@kodax-ai/kodax 0.7.96-beta.9 → 0.7.96-rc.10

package/CHANGELOG.md

@@ -8,6 +8,240 @@ All notable changes to this project will be documented in this file.
 
 ---
 
+## [0.7.96-rc.10] - 2026-09-22
+
+Tenth release candidate of the v0.7.96 line: Runtime shutdown now owns and
+drains the background work it starts, Edits-mode text tools no longer reject
+ordinary project files when a workspace root contains protected native state,
+and the MCP image-validation cancellation fixture is stabilized. Every rc.9
+contract is retained. npm publication remains a manual maintainer action.
+
+### Fixed
+
+- Drain owned managed terminal maintenance on Runtime close: the optional
+  repo-intelligence/artifact maintenance factory is registered with its own
+  Runtime before it can start, close stops accepting new optional maintenance
+  and waits for existing owned work before releasing Actor, executor, and
+  owner-liveness resources, so test workspaces are no longer held after
+  `Runtime.close()` returns. Run completion, successor admission, and Stop
+  stay independent of maintenance; shared repo caches are not cancelled.
+- Own and settle memory work on shutdown: Runtime registers its memory
+  setup/finalization IO and background review drains before execution; close
+  refuses new work, cancels pending review requests, and awaits
+  already-started work before releasing the owner. Managed execution finishes
+  its required durable memory finalization before publishing completion, the
+  classic finalizer owns learned-Skill outcome and binding-release IO, and
+  branch-authority setup checks cancellation before prompt/Git work. A caller
+  signal already aborted at entry settles as an interrupt terminal (defined
+  `KodaXResult`, terminal `onComplete`) instead of a raw rejection, keeping
+  the CAP-005-001b and CAP-086-003 contracts.
+- Scope trusted text transaction cache protection to the authorized canonical
+  target: Edits-mode `edit`/`write` no longer fail with `Runtime write policy
+  targets protected native text state` for ordinary project files when a
+  workspace root contains the protected native cache (for example a home
+  root). Development artifact trust still checks every authorized write root,
+  so a writable manifest cannot redefine trusted native bytes.
+
+---
+
+## [0.7.96-rc.9] - 2026-09-21
+
+Ninth release candidate of the v0.7.96 line: Windows daemon startup trees
+are reclaimed when a launcher dies before publication, contended daemon state
+replacement retries only Windows EPERM, and Windows Runtime identity probes
+gained structured, privacy-bounded lifecycle diagnostics. Every rc.8
+contract is retained. npm publication remains a manual maintainer action.
+
+### Fixed
+
+- Arbitrate daemon publication against launcher loss with a one-shot startup
+  handoff: unpublished daemon candidates and their Windows Job descendants are
+  reclaimed, while published shared services and other clients' execution are
+  preserved (Issue 337).
+- Retry only Windows EPERM while atomically publishing the same flushed
+  daemon state, under a bounded monotonic failure-path budget; permanent
+  errors and staging cleanup are preserved and ownership ordering is
+  unchanged, so concurrent JSON readers no longer break state replacement
+  (Issue 338).
+- Add structured Windows Runtime lifecycle diagnostics: `setKodaXDiagnosticSink`
+  reports boot identity, Job membership, process snapshot, start identity, and
+  exit-owner validation stages with bounded evidence and no commands,
+  environment, output, or identity values; probes, retries, and checks are
+  unchanged.
+
+---
+
+## [0.7.96-rc.8] - 2026-09-17
+
+Eighth release candidate of the v0.7.96 line: custom OpenAI-compatible
+reasoning is negotiated from `auto` with explicit-level fallback, timeout and
+cancellation errors keep their redacted semantics across scoped credentials,
+and KodaX's default `NODE_ENV` no longer leaks into user shell commands.
+Every rc.7 contract is retained. npm publication remains a manual maintainer
+action.
+
+### Fixed
+
+- Preserve native DOMException timeout/cancellation semantics, nested causes, and
+  redacted error stacks across scoped Provider credentials. Keep typed timeouts
+  recognizable through Provider wrapping and recovery even without timeout wording.
+- Negotiate custom OpenAI-compatible reasoning from `auto` by default, lower rejected
+  efforts without losing explicit disable intent, and reuse hard-rejection caches
+  across streaming and non-streaming turns. Report requested/sent effort and fallback
+  reasons to SDK hosts, retaining the original rejection across rate-limit retries;
+  preserve and replay `reasoning` and structured `reasoning_details`.
+- Keep KodaX's default `NODE_ENV` out of SDK user shell commands so `npm install`
+  and `npm ci` no longer implicitly omit devDependencies. Preserve KodaX's own
+  production mode and explicitly configured user environment values.
+
+---
+
+## [0.7.96-rc.7] - 2026-09-14
+
+Seventh release candidate of the v0.7.96 line: successful writes return
+eligible file outputs over A2A in both coding and managed execution. Every
+rc.6 contract is retained. npm publication remains a manual maintainer
+action.
+
+### Fixed
+
+- Return eligible A2A files from successful writes in both coding and managed execution,
+  independently of conversation compaction and the memory artifact ledger. Preserve existing
+  publication limits and legacy executors; recognize HTML/HTM outputs as `text/html`.
+
+---
+
+## [0.7.96-rc.6] - 2026-09-14
+
+Sixth release candidate of the v0.7.96 line: Windows exit delays from
+unresolved historical Shell records are reduced while unknown cleanup
+outcomes and Run recovery evidence are preserved. Every rc.5 contract is
+retained. npm publication remains a manual maintainer action.
+
+### Fixed
+
+- Reduce Windows exit delays from unresolved historical Shell records. Skip process-tree
+  queries only when every retained target is definitively absent; preserve unknown cleanup
+  outcomes and Run recovery evidence.
