@kodax-ai/kodax 0.7.96-rc.9 → 0.7.96

package/CHANGELOG.md

@@ -8,6 +8,226 @@ All notable changes to this project will be documented in this file.
 
 ---
 
+## [0.7.96] - 2026-10-01
+
+Stable release of the v0.7.96 line, finalizing the fourteen release
+candidates: trusted text transactions and platform shell containment across
+Windows, Linux, and macOS; Windows daemon lifecycle arbitration with
+nonblocking uncertain Shell cleanup; turn-matched interrupted-Run recovery
+across Runs; provable tool-history pairing and compaction-copy tracing;
+macOS system Git preflight; provider authentication isolation; single-writer
+Runtime transcript ownership in Ink sessions; and Windows NUL-ACE startup
+recovery. CI runs inside the tag-triggered Release workflow. Every rc.14
+contract is retained; open items remain tracked in `docs/KNOWN_ISSUES.md`.
+npm publication remains a manual maintainer action.
+
+---
+
+## [0.7.96-rc.14] - 2026-10-01
+
+Fourteenth release candidate of the v0.7.96 line: interrupted-Run recovery
+reaches coding Runs and managed execution with budgeted turn-matched
+records, tool-history pairing and compaction-copy tracing become provable,
+Anthropic-compatible providers ignore inherited `ANTHROPIC_AUTH_TOKEN`, the
+Ink host defers to the Runtime as the single transcript writer, and Windows
+interactive startup re-verifies the NUL account ACE behind a current setup
+marker after a reboot. CI now runs inside the tag-triggered Release
+workflow instead of on branch pushes. Every rc.13 contract is retained. npm
+publication remains a manual maintainer action.
+
+### Fixed
+
+- Interactive Windows startup verifies the live NUL sandbox-account grant
+  before trusting the durable setup marker. Missing access enters the existing
+  setup recovery boundary; installation omits historical read roots whose
+  files disappeared. SDK/daemon startup and ordinary admission remain
+  read-only and do not activate setup automatically (Issue 341).
+- Windows sandbox unit tests provision mock-SID artifacts and remove recovery
+  fixtures in a private temporary native cache, so they no longer interfere
+  with live sandbox commands using the host's shared cache. The native
+  provisioning suite still requires an ordinary host token (Issue 343).
+- Tool-history validation pairs calls with results across the whole assistant
+  scope, so an internal managed-run context message between them no longer
+  strips both halves of the pair (Issue 340).
+- Failed managed provider calls hand back the Runner transcript they received,
+  not provider-normalized request copies, so compatibility cleanup never becomes
+  persisted history.
+- Conversation resolution restores active-path entries damaged by the old
+  adjacent-only cleanup when a retained sibling chain reproduces the damage
+  exactly; unproven cases stay ambiguous. The page cache version is bumped so
+  existing v6 caches rebuild once.
+- The next managed or coding Run of a Session receives a labelled, bounded,
+  transient record of journaled progress from an earlier unfinished Run on the
+  active branch: confirmed results, operations whose result is unknown, and
+  unconfirmed excerpts of assistant text the Run streamed but never saved. The
+  record is never saved and each part disappears once history contains it.
+  Operations from every included Run take the size bound before any excerpt.
+  Operations match history per turn, so a provider reusing a tool call id in a
+  later turn no longer hides an earlier unfinished operation, and the source
+  tracing also covers histories compacted again before this fix.
+- Conversation resolution traces a compaction copy of a copy back to its first
+  retained predecessor, so re-compacted history no longer shows the same
+  message twice. When an older compaction boundary cannot be proven, history
+  is truncated at that boundary and reported as `partial` with
+  `compaction_history_truncated`, instead of flattening unproven regions into
+  one conversation. The page cache version is bumped to 9.
+- Anthropic-compatible providers no longer pick up an inherited
