux report any required
-Seatbelt/bubblewrap dependencies. Declining or missing a dependency does not
-break ordinary permission handling, and normal startup will not keep reminding
-you.
+commands, and shortcuts. Interactive setup also checks the optional ASRT sandbox
+once. On Windows, a bare interactive CLI startup checks the installed setup
+generation before the REPL and uses the same UAC setup boundary to repair a
+missing or stale generation; a healthy upgrade preserves the existing sandbox
+SID. Current state stays silent, concurrent startups converge on one setup, and
+ordinary tool calls never run setup or wait on its lock. Print-mode, daemon,
+and SDK startup never trigger UAC automatically. macOS/Linux report any
+required Seatbelt/bubblewrap dependencies. Declining or missing a dependency
+does not break ordinary permission handling.
 
 > **No-Node target machines:** download a Bun-compiled single binary for Windows / macOS / Linux × x64 + arm64 from the [GitHub Releases](https://github.com/icetomoyo/KodaX/releases) page. See [docs/release.md](docs/release.md) for the build pipeline.
 
@@ -198,7 +201,11 @@ $env:ZHIPU_API_KEY="your_api_key"
 
 ### 2.1 Activate the optional sandbox
 
-`kodax setup` and first-run setup check sandbox readiness. You can inspect or
+`kodax setup` and first-run setup check sandbox readiness. A bare interactive
+Windows CLI startup (including `kodax -r`) also self-heals an absent or stale
+setup generation before creating the REPL Runtime. A current generation uses a
+marker-only fast path. If migration is needed, startup keeps a live elapsed-time
+indicator visible while the existing setup operation runs. You can inspect or
 activate it explicitly:
 
 ```bash
@@ -206,8 +213,17 @@ kodax sandbox doctor
 kodax sandbox setup
 ```
 
+Run these host control-plane commands directly in the user's terminal, not
+through KodaX's Bash tool. Inside the REPL, use `/sandbox` for read-only
+readiness diagnostics. On Windows, a doctor launched through Bash is contained
+and cannot inspect the host-owned ASRT state database, so its nested result is
+not the host readiness result.
+
 - Windows uses a restricted sandbox account and network policy. A normal
   terminal is sufficient; approve the activation UAC confirmation(s).
+  Concurrent interactive startups share only the existing setup lock: one
+  performs the repair, followers recheck its result, and shell commands remain
+  independent. Headless, print-mode, daemon, and SDK startup never open UAC.
 - macOS uses Seatbelt/`sandbox-exec` and requires ripgrep
   (`brew install ripgrep`).
 - Linux uses bubblewrap and requires `bubblewrap`, `socat`, and `ripgrep`
@@ -229,8 +245,10 @@ history. SDK embedders can use the same capability independently through
 Sandboxed shell commands inherit the host environment, including ordinary
 development credentials, and retain external network access. A fixed internal
 deny set removes KodaX/Electron execution-control variables. Writes remain
-bounded to the workspace and system temporary directory; broad host reads,
-including Agent Home and global Git configuration, are available.
+bounded to the workspace and platform temporary roots. On Windows, each command
+receives a private directory under the system temporary directory; `%TEMP%`,
+`%TMP%`, and `%TMPDIR%` point to that directory.
+Broad host reads, including Agent Home and global Git configuration, are available.
 
 For Qwen Token Plan, select `qwen-token-plan` and use its separate credential;
 `QWEN_API_KEY` does not authenticate this route:
@@ -556,7 +574,8 @@ sandbox completion is silent; only a proven pre-start boundary reaches Edits
 or Auto[LLM], and reviewer infrastructure failure blocks with a safer-route
 message after one retry. Workspace containment now permits broad host reads,
 including Agent Home, credential locations, and global Git configuration,
-while retaining workspace/system-TMP-only writes and external network. See the
+while retaining workspace/platform-Temp writes (a private per-command Temp child
+on Windows), plus external network. See the
 [v0.7.96 design](docs/features/v0.7.96.md#feature_297-codex-aligned-permission-profiles-sandbox-escalation-and-exec-policy),
 [ADR-069](docs/ADR.md#adr-069-sandbox-success-is-authority-while-host-escalation-is-a-separate-policy-boundary),
 and the [SDK permission guide](public_docs/sdk/embedder-guide.md#24-runtime-owned-permission-routing-and-plan-bridges-v0796).