+- Reuse the Windows termination process for its first post-termination snapshot. Retain
+  exact process identity checks, fresh verification and retries when cleanup is uncertain.
+
+---
+
+## [0.7.96-rc.5] - 2026-09-14
+
+Fifth release candidate of the v0.7.96 line: corrupt extracted images no
+longer poison subsequent model requests (Issue 335), and residual native
+request-content errors are diagnosed with an evidence-backed text-only
+request. Every rc.4 contract is retained. npm publication remains a manual
+maintainer action.
+
+### Fixed
+
+- Prevent corrupt extracted images from poisoning subsequent model requests (Issue 335).
+  Prepare read/MCP image bytes at receipt and historical images at run admission; reuse them
+  across Anthropic/OpenAI requests, retries and compaction without repeatedly reading files.
+  Preserve valid bytes, text, tool status and original history. Revalidate on new reads/resume,
+  correct stale MIME, keep diagnostics aligned and preserve nested upstream error codes.
+  Cancel preparation promptly while preserving text-only scheduling and direct SDK compatibility.
+  Reuse ingress validation verdicts and include decoder queue waits in the existing time budget.
+  Avoid unused image snapshots for custom Runner callbacks and ACP transports.
+  Decoder unavailability retains the existing image path with an explicit notice.
+  Expose `validateImageBytes` through the LLM and media SDK; include the WASM codec in Bun
+  binaries and release archives.
+- Diagnose residual native request-content errors with the current Agent using a text-only
+  request and the existing output/attempt budgets. Apply only evidence-backed request-view
+  repairs, preserve completed and unknown-execution tool records, retain later valid reasoning,
+  stop on new input/cancellation and allow one
+  diagnostic plus one retry. Preserve precise image evidence through credential redaction;
+  authentication, quota and transport failures keep their existing recovery behavior.
+  Release settled image-validation contexts without retaining credentials or image snapshots.
+
+---
+
+## [0.7.96-rc.4] - 2026-09-13
+
+Fourth release candidate of the v0.7.96 line: new Session startup no longer
+scans unrelated Run event logs, and lost or corrupt event-sequence cursors
+recover beyond stale cross-Runtime caches (Issue 334). Every rc.3 contract is
+retained. npm publication remains a manual maintainer action.
+
+### Fixed
+
+- Initialize new Session event journals at sequence zero instead of scanning and
+  parsing unrelated Run logs. This removes a synchronous startup stall that could
+  also cause concurrent Session history reads to exceed their 15-second timeout.
+- Bind cached event sequence floors to their journal epoch. When an existing
+  sequence file is missing or corrupt, recover the durable log maximum even if
+  another Runtime has left this process with an older cached floor, preventing
+  duplicate event sequences and lost replay progress.
+- Populate both Full RepoIntel routing and preturn caches during startup prewarm
+  from the same worker result, avoiding a repeated routing query after the short
+  inner cache expires while preserving the complete Full context.
+
+---
+
+## [0.7.96-rc.3] - 2026-09-13
+
+Third release candidate of the v0.7.96 line: daemon capabilities are aligned
+and accepted Shell Stops become recoverable while process-tree cleanup is
+unknown, with shell results keeping their status and output. Every rc.2
+contract is retained. npm publication remains a manual maintainer action.
+
+### Fixed
+
+- Project the owning Runtime's `sessionCancellation` and `toolInvocation`
+  capabilities through the default daemon handshake and capability query.
+  Explicit tool execution retains normal permissions, events and persistence.
+- Keep an accepted Shell Stop unconfirmed while process-tree cleanup is unknown.
+  Retry cleanup against the original Run, retain exact recovery references across
+  owner restarts, and preserve known descendants when refreshing process identities.
+- Preserve Run cleanup evidence during generic process sweeps, and propagate
+  the owning Run's Shell cleanup registration through read/write child executors.
+- Keep the cancelled/timeout status and captured output in shell results when
+  process-tree cleanup cannot be confirmed: the unconfirmed-cleanup note is
+  appended to the command outcome instead of replacing it. The background
+  stop owns native termination, so cleanup never terminates the same
+  process tree twice.
+
+---
+
+## [0.7.96-rc.2] - 2026-09-12
+
+Second release candidate of the v0.7.96 line: a stale first Session Stop
+request bound to an already terminal Run is rejected atomically before a new
+Stop frontier is published. Every rc.1 contract is retained. npm publication
+remains a manual maintainer action.
+
+### Fixed
+
+- Reject first `sessions.cancel` requests bound to a terminal Run before
+  publishing a cancellation frontier, preventing delayed requests from stopping
+  successor Runs. Accepted requests retain normal and post-restart replay.
+
+---
+
+## [0.7.96-rc.1] - 2026-09-12
+
+First release candidate of the v0.7.96 line: trusted text authority is
+unified across Runtime Sessions and direct SDK entries, and provider requests
+carry live permission facts. Every beta.9 contract is retained. npm
+publication remains a manual maintainer action.
+
+### Fixed
+
+- Unify trusted text authority across Runtime Sessions and direct SDK entries.
+  Full Access now reaches native text transactions through `runKodaX`,
+  `runManagedTask`, and each `KodaXClient.send`. Auto-approved concrete text
+  calls can write their exact external target, including portable `tool_call`
+  dispatch, without granting a directory or reusing approval across operations
+  or Runs. Explicit denials and native integrity checks remain enforced.
+- Include live host permission facts in direct and managed provider requests,
+  including retries, independently of configuration defaults and prompt
+  overrides. Runtime permission capability 6 fences older daemon authority.
+
+---
+
 ## [0.7.96-beta.9] - 2026-09-12
 