+  `ANTHROPIC_AUTH_TOKEN`. The SDK sent it as a Bearer header next to the
+  provider key, so gateways such as zhipu-coding and deepseek returned 401 and
+  the Anthropic token reached a third-party endpoint. The native Anthropic
+  provider is unchanged.
+- Compare PowerShell-emitted native artifact and control-directory paths
+  through long-form realpaths when the literal comparison disagrees.
+  PowerShell's `GetFullPath` expands 8.3 path components, so a runner whose
+  `TEMP` root uses a short name (`C:\Users\RUNNER~1\...`) made the private
+  test native-artifact cache provisioning fail with an unexpected-path error
+  even though the provisioner returned the canonical destination.
+- The interactive REPL no longer forks a duplicate branch every round when a
+  Runtime owns the Session. The host stops writing its own lineage. Storage
+  reconciles host saves against the Runtime's durable lineage, and the host
+  continues from the Runtime's entry ids. That fixes three problems:
+  - The next host save no longer replaces the Runtime's branch.
+  - A crash between the two writes no longer leaves a permanent fork.
+  - A Run cancelled before it produced a result no longer clears the host's
+    transcript copy.
+
+### Changed
+
+- CI runs through `workflow_call` or manual dispatch instead of branch pushes
+  and pull requests. Tag and manually dispatched release builds run the full
+  reusable CI workflow before their build matrix.
+
+### Documentation
+
+- Align the public SDK guide with read-only legacy history repair, partial
+  compaction truncation, transient interrupted-Run recovery, and Runtime-owned
+  transcript persistence. Document the CLI-only NUL recovery boundary and
+  provider authentication isolation.
+- Track unexpected interactive REPL exit as unresolved (Issue 342). Successful
+  SDK concurrency and full-TTY trace replay do not resolve that failure.
+
+---
+
+## [0.7.96-rc.13] - 2026-09-29
+
+Thirteenth release candidate of the v0.7.96 line: Runtime-owned managed
+runs persist generated output at Runner commit boundaries so an interrupted
+run keeps its transcript instead of losing it with a hung request. Every
+rc.12 contract is retained. npm publication remains a manual maintainer
+action.
+
+### Fixed
+
+- Runtime-owned managed runs persist generated assistant messages and tool results
+  at Runner commit boundaries, before tools or subsequent provider calls can hang.
+  Persist the current compacted transcript and queued-input identities; do not
+  repeatedly save old input messages or change host-owned persistence timing.
+
+---
+
+## [0.7.96-rc.12] - 2026-09-28
+
+Twelfth release candidate of the v0.7.96 line: uncertain Shell cleanup no
+longer blocks conversations, Runner iteration progress becomes observable,
+exhausted Actor children settle with honest structured results, and the test
+toolchain upgrades to Vitest 4. Every rc.11 contract is retained. npm
+publication remains a manual maintainer action.
+
+### Fixed
+
+- Return exhausted Shell cleanup diagnostics and partial output to the model
+  without cancelling its Run. Keep unresolved process identities as deferred
+  cleanup, allow successors and close, and accept queued input during Stop.
+- Expose Root Runner iteration progress in Runtime live snapshots and structured
+  Actor iteration progress in durable turn summaries/output. Values come from
+  the executing Runner; the default managed Root (500) and native Actor child
+  (200) thresholds are unchanged.
+- Settle exhausted native Actor children as failed with terminationReason
+  iteration_limit, preserving partial output, artifacts and structured results.
+  Parent completion notifications include the reason. Exhaustion no longer runs
+  a structured-output repair or workflow digest, and follow-up starts a fresh
+  iteration count. Completion on the final permitted iteration remains successful.
+
+### Changed
+
+- Upgrade the test toolchain to Vitest 4.1.11 (with `@vitest/coverage-v8`
+  4.1.11 and pinned vite 7.3.3/vite-node) and fflate ^0.8.3, which fixes a