@@ -740,7 +759,7 @@ permission UI, and recovers stale prepared Session tails through an
 authoritative merge. Background persistence failures are surfaced as
 diagnostics rather than hidden.
 
-**v0.7.96-alpha.5 release:** Windows shell admission now follows the
+**v0.7.96-alpha.7 release:** Windows shell admission now follows the
 Codex concurrency boundary: versioned setup performs legacy migration once,
 while ordinary admission accepts effective inherited normal-token access and
 only converges a missing exact-root restricted capability using `SET_ACCESS`
@@ -754,21 +773,33 @@ No command-lifetime or machine-global filesystem coordinator is shared
 by Bash, trusted text, worktrees, Sessions, or Runtime processes. Every native
 command has an independent request, token, control channel, and Job; matching
 network authorities share a bounded broker pool without serializing command
-lifetime. Protocol 9/setup generation 9 holds the protected setup marker until
+lifetime. Protocol 10/setup generation 10 holds the protected setup marker until
 durable target `Started`, reuses a healthy fixed sandbox account across setup
-versions, and upgrades generation-8 installations in place without replaying
-legacy ACL cleanup. Generation 8 remains the proof boundary for the one-time
+versions, and upgrades healthy generation-8 or released generation-9
+installations in place without replaying legacy ACL cleanup. Generation 8
+remains the proof boundary for the one-time
 legacy migration. Setup first publishes a protected non-ready `installing`
 marker; the elevated parent synchronously installs NUL compatibility and profile
 read capabilities, and only then does the caller atomically publish the ready
-marker. No helper or migration overlaps ordinary admission, and system TMP is
-not prewarmed. This release
-also creates its five fixed protected Agent Home directories before constructing
-a Windows policy when a custom `KODAX_HOME` sits below the system-TMP write
-grant; missing deny roots therefore cannot reject first launch, and no lock or
-ACL transaction is added. This release advertises `sandboxRuntime:9`, so a
-linked CLI cannot silently reuse a daemon that still runs the setup-8 ACL path. See the
-[v0.7.96-alpha.5 release checklist](docs/release.md#v0796-alpha5-release-preparation).
+marker. No helper or migration overlaps ordinary admission, and the shared
+system TMP root is not prewarmed or rewritten during command admission. Each
+command instead receives an empty private Temp child. Setup converges broad
+profile capabilities once; ordinary admission only verifies those roots and
+converges command-specific small roots additively. The command token activates
+only its authorized capabilities. This release advertises `sandboxRuntime:11`, so a
+linked CLI cannot silently reuse a daemon that predates this admission and recovery contract.
+Each loaded embedded native manifest also keeps its exact content-addressed
+protected-cache generation across later `npm link` rebuilds; another build
+cannot swap a long-lived process onto a mismatched native evidence schema.
+Unlowerable nested shell bodies remain opaque for exact Exec Policy plus the
+normal Edits/Auto[LLM] host boundary, rather than becoming a parser-generated
+hard forbid. Alpha.7 also self-heals a stale Windows setup
+generation before an interactive REPL starts, keeps current-marker startup on a
+fast path, shows live elapsed time only while real recovery runs, and documents
+that sandbox doctor is a host control-plane operation (`/sandbox` in the REPL or
+`kodax sandbox doctor` directly in a user terminal). npm publication remains a
+manual maintainer action. See the
+[release checklist](docs/release.md#v0796-alpha7-release-preparation).