 Ninth beta pre-release of the v0.7.96 line, carrying FEATURE_299 (unified

package/README.md

@@ -297,6 +297,8 @@ a new one before running `kodax`.
 `userAgentMode` defaults to `"compat"`, which sends `KodaX` instead of the official SDK User-Agent. Switch it to `"sdk"` only when your gateway expects the upstream SDK header.
 For custom reasoning models, `reasoning: { efforts, default }` is the preferred v0.7.57 shape; use `"reasoning": "none"` for models without thinking capability. SDK hosts should render effort pickers from `reasoningProfile.supportedEfforts` / `defaultEffort` rather than assuming a fixed five-option ladder.
 
+An undeclared OpenAI-compatible reasoning profile means capability is unknown. Omitted effort uses `auto`: the declared default wins, otherwise KodaX tries `max` and lowers only after explicit parameter/value rejection. `none` attempts to disable reasoning, then tries the lowest available thinking effort if disabling is rejected. SDK hosts receive `onReasoningResolved` with the requested effort, sent effort, fallback reasons, and `verified: false`; request acceptance does not prove that the model honored the strength. See [reasoning negotiation](docs/DD.md#23-custom-openai-compatible-reasoning) for cache and replay contracts.
+
 #### OpenAI-compatible reasoning providers
 
 Some OpenAI-compatible reasoning models require KodaX to replay the previous assistant turn's `reasoning_content` on later requests. DeepSeek V4 thinking mode is the known load-bearing case. Built-in DeepSeek already opts in; custom providers must say so explicitly:
@@ -784,6 +786,101 @@ provider's model, REPL `/compact` clears the UI only after a durable save, and
 successful reports carry bounded `summaryRequests` plus `commitMs` per
 physical summary call.
 