+  ZIP64 directory scan that never terminated when a compressed-size sentinel
+  was present without the required `0x0001` extra field; skill archive
+  regression coverage locks the fix in.
+
+### Documentation
+
+- Document the embedder-owned Electron `safeStorage` credential storage
+  lifecycle: on Windows, the `Local State` encryption state must be preserved
+  together with the ciphertext across cleanup, uninstall, reinstall, and
+  profile migration, and an undecryptable existing client secret surfaces a
+  terminal credential recovery error instead of a silent replacement.
+
+---
+
+## [0.7.96-rc.11] - 2026-09-23
+
+Eleventh release candidate of the v0.7.96 line: SDK-owned background Git
+calls on macOS preflight the system Git shim so a machine without usable
+command-line developer tools no longer receives repeated Apple installation
+prompts. Every rc.10 contract is retained. npm publication remains a manual
+maintainer action.
+
+### Fixed
+
+- Preflight the macOS system Git shim before SDK-owned Git calls
+  (`@kodax-ai/agent/runtime/macos-git`): the shared platform guard detects
+  the known developer-tools-missing condition only (exit code 2,
+  `DEVELOPER_DIR`-aware), caches probes with a bounded TTL, shares one probe
+  across concurrent callers, and recovers after installation with no
+  permanent disable state. Repo-intelligence, worktree, changed-diff,
+  managed-task checkpoint, agent-adapter, worktree-sweep, session-snapshot,
+  REPL helpers, and synchronous memory paths apply the guard while ordinary
+  Git on `PATH`, independent Git installations, and arbitrary Bash/PTY
+  commands remain unchanged (Issue 339). Worktree operations keep actionable
+  errors; synchronous memory identity keeps its remote-based identity and
+  local-path fallback rules. Native macOS on-device UI verification remains
+  recommended on real hardware.
+
+---
+
+## [0.7.96-rc.10] - 2026-09-22
+
+Tenth release candidate of the v0.7.96 line: Runtime shutdown now owns and
+drains the background work it starts, Edits-mode text tools no longer reject
+ordinary project files when a workspace root contains protected native state,
+and the MCP image-validation cancellation fixture is stabilized. Every rc.9
+contract is retained. npm publication remains a manual maintainer action.
+
+### Fixed
+
+- Drain owned managed terminal maintenance on Runtime close: the optional
+  repo-intelligence/artifact maintenance factory is registered with its own
+  Runtime before it can start, close stops accepting new optional maintenance
+  and waits for existing owned work before releasing Actor, executor, and
+  owner-liveness resources, so test workspaces are no longer held after
+  `Runtime.close()` returns. Run completion, successor admission, and Stop
+  stay independent of maintenance; shared repo caches are not cancelled.
+- Own and settle memory work on shutdown: Runtime registers its memory
+  setup/finalization IO and background review drains before execution; close
+  refuses new work, cancels pending review requests, and awaits
+  already-started work before releasing the owner. Managed execution finishes
+  its required durable memory finalization before publishing completion, the
+  classic finalizer owns learned-Skill outcome and binding-release IO, and
+  branch-authority setup checks cancellation before prompt/Git work. A caller
+  signal already aborted at entry settles as an interrupt terminal (defined
+  `KodaXResult`, terminal `onComplete`) instead of a raw rejection, keeping
+  the CAP-005-001b and CAP-086-003 contracts.
+- Scope trusted text transaction cache protection to the authorized canonical
+  target: Edits-mode `edit`/`write` no longer fail with `Runtime write policy
+  targets protected native text state` for ordinary project files when a
+  workspace root contains the protected native cache (for example a home
+  root). Development artifact trust still checks every authorized write root,
+  so a writable manifest cannot redefine trusted native bytes.
+
+---
+
 ## [0.7.96-rc.9] - 2026-09-21
 