 
 **v0.7.96-alpha.3 release:** Provider credentials are lazy, scoped,
 revocable capabilities (ADR-068). The v2 credential broker keeps Provider
@@ -1054,8 +1085,9 @@ Runtime session, not by a UI hook. Edits and Auto try the sandbox first;
 sandbox completion is final, while only a proven pre-start host boundary reaches
 Exec Policy and the Edits user decision or Auto[LLM] reviewer. Auto review has
 fixed 90/180-second attempt bounds and never falls back to Rules, Edits, or an
-automatic user prompt. Full Access skips sandbox and review but retains
-administrator policy and critical-effect denial. Runtime permission prompts
+automatic user prompt. Full Access samples the profile once per Bash call and
+runs directly on the host without sandbox or approval prompts. Explicit
+forbidden rules and the Codex dangerous-command policy still block. Runtime permission prompts
 offer opaque, exact
 allow-once/session/persistent grant suggestions; persistent grants are
 daemon-owned and revisioned. Host plan exit is exposed only when the host
@@ -1305,7 +1337,7 @@ Agent, Skill, Extension-tool authority, workspace, tool-policy, or task-store
 changes require an explicit server restart. Managed
 A2A contexts default to `~/kodax_a2a_server_workspace/<runtime-profile>/contexts/`.
 Exact Skill scripts require the opt-in isolated policy and a passing
-`kodax sandbox doctor`. On current native protocol 9 this isolated Skill Script
+`kodax sandbox doctor`. On current native protocol 10 this isolated Skill Script
 route is POSIX-only. Windows is unavailable because the route requires
 per-command `denyRead`, which the Windows `WRITE_RESTRICTED` backend rejects as
 `unsupported_policy`; `kodax sandbox setup` cannot enable it.
@@ -1566,14 +1598,14 @@ KodaX provides 4 permission profiles:
 | `plan` | Read-only planning mode | All modification tools blocked |
 | `accept-edits` | Sandbox-first edits; user decides an exact host boundary | Host-boundary operations |
 | `auto` | Sandbox-first execution; LLM reviews an exact host boundary | No automatic prompt; denied calls return a safer-route reason |
-| `full-access` | Direct host execution without sandbox or Auto review | Explicit Exec Policy `prompt` only |
+| `full-access` | Direct host execution without sandbox or approval prompts | Never prompts; explicit forbidden/dangerous policy can block |
 
 ```bash
 # In REPL, use /mode command
 /mode plan          # Switch to plan mode (read-only)
 /mode accept-edits  # Switch to accept-edits mode
 /mode auto             # Switch to Runtime-owned Auto Mode
-/mode full-access      # Direct host execution, still subject to Exec Policy
+/mode full-access      # Direct host execution without sandbox or approvals
 /auto                  # Alias for auto
 
 # Check current mode
@@ -1594,8 +1626,9 @@ KodaX provides 4 permission profiles:
 - Shift-Tab cycles `Plan -> Edits -> Auto[LLM] -> Full Access`; Shift+Enter
   inserts a newline. Legacy `auto-in-project` and Auto[RULES] state normalize
   to Auto[LLM] and are never persisted again.
-- Full Access skips sandbox and reviewer, but administrator forbids and the
-  narrow critical-effect fallback remain enforced. Use
+- Full Access skips sandbox and all approval paths. Explicit forbidden rules
+  and the Codex dangerous-command policy remain enforced; an Exec Policy
+  `prompt` rule is rejected under Never approval semantics. Use
   `kodax execpolicy check -- <command>` to inspect host policy without running it.