+**v0.7.96-rc.10 release:** Tenth release candidate of the v0.7.96 line.
+Runtime shutdown owns and drains the background work it starts: managed
+terminal maintenance and memory setup/finalization IO plus background review
+drains are registered with the owning Runtime, close refuses new work and
+awaits already-started work before releasing resources, and managed execution
+finishes its durable memory finalization before publishing completion.
+Edits-mode `edit`/`write` no longer reject ordinary project files when a
+workspace root contains protected native state: trusted text transaction
+cache protection targets only the authorized canonical file while
+development artifact trust still checks every authorized write root. Every
+rc.9 contract is retained.
+
+**v0.7.96-rc.9 release:** Ninth release candidate of the v0.7.96 line.
+Arbitrates daemon publication against launcher loss with a one-shot startup
+handoff: unpublished Windows daemon startup trees and their Job descendants
+are reclaimed while published shared services stay untouched (Issue 337).
+Windows daemon state replacement retries only contended EPERM while
+atomically publishing the same flushed state under a bounded failure budget,
+so concurrent JSON readers no longer break replacement (Issue 338). Windows
+Runtime identity probes emit structured lifecycle diagnostics through
+`setKodaXDiagnosticSink` with bounded evidence and no commands, environment,
+output, or identity values. Every rc.8 contract is retained.
+
+**v0.7.96-rc.8 release:** Eighth release candidate of the v0.7.96 line.
+Custom OpenAI-compatible reasoning is negotiated from `auto`: rejected
+efforts lower through explicit levels without losing disable intent,
+hard-rejection caches span streaming and non-streaming turns, and
+requested/sent effort plus fallback reasons reach SDK hosts while
+`reasoning` and `reasoning_details` replay only to the same endpoint and
+model. Timeout and cancellation errors keep native DOMException semantics,
+nested causes, and redacted stacks across scoped credentials. KodaX's
+default `NODE_ENV` no longer reaches user shell commands, so `npm install`
+and `npm ci` keep devDependencies. Every rc.7 contract is retained.
+
+**v0.7.96-rc.7 release:** Seventh release candidate of the v0.7.96 line.
+Successful writes return eligible file outputs over A2A in both coding and
+managed execution, independently of conversation compaction and the memory
+artifact ledger, with existing publication limits and legacy executors
+preserved; HTML/HTM outputs are recognized as `text/html`. Every rc.6
+contract is retained.
+
+**v0.7.96-rc.6 release:** Sixth release candidate of the v0.7.96 line.
+Reduces Windows exit delays from unresolved historical Shell records:
+process-tree queries are skipped only when every retained target is
+definitively absent, unknown cleanup outcomes and Run recovery evidence are
+preserved, and the Windows termination process is reused for its first
+post-termination snapshot with exact identity checks and fresh verification
+when cleanup is uncertain. Every rc.5 contract is retained.
+
+**v0.7.96-rc.5 release:** Fifth release candidate of the v0.7.96 line,
+fixing Issue 335. Read and MCP image bytes are validated at receipt and
+historical images are prepared at run admission, reused across
+Anthropic/OpenAI requests, retries, and compaction; confirmed corrupt images
+become actionable text while valid bytes, tool status, and original history
+are preserved. `validateImageBytes` ships through the LLM and media SDK, and
+the WASM codec is included in Bun binaries and release archives. Residual
+native request-content errors are diagnosed with one evidence-backed
+text-only request plus one retry. Every rc.4 contract is retained.
+
+**v0.7.96-rc.4 release:** Fourth release candidate of the v0.7.96 line,
+fixing Issue 334. New Session event journals initialize at sequence zero
+instead of scanning unrelated Run logs, removing a synchronous startup stall
+that could push concurrent Session history reads past their 15-second
+timeout. Cached sequence floors are epoch-aware, and a missing or corrupt
+sequence file recovers the durable log maximum beyond a stale cross-Runtime
+cache, preventing duplicate event sequences and lost replay progress.
+Startup prewarm serves routing and preturn from the same complete result.
+Every rc.3 contract is retained.
+
+**v0.7.96-rc.3 release:** Third release candidate of the v0.7.96 line.
+Aligns the daemon `sessionCancellation` and `toolInvocation` capabilities and
+makes accepted Shell Stops recoverable while process-tree cleanup is unknown:
+cleanup retries target the original Run, recovery references survive owner
+restarts, and shell results keep their cancelled/timeout status and captured
+output with the unconfirmed-cleanup note appended. Every rc.2 contract is
+retained.
+
+**v0.7.96-rc.2 release:** Second release candidate of the v0.7.96 line. A
+first Session Stop request bound to an already terminal `expectedRunId` is
+rejected atomically before a new Stop frontier is published — typed
+`code: 'conflict'`, `denialSource: 'stale_run'`, `retryable: false` — so a
+delayed request cannot stop successor Runs. Already accepted requests stay
+replayable, including after Runtime restart. Every rc.1 contract is retained.
+
+**v0.7.96-rc.1 release:** First release candidate of the v0.7.96 line.
+Unifies trusted text authority across Runtime Sessions and direct SDK
+entries: Full Access reaches native text transactions through `runKodaX`,
+`runManagedTask`, and each `KodaXClient.send`; auto-approved concrete text
+calls write their exact external target, including portable `tool_call`
+dispatch, without granting a directory or reusing approval across operations
+or Runs; explicit denials and native integrity checks remain enforced.
+Direct and managed provider requests carry live host permission facts,
+refreshed on retries, and runtime permission capability 6 fences older
+daemon authority.
+
 **v0.7.96-beta.9 release:** Ships FEATURE_299 — unified Stop, Full Access
 and extension execution contracts. Owned Run controls and atomic Session
 Stop work independently of file locks across direct CLI, SDK, daemon, and
@@ -860,7 +957,7 @@ requests, preserves structured Child Agent Provider failures, honors exact
 run-scoped credential verification, and omits empty `tools` arrays for strict
 vLLM gateways (Issues 329-332). npm publication remains a
 manual maintainer action. See the
-[release checklist](docs/release.md#v0796-beta9-release-preparation).
+[release checklist](docs/release.md#v0796-rc9-release-preparation).
 
 **v0.7.96-alpha.3 release:** Provider credentials are lazy, scoped,
 revocable capabilities (ADR-068). The v2 credential broker keeps Provider

package/README_CN.md

@@ -296,6 +296,74 @@ SDK 系统代码契约更新，但没有放宽 shell/sandbox 的 fail-closed 边
 `handleRuntimePermissionRequest()` 管理 SDK 权限 UI，并在 prepared Session 尾部遇到
 `data_changed` 时通过权威 delta 合并恢复；后台持久化失败会显示为诊断，不再静默丢失。
 