 Ninth release candidate of the v0.7.96 line: Windows daemon startup trees

package/README.md

@@ -786,6 +786,73 @@ provider's model, REPL `/compact` clears the UI only after a durable save, and
 successful reports carry bounded `summaryRequests` plus `commitMs` per
 physical summary call.
 
+**v0.7.96 stable release:** The stable release of the v0.7.96 line,
+finalizing the fourteen release candidates: trusted text transactions and
+platform shell containment across Windows, Linux, and macOS; Windows daemon
+lifecycle arbitration with nonblocking uncertain Shell cleanup; turn-matched
+interrupted-Run recovery across Runs; provable tool-history pairing and
+compaction-copy tracing; macOS system Git preflight; provider authentication
+isolation; single-writer Runtime transcript ownership in Ink sessions; and
+Windows NUL-ACE startup recovery. CI runs inside the tag-triggered Release
+workflow. Every rc.14 contract is retained; open items remain tracked in
+`docs/KNOWN_ISSUES.md`.
+
+**v0.7.96-rc.14 release:** Fourteenth release candidate of the v0.7.96
+line. Interrupted-Run recovery reaches coding Runs and managed execution
+with a labelled, bounded, transient record of journaled progress matched
+per turn; tool-history pairing spans the whole assistant scope;
+conversation resolution traces compaction copies to a provable root and
+truncates unproven boundaries as `partial`; Anthropic-compatible providers
+ignore an inherited `ANTHROPIC_AUTH_TOKEN`; the Ink host defers to the
+Runtime as the single transcript writer; and Windows interactive startup
+re-verifies the NUL account ACE behind a current setup marker after a
+reboot (Issues 340-341). CI now runs inside the tag-triggered Release
+workflow instead of on branch pushes. Every rc.13 contract is retained.
+
+**v0.7.96-rc.13 release:** Thirteenth release candidate of the v0.7.96
+line. Runtime-owned managed runs persist generated assistant messages and
+tool results at Runner commit boundaries, before tools or subsequent
+provider calls can hang: the current compacted transcript and queued-input
+identities survive an interrupted run, initial input replay is skipped
+rather than re-saving all history, and host-owned persistence timing is
+unchanged. Every rc.12 contract is retained.
+
+**v0.7.96-rc.12 release:** Twelfth release candidate of the v0.7.96 line.
+Uncertain Shell cleanup no longer blocks conversations: exhausted cleanup
+retries return diagnostics and partial output to the model, unresolved
+process identities become deferred cleanup records, successors and close
+proceed, and an exhausted terminal Run settles honestly with
+`effectOutcome: unknown` instead of claiming verified termination. Root
+Runner iteration progress is exposed in Runtime live snapshots and durable
+Actor turns, and exhausted native Actor children settle as failed with
+`terminationReason: iteration_limit` while preserving partial output,
+artifacts, and structured results. The test toolchain upgrades to Vitest
+4.1.11 with fflate 0.8.3 (ZIP64 scan fix). Every rc.11 contract is retained.
+
+**v0.7.96-rc.11 release:** Eleventh release candidate of the v0.7.96 line.
+SDK-owned background Git calls on macOS preflight the system Git shim: a
+shared `DEVELOPER_DIR`-aware platform guard (`@kodax-ai/agent/runtime/macos-git`)
+detects the known developer-tools-missing condition (exit code 2 only,
+TTL-cached probes shared across concurrent callers, recoverable after
+installation, no permanent disable state) so repo-intelligence, worktree,
+changed-diff, managed-task checkpoint, agent-adapter, worktree-sweep,
+session-snapshot, REPL helpers, and synchronous memory paths no longer
+repeat Apple's developer-tools installation prompt. Ordinary Git on `PATH`,
+independent Git, and arbitrary Bash/PTY commands are unchanged (Issue 339).
+Every rc.10 contract is retained.
+
+**v0.7.96-rc.10 release:** Tenth release candidate of the v0.7.96 line.
+Runtime shutdown owns and drains the background work it starts: managed
+terminal maintenance and memory setup/finalization IO plus background review
+drains are registered with the owning Runtime, close refuses new work and
+awaits already-started work before releasing resources, and managed execution
+finishes its durable memory finalization before publishing completion.
+Edits-mode `edit`/`write` no longer reject ordinary project files when a
+workspace root contains protected native state: trusted text transaction
+cache protection targets only the authorized canonical file while
+development artifact trust still checks every authorized write root. Every
+rc.9 contract is retained.
+
 **v0.7.96-rc.9 release:** Ninth release candidate of the v0.7.96 line.
 Arbitrates daemon publication against launcher loss with a one-shot startup
 handoff: unpublished Windows daemon startup trees and their Job descendants

package/README_CN.md

@@ -296,6 +296,55 @@ SDK 系统代码契约更新，但没有放宽 shell/sandbox 的 fail-closed 边
 `handleRuntimePermissionRequest()` 管理 SDK 权限 UI，并在 prepared Session 尾部遇到
 `data_changed` 时通过权威 delta 合并恢复；后台持久化失败会显示为诊断，不再静默丢失。
 