 - Runtime-backed prompts can offer exact `allow once`, `allow this session`,
   and `always allow` choices. Return the Runtime-issued opaque suggestion;

package/README_CN.md

@@ -58,10 +58,12 @@ kodax
 provider/model 元数据设置。使用 `kodax setup` 重新运行设置，
 使用 `kodax setup --custom` 配置自定义 provider；使用 `kodax setup --help` 或
 REPL `/setup --help` 查看完整路径、环境变量、命令和快捷键。交互式 setup 还会检查
-一次可选 ASRT sandbox：Windows 激活时会请求 UAC（已有安装进行 v2 账户 SID
-轮换时可能需要第二次确认）；
+一次可选 ASRT sandbox。Windows 裸交互 CLI 启动会在进入 REPL 前检查已安装 setup
+generation；缺失或过期时复用同一条 setup 边界并按需请求 UAC，健康升级保留现有
+sandbox SID。当前状态保持静默，并发启动只收敛到一次 setup，普通工具调用不执行
+setup、也不等待 setup 锁；print 模式、daemon 与 SDK 启动绝不会自动弹 UAC。
 macOS/Linux 会报告 Seatbelt/bubblewrap 所需依赖。拒绝 UAC 或缺少依赖不会破坏普通
-权限管理，日常启动也不会反复提醒。
+权限管理。
 
 > **不装 Node 的目标机器**：从 [GitHub Releases](https://github.com/icetomoyo/KodaX/releases) 拿 Bun 编译的单文件二进制（Win / macOS / Linux × x64 + arm64）。详见 [docs/release.md](docs/release.md)。
 
@@ -194,7 +196,8 @@ option，以及多余参数都会失败且不改变目录。目标位置是所
 成功完成时静默返回，只有可证明的启动前边界才进入 Edits 或 Auto[LLM]；reviewer
 基础设施失败重试一次后阻断并提示更安全路线，不降级权限模式。Workspace
 containment 允许包括 Agent Home、凭据位置和全局 Git 配置在内的广泛宿主读取，仍只
-允许 workspace/系统 TMP 写入，并保留外部网络。详见
+允许 workspace 与平台临时目录写入；Windows 使用系统 TMP 下的每命令私有目录，
+POSIX 保留平台 canonical Temp 根与继承变量。外部网络继续可用。详见
 [v0.7.96 FEATURE_297](docs/features/v0.7.96.md#feature_297-codex-aligned-permission-profiles-sandbox-escalation-and-exec-policy)、
 [ADR-069](docs/ADR.md#adr-069-sandbox-success-is-authority-while-host-escalation-is-a-separate-policy-boundary) 和
 [SDK 权限指南](public_docs/sdk/embedder-guide.md#24-runtime-owned-permission-routing-and-plan-bridges-v0796)。
@@ -293,7 +296,7 @@ SDK 系统代码契约更新，但没有放宽 shell/sandbox 的 fail-closed 边
 `handleRuntimePermissionRequest()` 管理 SDK 权限 UI，并在 prepared Session 尾部遇到
 `data_changed` 时通过权威 delta 合并恢复；后台持久化失败会显示为诊断，不再静默丢失。
 
-**v0.7.96-alpha.5 发布**：Windows shell 准入现在遵循 Codex 的并发边界：
+**v0.7.96-alpha.7 发布**：Windows shell 准入现在遵循 Codex 的并发边界：
 版本化 setup 只执行一次 legacy 迁移；普通准入在 capability 已存在时只读，只有缺失
 精确 root restricted capability 时才用 `SET_ACCESS` 与 DACL 回读收敛，且不等待任何
 跨进程目标互斥锁。稳定 filesystem capability SID 保留在对象上，每条命令的 token
@@ -302,20 +305,30 @@ SDK 系统代码契约更新，但没有放宽 shell/sandbox 的 fail-closed 边
 无法把 restricting SID 用于读权限；该字段继续保留跨平台 API 兼容。Bash、可信文本、worktree、
 Session 与 Runtime 进程之间不再共享命令生命周期或机器级 filesystem coordinator。
 每条 native 命令拥有独立 request、token、控制通道和 Job；相同网络权威使用有界
-broker pool，但不串行命令生命周期。protocol 9/setup generation 9 会把受保护 setup
+broker pool，但不串行命令生命周期。protocol 10/setup generation 10 会把受保护 setup