+**v0.7.96-rc.10 发布**：v0.7.96 线第十个发布候选。Runtime 关闭时拥有并
+排空自己启动的后台工作：托管终端维护与内存 setup/finalization IO 及后台
+review 排空都注册到所属 Runtime，close 拒绝新工作并等待已开始的工作完成后
+才释放资源，托管执行在发布完成前先落地持久内存 finalization。当工作区根
+包含受保护原生状态时，Edits 模式的 `edit`/`write` 不再拒绝普通项目文件：
+受信文本事务的缓存保护只针对授权的规范化目标文件，而开发工件信任仍检查
+全部授权可写根。所有 rc.9 契约全部保留。
+
+**v0.7.96-rc.9 发布**：v0.7.96 线第九个发布候选。以一次性启动交接仲裁
+daemon 发布与 launcher 失联：未发布的 Windows daemon 启动树及其 Job 后代被
+回收，已发布的共享服务不受影响（Issue 337）。Windows daemon 状态替换在有界
+失败预算下只对竞争性 EPERM 重试，原子发布同一份已 flush 状态，并发 JSON
+读取者不再破坏替换（Issue 338）。Windows Runtime 身份探测通过
+`setKodaXDiagnosticSink` 输出结构化生命周期诊断，证据有界且不含命令、环境
+变量、输出或身份值。所有 rc.8 契约全部保留。
+
+**v0.7.96-rc.8 发布**：v0.7.96 线第八个发布候选。自定义 OpenAI 兼容推理从
+`auto` 开始协商：被拒绝的 effort 沿显式档位降级且不丢失显式禁用意图，硬拒绝
+缓存跨流式与非流式回合复用，请求/实际发送的 effort 与回退原因上报给 SDK 宿主，
+`reasoning` 与结构化 `reasoning_details` 只向同一 endpoint 与模型重放。超时与
+取消错误跨受限 Provider 凭据保持原生 DOMException 语义、嵌套原因与脱敏栈。
+KodaX 默认 `NODE_ENV` 不再进入用户 shell 命令，`npm install` 与 `npm ci`
+不再隐式省略 devDependencies。所有 rc.7 契约全部保留。
+
+**v0.7.96-rc.7 发布**：v0.7.96 线第七个发布候选。成功的写入在 coding 与
+managed 两条执行路径上都通过 A2A 返回符合条件的文件输出，不再依赖对话压缩
+与 memory 工件台账；既有发布限制与 legacy executor 全部保留，HTML/HTM 输出
+识别为 `text/html`。所有 rc.6 契约全部保留。
+
+**v0.7.96-rc.6 发布**：v0.7.96 线第六个发布候选。降低未决历史 Shell 记录
+导致的 Windows 退出延迟：仅当所有保留目标都确定不存在时才跳过进程树查询，
+未知的清理结果与 Run 恢复证据全部保留；Windows 终止进程复用于首次终止后
+快照，清理不确定时保留精确的进程身份校验、全新验证与重试。所有 rc.5 契约
+全部保留。
+
+**v0.7.96-rc.5 发布**：v0.7.96 线第五个发布候选，修复 Issue 335。`read` 与
+MCP 图片字节在接收时校验，历史图片在 Run 准入时准备，跨 Anthropic/OpenAI
+请求、重试与压缩复用；确认损坏的图片替换为可执行的文字说明，正常图片字节、
+工具状态与原始历史全部保留。`validateImageBytes` 通过 LLM 与 media SDK 暴露，
+WASM 解码器随 Bun 二进制与发布归档附带。残留的原生请求内容错误用一次
+有证据支撑的纯文本请求加一次重试进行诊断。所有 rc.4 契约全部保留。
+
+**v0.7.96-rc.4 发布**：v0.7.96 线第四个发布候选，修复 Issue 334。新建
+Session 事件日志从序列零初始化，不再扫描无关的 Run 日志——消除可能把并发
+Session 历史读取拖过 15 秒超时的同步启动停顿。缓存序列下限按 journal epoch
+绑定；序列文件缺失或损坏时，即使另一个 Runtime 留下了更旧的缓存下限，也会
+恢复持久日志最大值，避免重复事件序列与丢失重放进度。启动预热让路由与
+preturn 共用同一完整结果。所有 rc.3 契约全部保留。
+
+**v0.7.96-rc.3 发布**：v0.7.96 线第三个发布候选。对齐 daemon 的
+`sessionCancellation` 与 `toolInvocation` capability，并让已受理的 Shell Stop
+在进程树清理未知时保持可恢复：清理重试仍针对原 Run，恢复引用跨宿主重启保留，
+shell 结果保留其取消/超时状态与已捕获输出，未确认清理说明以附加形式呈现。
+所有 rc.2 契约全部保留。
+
+**v0.7.96-rc.2 发布**：v0.7.96 线第二个发布候选。绑定到已终态 `expectedRunId`
+的首次 Session Stop 请求会在发布新 Stop frontier 之前被原子拒绝——类型为
+`code: 'conflict'`、`denialSource: 'stale_run'`、`retryable: false`——迟到的
+请求因此无法停止后继 Run。已受理的请求保持可重放，包括 Runtime 重启之后。
+所有 rc.1 契约全部保留。
+
+**v0.7.96-rc.1 发布**：v0.7.96 线首个发布候选。统一 Runtime Session 与直接
+SDK 入口的可信文本授权：Full Access 通过 `runKodaX`、`runManagedTask` 与每个
+`KodaXClient.send` 覆盖原生文本事务；自动批准的具体文本调用可写入其确切外部
+目标（包括可移植的 `tool_call` 分发），但不授予目录权限，也不会跨操作或跨 Run
+复用批准；显式拒绝与原生完整性校验继续生效。直接与托管 provider 请求携带实时
+宿主权限事实并在重试时刷新，runtime 权限 capability 6 阻止旧 daemon 提供该授权。
+
 **v0.7.96-beta.9 发布**：交付 FEATURE_299——统一 Stop、Full Access 与扩展
 执行契约。owned Run 控制与原子 Session Stop 不依赖文件锁，跨直接 CLI、SDK、
 daemon 与 ACP 宿主在单一"受理 vs 确认"Stop 契约下工作。Full Access 直接在
@@ -369,8 +437,7 @@ native 文本权威改在摘要固定的 `manylinux_2_28` 构建器中编译，
 scope 在 SDK、Agent 摘要、CLI 与 Runtime Worker 请求间共享，保留结构化的 Child Agent Provider
 失败信息，精确遵循 run-scoped 凭据校验，并为严格 vLLM 网关省略空 `tools` 数组（Issues 329-332）。
 npm 发布仍由
-npm 发布仍由
-维护者手动执行。详见 [v0.7.96-beta.9 发布清单](docs/release.md#v0796-beta9-release-preparation)。
+维护者手动执行。详见 [v0.7.96-rc.10 发布清单](docs/release.md#v0796-rc10-release-preparation)。
 