+**v0.7.96 正式版发布**：v0.7.96 线的正式版本，定格十四个发布候选的全部
+成果：跨 Windows/Linux/macOS 的受信文本事务与平台 Shell 隔离；Windows
+daemon 生命周期仲裁与不阻塞的不确定 Shell 清理；按回合匹配的中断 Run 跨
+Run 恢复；可证明的工具历史配对与压缩副本追溯；macOS 系统 Git 预检；
+Provider 认证隔离；Ink 会话中 Runtime 作为唯一转录写入者；Windows NUL
+账户 ACE 启动恢复。CI 在 tag 触发的 Release workflow 内运行。所有 rc.14
+契约全部保留；未决项继续在 `docs/KNOWN_ISSUES.md` 中跟踪。
+
+**v0.7.96-rc.14 发布**：v0.7.96 线第十四个发布候选。中断 Run 的恢复进入
+coding Run 与托管执行：以带标签、有界、临时的记录按回合匹配交接已日志化的
+进度；工具历史配对覆盖整个 assistant 范围；会话解析把压缩副本追溯到可证明
+的根，无法证明的边界以 `partial` 截断；Anthropic 兼容 Provider 不再继承
+`ANTHROPIC_AUTH_TOKEN`；Ink 宿主让位给 Runtime 作为唯一转录写入者；
+Windows 交互启动在重启后面对仍有效的 setup 标记会重新校验 NUL 账户 ACE
+（Issues 340-341）。CI 改为在 tag 触发的 Release workflow 内运行，普通
+push 不再触发。所有 rc.13 契约全部保留。
+
+**v0.7.96-rc.13 发布**：v0.7.96 线第十三个发布候选。Runtime 拥有的托管 Run
+在 Runner 消息提交边界持久化已生成的助手消息与工具结果，赶在工具或后续
+Provider 调用可能挂起之前：当前压缩后的转录与排队输入身份在中断的 Run 中
+得以保留，初始输入重放被跳过而不重复保存全部历史，宿主拥有的持久化时机
+不变。所有 rc.12 契约全部保留。
+
+**v0.7.96-rc.12 发布**：v0.7.96 线第十二个发布候选。不确定的 Shell 清理不再
+阻塞对话：耗尽的清理重试把诊断与部分输出返回给模型，未决的进程身份转为
+deferred 清理记录，后继 Run 与 close 照常进行，耗尽后的终态 Run 以
+`effectOutcome: unknown` 诚实结算而不宣称已验证终止。Root Runner 迭代进度
+在 Runtime 实时快照与持久 Actor 回合中可见，耗尽的 native Actor 子任务以
+`terminationReason: iteration_limit` 结算为失败并保留部分输出、工件与结构化
+结果。测试工具链升级到 Vitest 4.1.11 与 fflate 0.8.3（修复 ZIP64 扫描死循环）。
+所有 rc.11 契约全部保留。
+
+**v0.7.96-rc.11 发布**：v0.7.96 线第十一个发布候选。macOS 上 SDK 拥有的后台
+Git 调用会先预检系统 Git 垫片：共享的平台守卫（`@kodax-ai/agent/runtime/macos-git`）
+能识别已知的开发者工具缺失状态（仅限退出码 2，感知 `DEVELOPER_DIR`，探测按有界
+TTL 缓存并在并发调用间共享，安装后可恢复，无永久禁用状态），使 repo-intelligence、
+worktree、changed-diff、托管任务 checkpoint、agent-adapter、worktree-sweep、
+session-snapshot、REPL 辅助路径与同步内存路径不再反复触发 Apple 开发者工具安装
+弹窗。`PATH` 上的普通 Git、独立安装的 Git 与任意 Bash/PTY 命令不受影响
+（Issue 339）。所有 rc.10 契约全部保留。
+
+**v0.7.96-rc.10 发布**：v0.7.96 线第十个发布候选。Runtime 关闭时拥有并
+排空自己启动的后台工作：托管终端维护与内存 setup/finalization IO 及后台
+review 排空都注册到所属 Runtime，close 拒绝新工作并等待已开始的工作完成后
+才释放资源，托管执行在发布完成前先落地持久内存 finalization。当工作区根
+包含受保护原生状态时，Edits 模式的 `edit`/`write` 不再拒绝普通项目文件：
+受信文本事务的缓存保护只针对授权的规范化目标文件，而开发工件信任仍检查
+全部授权可写根。所有 rc.9 契约全部保留。
+
 **v0.7.96-rc.9 发布**：v0.7.96 线第九个发布候选。以一次性启动交接仲裁
 daemon 发布与 launcher 失联：未发布的 Windows daemon 启动树及其 Job 后代被
 回收，已发布的共享服务不受影响（Issue 337）。Windows daemon 状态替换在有界
@@ -429,7 +478,7 @@ native 文本权威改在摘要固定的 `manylinux_2_28` 构建器中编译，
 scope 在 SDK、Agent 摘要、CLI 与 Runtime Worker 请求间共享，保留结构化的 Child Agent Provider
 失败信息，精确遵循 run-scoped 凭据校验，并为严格 vLLM 网关省略空 `tools` 数组（Issues 329-332）。
 npm 发布仍由
-维护者手动执行。详见 [v0.7.96-rc.9 发布清单](docs/release.md#v0796-rc9-release-preparation)。
+维护者手动执行。详见 [v0.7.96 正式版发布清单](docs/release.md#v0796-release-preparation)。
 