 marker 持有到目标 `Started` 已持久化；setup 版本升级复用健康的固定沙箱账户与 SID，
-已有 generation 8 安装会原地升级且不会重放 legacy ACL 清理；generation 8 继续仅作为
+健康的 generation 8 或已发布 generation 9 安装会原地升级且不会重放 legacy ACL 清理；generation 8 继续仅作为
 一次性 legacy 迁移的证明边界。setup 先发布受保护且不可执行的 `installing` marker；高权限
 父进程同步完成 NUL 兼容性与 profile 读 capability，调用方随后才原子发布 ready marker。
-不存在与普通命令准入重叠的 helper 或迁移，也不预热系统 TMP。自定义 `KODAX_HOME` 位于系统 TMP
-写入根下时，KodaX 会在构造 Windows 策略前仅创建五个固定的受保护内部目录，避免不存在的
-deny root 拒绝首次启动；该动作不增加锁、ACL 事务或命令生命周期协调。本版本广告
-`sandboxRuntime:9`，因此 npm link 后的新 CLI 不会静默复用仍运行 setup-8 ACL 路径的旧 daemon。
+不存在与普通命令准入重叠的 helper 或迁移，也不会在命令准入中预热或改写共享系统 TMP。
+每条命令会在系统临时目录下获得一个空的私有 Temp 子目录，`TEMP`/`TMP`/`TMPDIR` 均指向它；
+每个 canonical root 收敛相同的稳定 capability ACE 集合，由命令 token 只激活本次授权能力，
+且不会降级其他命令已有授权。
+setup 一次性收敛宽泛 profile 根权限，普通命令只验证这些 setup-owned 根，并仅对命令特有的
+小根做幂等增量授权。该路径不增加锁、ACL 清场或命令生命周期协调。本版本广告
+`sandboxRuntime:11`，因此 npm link 后的新 CLI 不会静默复用缺少本次准入与自愈契约的旧 daemon。
+已加载的 embedded native manifest 还会持续使用其精确内容哈希对应的受保护缓存代际；后续
+`npm link` 重建不能让长生命周期进程切换到不匹配的 native 证据格式。无法可靠降低的嵌套
+shell 内容保留为 opaque 完整 argv，由精确 Exec Policy 与正常 Edits/Auto[LLM] 宿主边界处理，
+不会仅因解析不确定就生成不可覆盖的硬拒绝。
 失败的 broker 代际会立即脱离复用但不会停止仍在运行的 holder，并继续计入固定端口容量直到进程
 实际关闭；启动/控制阶段各自以 15 秒为界，不会缩短命令执行 deadline。多个 npm-link/`kodax -r`
 客户端同时遇到空闲旧 daemon 时，会以认证临时身份选出一个替换者，其余客户端脱离后等待或续跑
-同一精确 prepared ticket；忙碌或不可信的 daemon 仍保持不动并返回结构化边界。详见
-[v0.7.96-alpha.5 发布清单](docs/release.md#v0796-alpha5-release-preparation)。
+同一精确 prepared ticket；忙碌或不可信的 daemon 仍保持不动并返回结构化边界。alpha.7 还会在
+交互式 REPL 启动前自愈陈旧的 Windows setup generation；当前 marker 走快速路径，只有实际恢复
+才显示持续更新的等待时间。sandbox doctor 明确属于宿主控制面：REPL 内使用 `/sandbox`，或直接
+在用户终端运行 `kodax sandbox doctor`，不能通过 sandbox-first Bash 工具调用。npm 发布仍由
+维护者手动执行。详见 [v0.7.96-alpha.7 发布清单](docs/release.md#v0796-alpha7-release-preparation)。
 
 **v0.7.96-alpha.3 发布**：Provider 凭据成为惰性、受限、可撤销的能力（ADR-068）。v2
 credential broker 将 Provider 密钥保留在 OS keychain，按每次 wire call、为单一封闭
@@ -511,8 +524,10 @@ CLI 也会在配置的 deadline 被终止。详见
 
 **v0.7.96 权限契约：**权限档位统一为 `Plan -> Edits -> Auto[LLM] -> Full Access`。
 Edits 与 Auto 先尝试 sandbox；成功即静默完成，只有启动前拒绝或 backend 不可用
-才在 Exec Policy 后进入用户/LLM 宿主边界。Full Access 不经过 sandbox 或 reviewer，
-但仍受管理员 forbidden 与窄 critical-effect fallback 约束。旧 `auto-in-project`
+才在 Exec Policy 后进入用户/LLM 宿主边界。每次 Bash 调用只在入口读取一次权限档位；
+Full Access 直接在宿主执行，不经过 sandbox、reviewer 或授权弹窗。显式 forbidden 规则
+与 Codex dangerous-command policy 仍可阻断，Exec Policy `prompt` 在 Never 语义下直接拒绝。
+旧 `auto-in-project`
 和 Auto[RULES] 状态只做读取兼容并归一到 Auto[LLM]；`/auto-engine` 已移除。
 Reviewer 首次 90 秒，只有 timeout/provider/无效输出会再试一次 180 秒；普通失败