 **v0.7.96-alpha.3 发布**：Provider 凭据成为惰性、受限、可撤销的能力（ADR-068）。v2
 credential broker 将 Provider 密钥保留在 OS keychain，按每次 wire call、为单一封闭
@@ -841,6 +908,8 @@ import { createMemoryAgent } from '@kodax-ai/kodax/experimental-memory'; // opt-
 
 自定义 reasoning 模型优先使用 v0.7.57 的 `reasoning: { efforts, default }`；无 thinking 能力的模型使用 `"reasoning": "none"`。SDK 宿主的 effort 选择器应从 `reasoningProfile.supportedEfforts` / `defaultEffort` 动态生成，不要假定固定五档。
 
+OpenAI-compatible provider 未声明 reasoning profile 表示能力未知。未设置 effort 时使用 `auto`：优先采用已声明默认档，否则从 `max` 开始，仅在明确的参数／档位拒绝后逐档降低。`none` 会尝试关闭；关闭被拒绝后尝试最低可用思考档。SDK 宿主通过 `onReasoningResolved` 收到用户意图、实际发送档位、回退原因和 `verified: false`；请求成功不代表模型已按该强度执行。缓存和推理数据回传规则见[详细设计](docs/DD.md#23-custom-openai-compatible-reasoning)。
+
 #### OpenAI 兼容推理模型
 
 部分 OpenAI-compatible 推理模型要求多轮请求时回放上一轮 assistant 的 `reasoning_content`。DeepSeek V4 thinking mode 是已知必须开启的场景；内置 DeepSeek provider 已经默认开启，但自定义 provider 需要显式配置：

package/dist/chunks/{agent-4LNAAVUB.js → agent-SIFLR4F3.js}

@@ -1,2 +1,2 @@
 // @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
-import{Ka as g,Ma as h,a as c,ga as d,ha as e,ia as f,kb as i,lb as j,tb as k}from"./chunk-7QJ4JHJE.js";import"./chunk-JA2DY4EC.js";import"./chunk-ESDWXMTG.js";import"./chunk-5Z7OAIPW.js";import"./chunk-NYKZ6Z2Q.js";import{Ob as a,Pb as b}from"./chunk-P472TI5T.js";import"./chunk-WXBRPZMI.js";import"./chunk-V7ZTP5SV.js";import"./chunk-ONUPGMER.js";export{e as bucketProviderPayloadSize,g as buildAutoRepoIntelligenceContext,f as checkPromiseSignal,b as cleanupIncompleteToolCalls,h as describeTransientProviderRetry,c as emitResilienceDebug,d as estimateProviderPayloadBytes,k as runKodaX,j as saveRequiredSessionSnapshot,i as saveSessionSnapshot,a as validateAndFixToolHistory};
+import{Ab as k,Qa as g,Sa as h,a as c,la as d,ma as e,na as f,rb as i,sb as j}from"./chunk-54LYU5IB.js";import"./chunk-756FJMN2.js";import"./chunk-67FTLDKF.js";import"./chunk-5MKGSX3I.js";import"./chunk-DTO7YOGG.js";import{Pb as a,Qb as b}from"./chunk-5DJN3YKJ.js";import"./chunk-WHQCTZKI.js";import"./chunk-W5XGIRQQ.js";import"./chunk-ONUPGMER.js";export{e as bucketProviderPayloadSize,g as buildAutoRepoIntelligenceContext,f as checkPromiseSignal,b as cleanupIncompleteToolCalls,h as describeTransientProviderRetry,c as emitResilienceDebug,d as estimateProviderPayloadBytes,k as runKodaX,j as saveRequiredSessionSnapshot,i as saveSessionSnapshot,a as validateAndFixToolHistory};