 **v0.7.96-alpha.3 发布**：Provider 凭据成为惰性、受限、可撤销的能力（ADR-068）。v2
 credential broker 将 Provider 密钥保留在 OS keychain，按每次 wire call、为单一封闭

package/dist/chunks/{agent-6EVY7G4I.js → agent-7N427EVB.js}

@@ -1,2 +1,2 @@
 // @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
-import{Pa as g,Ra as h,a as c,ka as d,la as e,ma as f,qb as i,rb as j,zb as k}from"./chunk-SCP7FZLG.js";import"./chunk-756FJMN2.js";import"./chunk-XSCBV3HD.js";import"./chunk-Q5R2MBGE.js";import"./chunk-FOC6MUV5.js";import{Pb as a,Qb as b}from"./chunk-2Y5LQMLN.js";import"./chunk-WHQCTZKI.js";import"./chunk-W5XGIRQQ.js";import"./chunk-ONUPGMER.js";export{e as bucketProviderPayloadSize,g as buildAutoRepoIntelligenceContext,f as checkPromiseSignal,b as cleanupIncompleteToolCalls,h as describeTransientProviderRetry,c as emitResilienceDebug,d as estimateProviderPayloadBytes,k as runKodaX,j as saveRequiredSessionSnapshot,i as saveSessionSnapshot,a as validateAndFixToolHistory};
+import{Fb as k,Va as g,Xa as h,a as c,qa as d,ra as e,sa as f,wb as i,xb as j}from"./chunk-7O2AIFNE.js";import"./chunk-EM4XJBTK.js";import"./chunk-66XN5AFU.js";import"./chunk-C7U542KM.js";import"./chunk-NI7PBPUR.js";import{Rb as a,Sb as b}from"./chunk-WV3DJVW4.js";import"./chunk-DSXUXUZG.js";import"./chunk-HZYRLIOC.js";import"./chunk-ONUPGMER.js";export{e as bucketProviderPayloadSize,g as buildAutoRepoIntelligenceContext,f as checkPromiseSignal,b as cleanupIncompleteToolCalls,h as describeTransientProviderRetry,c as emitResilienceDebug,d as estimateProviderPayloadBytes,k as runKodaX,j as saveRequiredSessionSnapshot,i as saveSessionSnapshot,a as validateAndFixToolHistory};

package/dist/chunks/argument-completer-FAIHW7HZ.js

@@ -0,0 +1,2 @@
+// @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
+import{Ma as a,Na as b}from"./chunk-SC2ELSUS.js";import"./chunk-GYO73UYQ.js";import"./chunk-YEAUDI6U.js";import"./chunk-TEUD5VPJ.js";import"./chunk-NKT3B3DR.js";import"./chunk-ABZDFK2X.js";import"./chunk-7O2AIFNE.js";import"./chunk-EM4XJBTK.js";import"./chunk-66XN5AFU.js";import"./chunk-C7U542KM.js";import"./chunk-NI7PBPUR.js";import"./chunk-WV3DJVW4.js";import"./chunk-DSXUXUZG.js";import"./chunk-HZYRLIOC.js";import"./chunk-ONUPGMER.js";export{a as ArgumentCompleter,b as createArgumentCompleter};