 或具体高风险判断都不会自动弹授权框，而是拒绝本次操作并给 Agent 更安全绕行提示。
@@ -636,15 +651,24 @@ $env:ZHIPU_API_KEY="your_api_key"
 
 ### 2.1 激活可选 sandbox
 
-`kodax setup` 与首次安装 setup 会检查 sandbox。也可以显式检查或激活：
+`kodax setup` 与首次安装 setup 会检查 sandbox。Windows 裸交互 CLI 启动（包括
+`kodax -r`）也会在创建 REPL Runtime 前自愈缺失或过期的 setup generation。当前
+generation 只读取 marker 并立即通过；确需迁移时，启动界面会持续显示已等待时间，
+不会再把最后一帧 session picker 冻在屏幕上。也可以显式检查或激活：
 
 ```bash
 kodax sandbox doctor
 kodax sandbox setup
 ```
 
+这些宿主控制面命令应直接在用户终端中运行，不要通过 KodaX 的 Bash 工具调用。
+在 REPL 内请使用 `/sandbox` 做只读就绪诊断。Windows 上，通过 Bash 启动的 doctor
+自身也处于沙箱内，无法读取宿主持有的 ASRT 状态数据库；该嵌套结果不代表宿主就绪状态。
+
 - Windows 使用受限 sandbox 账户和网络策略。普通 Terminal 即可，按提示同意激活
-  所需的 UAC 确认；不必先以管理员身份启动 Terminal。
+  所需的 UAC 确认；不必先以管理员身份启动 Terminal。并发交互启动只共享既有 setup 锁：
+  一个进程修复，其他进程复查结果，shell 命令仍彼此独立。无头、print、daemon 和 SDK
+  启动不会自动弹 UAC。
 - macOS 使用 Seatbelt/`sandbox-exec`，需要 ripgrep：
   `brew install ripgrep`。
 - Linux 使用 bubblewrap，需要 `bubblewrap`、`socat` 和 `ripgrep`，请根据发行版用
@@ -660,7 +684,8 @@ KodaX 不会自动运行 `sudo` 或系统包管理器。Edits 与 Auto[LLM] 会
 见 [SDK sandbox 指南](public_docs/sdk/embedder-guide.md#30-standalone-sandbox-sdk-v0778)。
 
 sandbox shell 默认继承宿主环境和普通开发凭据，并允许外部网络；固定的
-KodaX/Electron 执行控制变量仍会被移除。写入范围保持在 workspace 与系统 TMP，
+KodaX/Electron 执行控制变量仍会被移除。写入范围保持在 workspace 与平台临时目录；
+Windows 使用系统 TMP 下的每命令私有目录，POSIX 保留平台 canonical Temp 根与继承变量。
 宿主读取范围则包含 Agent Home、凭据位置和真实的全局 Git 配置。
 
 Qwen Token Plan 需要选择 `qwen-token-plan` 并使用单独的凭据；`QWEN_API_KEY`
@@ -1207,7 +1232,7 @@ A2A 配置迁移与历史任务 owner 迁移是两件事。如果升级 realm-aw
 
 托管 A2A 上下文默认位于 `~/kodax_a2a_server_workspace/<runtime-profile>/contexts/`。
 精确授权的 Skill 脚本必须使用隔离策略，并通过 `kodax sandbox doctor`。
-当前 native protocol 9 下，该隔离 Skill Script 路径仅支持 POSIX；Windows 不可用，
+当前 native protocol 10 下，该隔离 Skill Script 路径仅支持 POSIX；Windows 不可用，
 因为它必须使用每命令 `denyRead`，而 Windows `WRITE_RESTRICTED` 后端会以
 `unsupported_policy` 拒绝该策略；`kodax sandbox setup` 不能启用此路径。
 

package/config-templates/config.example.jsonc

@@ -38,8 +38,9 @@
 
   // Agent harness: "ama" enables adaptive multi-agent use; "sa" forces one
   // agent. Permission profiles are "plan", "accept-edits", sandbox-first
-  // "auto", or direct-host "full-access". Full Access still honors
-  // administrator/critical policy. Exec Policy is separate:
+  // "auto", or direct-host "full-access". Full Access has no sandbox or
+  // approval prompts; explicit forbidden and Codex dangerous-command policy
+  // still block. Exec Policy is separate:
   // ~/.kodax/exec-policy.jsonc (and explicitly trusted project policy).