package/dist/chunks/argument-completer-OPZOG6XS.js

@@ -0,0 +1,2 @@
+// @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
+import{Ma as a,Na as b}from"./chunk-UYRXWZL3.js";import"./chunk-NCNPYSVW.js";import"./chunk-NDYG5DGT.js";import"./chunk-BNQSGCFN.js";import"./chunk-NGD36O5G.js";import"./chunk-JMCQ6GNW.js";import"./chunk-54LYU5IB.js";import"./chunk-756FJMN2.js";import"./chunk-67FTLDKF.js";import"./chunk-5MKGSX3I.js";import"./chunk-DTO7YOGG.js";import"./chunk-5DJN3YKJ.js";import"./chunk-WHQCTZKI.js";import"./chunk-W5XGIRQQ.js";import"./chunk-ONUPGMER.js";export{a as ArgumentCompleter,b as createArgumentCompleter};

package/dist/chunks/chunk-3KJZV7C4.js

@@ -0,0 +1,2 @@
+// @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
+import{g,i as x,j as v}from"./chunk-UBMU25PI.js";import{c as T}from"./chunk-67FTLDKF.js";import{a as d}from"./chunk-ONUPGMER.js";import u from"node:fs";import{createHash as C}from"node:crypto";import{createRequire as O}from"node:module";import l from"node:path";var h=5;var E=O(import.meta.url),S=3e4,f;function P(t,o){let e=t.replaceAll("/","\\"),a=e.toLowerCase(),r=e.slice(3),c=(r===""?[]:r.split("\\")).some(n=>{let i=n.split(".",1)[0].toUpperCase(),p=["CON","PRN","AUX","NUL","CONIN$","CONOUT$"].includes(i)||/^(?:COM|LPT)[1-9¹²³]$/.test(i);return n===""||n==="."||n===".."||n.endsWith(".")||n.endsWith(" ")||/[\u0000-\u001f<>"|?*]/.test(n)||/~[0-9¹²³]/.test(n)||p});if(t.includes("\0")||e.startsWith("\\\\")||a.startsWith("\\??\\")||a.startsWith("\\device\\")||a.startsWith("\\global??\\")||a.startsWith("globalroot\\")||!/^[A-Za-z]:\\/.test(e)||e.slice(2).includes(":")||c)throw new T({code:"text_mutation_unsafe_path",path:t,message:`Trusted text mutation ${o} must use a local drive-absolute path; UNC and device namespaces are denied: ${t}`})}d(P,"assertLocalDriveAbsolutePath");function m(t,o){if(process.platform==="win32"){P(t,o);return}if(t.includes("\0")||!l.isAbsolute(t)||t.startsWith("//"))throw new T({code:"text_mutation_unsafe_path",path:t,message:`Trusted text mutation ${o} must use a local absolute path: ${t}`})}d(m,"assertSupportedAbsolutePath");function y(t,o){let e=l.relative(t,o);return e===""||!e.startsWith("..")&&!l.isAbsolute(e)}d(y,"sameOrInside");function A(t){let o=new Map;for(let e of t){let a=l.resolve(e),r=process.platform==="win32"?a.toLowerCase():a;o.has(r)||o.set(r,a)}return[...o.values()].sort((e,a)=>a.length-e.length)}d(A,"normalizedRootCandidates");function w(t,o,e=!1){m(t,"target");for(let n of o)m(n,"write root");let a=l.resolve(t),r=[...A(o)];if(e){let n=l.dirname(a);for(;!u.existsSync(n);){let i=l.dirname(n);if(i===n)break;n=i}r.unshift(n)}let s=r.find(n=>n!==a&&y(n,a)),c=d(n=>{try{if(!u.lstatSync(n).isDirectory())throw new Error("write root is not a directory");return u.realpathSync.native(n)}catch(i){throw new T({code:"text_mutation_unsafe_path",path:t,message:`Trusted text mutation write root is unavailable: ${n}`,cause:i})}},"canonicalizeRoot");if(s!==void 0){let n=c(s);return{canonicalRoot:n,canonicalTarget:l.join(n,l.relative(s,a))}}for(let n of r){let i=c(n);if(i!==a&&y(i,a))return{canonicalRoot:i,canonicalTarget:a}}throw new T({code:"text_mutation_policy_denied",path:t,message:`Trusted text mutation target is outside the Runtime write roots: ${t}`})}d(w,"authorizeTarget");function _(t,o=t){if(g(t),f!==void 0)return f;let e=v(import.meta.url,h,t,o),a=K(e);return f=X(a),f}d(_,"loadNativeBinding");function X(t){if(typeof t.textTransactionProtocol!="function"||typeof t.TrustedTextTransactionRoot!="function"||t.textTransactionProtocol()!==h)throw new Error(`The KodaX trusted text transaction binding must implement protocol ${h}.`);return t}d(X,"validateNativeBinding");function K(t){if(process.platform==="win32")return E(t);let o=u.openSync(t,u.constants.O_RDONLY|u.constants.O_NOFOLLOW);try{let e=u.fstatSync(o);if(!e.isFile()||e.nlink!==1||e.size>64*1024*1024)throw new Error("The protected native text binding has an unsafe identity.");let a=l.basename(l.dirname(t)).toLowerCase(),r=u.readFileSync(o),s=C("sha256").update(r).digest("hex");if(!/^[0-9a-f]{64}$/.test(a)||s!==a)throw new Error("The protected native text binding changed after provisioning.");let c={exports:{}},n=process.platform==="linux"?`/proc/self/fd/${o}`:`/dev/fd/${o}`;return process.dlopen(c,n),c.exports}finally{u.closeSync(o)}}d(K,"loadNativeBindingFile");function N(t,o,e){return process.platform==="win32"?new t.TrustedTextTransactionRoot(o,void 0,e):new t.TrustedTextTransactionRoot(o,x(),e)}d(N,"createNativeRoot");function k(t){switch(t){case"invalid_path":case"reparse_point":case"hard_link":return"text_mutation_unsafe_path";case"unauthorized_path":return"text_mutation_policy_denied";case"remote_filesystem":case"unsupported_filesystem":case"unsupported_platform":return"text_mutation_unsupported_filesystem";case"contended":return"text_mutation_contended";case"stale":return"text_mutation_stale";case"metadata_preservation":return"text_mutation_metadata_preservation_failed";default:return"text_mutation_io_failed"}}d(k,"mappedNativeErrorCode");function R(t,o){if(o instanceof T)throw o;let e=o instanceof Error?o.message:String(o),a="KODAX_TEXT_TRANSACTION:",r=e.indexOf(a),s={};if(r>=0)try{let c=JSON.parse(e.slice(r+a.length));c!==null&&typeof c=="object"&&!Array.isArray(c)&&(s=c)}catch{s={}}throw new T({code:k(s.code),path:t,message:s.message??e,...typeof s.os_code=="number"?{osCode:s.os_code}:{},cause:o})}d(R,"translateNativeError");function B(t){return{state:t.state,content:t.content,revision:t.revision,slot:t.slotId,canonicalPath:t.canonicalPath}}d(B,"publicSnapshot");function L(t,o,e){if(e.status==="stale"){if(typeof e.currentRevision!="string")throw new Error("Native text transaction returned a stale result without a revision.");return{status:"stale",currentRevision:e.currentRevision}}if(typeof e.slotId!="string"||typeof e.preContent!="string"||typeof e.preRevision!="string"||typeof e.postRevision!="string")throw new Error("Native text transaction returned an incomplete commit receipt.");let a={before:{state:e.preRevision.startsWith("missing:")?"missing":"present",content:e.preContent,revision:e.preRevision,slot:e.slotId,canonicalPath:t},after:{state:"present",content:o,revision:e.postRevision,slot:e.slotId,canonicalPath:t},recoveredAbandonedLock:e.abandonedLock===!0};if(e.status==="committed_uncertain"){if(typeof e.message!="string"||e.message==="")throw new Error("Native text transaction returned an uncertain commit without a reason.");return{status:"committed_uncertain",...a,reason:e.message}}return{status:"written",...a}}d(L,"requireWrittenOutcome");function F(t,o,e=()=>!1,a){return{async snapshot(r){if(r.signal?.aborted)throw r.signal.reason;m(r.path,"target");let s=e(),c=a?.(r.toolCall,r.path,"snapshot")===!0,n=w(r.path,t(),s||c);o(n.canonicalTarget),g([n.canonicalTarget]);try{let i=_([n.canonicalTarget],t()),p=N(i,n.canonicalRoot,s);return B(await p.snapshot(n.canonicalTarget))}catch(i){R(n.canonicalTarget,i)}},async commit(r){if(r.signal?.aborted)throw r.signal.reason;m(r.path,"target");let s=e(),c=a?.(r.toolCall,r.path,"commit")===!0,n=w(r.path,t(),s||c);o(n.canonicalTarget),g([n.canonicalTarget]);try{let i=_([n.canonicalTarget],t()),b=await N(i,n.canonicalRoot,s).commit(n.canonicalTarget,r.expectedRevision,r.content,r.createParentDirectories,S);return L(n.canonicalTarget,r.content,b)}catch(i){R(n.canonicalTarget,i)}}}}d(F,"createTrustedTextMutationHost");import W from"node:path";import{isDeepStrictEqual as I}from"node:util";var $=new Set(["write","edit","multi_edit","insert_after_anchor"]);function Z(t,o){let e=new Map,a=d(r=>{let s=W.resolve(t,r);return process.platform==="win32"?s.toLowerCase():s},"normalize");return{grant(r){!o()||!$.has(r.name)||typeof r.input.path!="string"||e.set(r.id,{call:structuredClone(r),target:a(r.input.path),phase:"snapshot"})},authorize(r,s,c){if(!o())return e.clear(),!1;let n=r===void 0?void 0:e.get(r.id);return!n||n.phase!==c||a(s)!==n.target||!I(r,n.call)?!1:(c==="snapshot"?n.phase="commit":e.delete(n.call.id),!0)},revoke(r){e.delete(r)},clear(){e.clear()}}}d(Z,"createTrustedTextApprovals");export{F as a,Z as b};