   // "agentMode": "ama",
   // "permissionMode": "accept-edits",

package/config-templates/integrations/a2a.example.jsonc

@@ -16,7 +16,7 @@
   // Arbitrary shell is never exposed. Skill instructions/assets need no
   // process authority. An exact checked-in scripts/... entry requires
   // process="isolated", skillScripts admission, and `kodax sandbox doctor`.
-  // On native protocol 9, isolated Skill Script is POSIX-only. Windows is
+  // On native protocol 10, isolated Skill Script is POSIX-only. Windows is
   // unavailable because its required per-command denyRead is unsupported.
   // ASRT receives no KodaX credentials or ambient ~/.srt-settings.json and its
   // script quota is observed; hostile tenants also require an outer container/VM.

package/dist/chunks/{agent-GP3D2GIO.js → agent-SV3OH5VR.js}

@@ -1,2 +1,2 @@
 // @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
-import{Aa as f,Qa as g,Sa as h,a as c,db as i,eb as j,mb as k,ya as d,za as e}from"./chunk-UR4J2NED.js";import"./chunk-MXJFGVTT.js";import"./chunk-BHWBUZBD.js";import"./chunk-LNPTCPLR.js";import"./chunk-ZD5NDQ53.js";import"./chunk-TD2PU67Z.js";import{Ob as a,Pb as b}from"./chunk-S5USXWS2.js";import"./chunk-7CPZTMYD.js";import"./chunk-ONUPGMER.js";export{e as bucketProviderPayloadSize,g as buildAutoRepoIntelligenceContext,f as checkPromiseSignal,b as cleanupIncompleteToolCalls,h as describeTransientProviderRetry,c as emitResilienceDebug,d as estimateProviderPayloadBytes,k as runKodaX,j as saveRequiredSessionSnapshot,i as saveSessionSnapshot,a as validateAndFixToolHistory};
+import{Aa as f,Qa as g,Sa as h,a as c,db as i,eb as j,mb as k,ya as d,za as e}from"./chunk-UTUAC7YQ.js";import"./chunk-MXJFGVTT.js";import"./chunk-ZXNXMFXJ.js";import"./chunk-LNPTCPLR.js";import"./chunk-ZD5NDQ53.js";import"./chunk-TD2PU67Z.js";import{Ob as a,Pb as b}from"./chunk-S5USXWS2.js";import"./chunk-7CPZTMYD.js";import"./chunk-ONUPGMER.js";export{e as bucketProviderPayloadSize,g as buildAutoRepoIntelligenceContext,f as checkPromiseSignal,b as cleanupIncompleteToolCalls,h as describeTransientProviderRetry,c as emitResilienceDebug,d as estimateProviderPayloadBytes,k as runKodaX,j as saveRequiredSessionSnapshot,i as saveSessionSnapshot,a as validateAndFixToolHistory};

package/dist/chunks/argument-completer-TTUEXPZ4.js

@@ -0,0 +1,2 @@
+// @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
+import{Ma as a,Na as b}from"./chunk-N5VUIPXE.js";import"./chunk-52FEJJMH.js";import"./chunk-O3SCJ4HT.js";import"./chunk-4IH2OTLC.js";import"./chunk-YYPZCZ6O.js";import"./chunk-UTUAC7YQ.js";import"./chunk-MXJFGVTT.js";import"./chunk-IDEPSEPH.js";import"./chunk-ZXNXMFXJ.js";import"./chunk-LNPTCPLR.js";import"./chunk-ZD5NDQ53.js";import"./chunk-TD2PU67Z.js";import"./chunk-S5USXWS2.js";import"./chunk-7CPZTMYD.js";import"./chunk-ONUPGMER.js";export{a as ArgumentCompleter,b as createArgumentCompleter};