@kodax-ai/kodax 0.7.97-alpha.9 → 0.7.97-beta.1

package/CHANGELOG.md

@@ -8,6 +8,338 @@ All notable changes to this project will be documented in this file.
 
 ---
 
+## [0.7.97-beta.1] - 2026-11-02
+
+First beta of the v0.7.97 line: Space-facing Host execution and Session
+seams complete — Main-owned capability-gated default Skills and
+consumption-time execution bindings select committed expert/connector state
+with fresh credential/tool leases at actual Product input consumption, and
+Quick Ask promotes Sessions through Host-owned revision checks with durable
+request-ID reconciliation while preserving the original Session and history.
+Plain redirect Run boundaries persist apart from legacy explicit Skill queues
+and survive cold recovery with strict missing-method rejection; Main bindings
+resolve before steer authority and retain the active Run's principal and
+lease boundaries. Every core configuration update publishes atomically under
+the shared lock — old bytes stay on failed writes, damaged provider
+collections are rejected before mutation, configuration errors stay free of
+secrets, and Windows reader-denied replacements retry within the same staged
+file and write lock. The complete daemon schema ships as packaged data inside
+the npm inventory while the CLI keeps its size budget; owner-local temporary
+Run results stay awaitable after Host Session cleanup. Windows protected
+paths retain lexical and physical short-name fences with credential staging
+DACLs replaced without broad grants. Bare `resume` discovery paints immediate
+`Finding sessions` feedback without extra startup work. Every v0.7.96 stable
+and v0.7.97-alpha.1 through alpha.12 contract is retained. npm publication
+remains a manual maintainer action.
+
+### Added
+
+- Add capability-gated Main default Skills and execution-binding resolvers for
+  committed expert/connector selection at actual Product input consumption;
+  retain original recovery bindings with fresh credential/tool leases.
+- Add Host-owned, revision-checked Session promotion with durable request-ID
+  reconciliation for Quick Ask, preserving the original Session and history.
+
+### Fixed
+
+- Distinguish plain redirect Run boundaries from legacy explicit Skill queues,
+  retaining that intent through cold recovery without weakening missing-method
+  rejection or changing the original input, principal, or authority.
+- Resolve Main bindings before checking steer authority, retaining the active
+  Run's principal and lease boundaries; preserve explicit method identity for
+  redirects, including conservative recovery of older null-marked queue records.
+- Publish every core configuration update under the existing shared lock with
+  atomic replacement; retain old bytes on failed writes, reject damaged saved
+  provider collections before mutation, and keep configuration errors free of secrets.
+  Bound Windows reader-denied replacements to the same staged file and write
+  lock, retaining the old configuration on permanent denial.
+- Preserve rejected queued inputs and explicit Skill identity; retain prepared
+  Skill admission context without replaying hooks or adopting changed policies
+  during checkpoint recovery. New execution intent requires a compatible Host.
+- Generate the complete daemon schema as packaged data, preserving the existing
+  CLI size budget and release workflow matrix/trigger behavior.
+- Keep owner-local temporary Run results awaitable after Host Session cleanup;
+  include generated protocol data in the actual npm package inventory.
+
+- Preserve lexical and physical protected paths across Windows short names;
+  keep missing SSH identities excluded and native cache anchors free of reparse
+  aliases. Replace credential staging DACLs without retaining explicit broad
+  grants. Preserve Undo's native identity and CAS fences while correcting
+  canonical test fixtures and retaining failed sandbox bootstrap diagnostics.
+- Paint `Finding sessions` startup feedback while bare-resume discovery scans
+  sessions and clear it before the picker or empty-list notice, without adding
+  file reads, workers, rebuilds or other startup work to the loading path.
+
+---
+
+## [0.7.97-alpha.12] - 2026-11-01
+
+Twelfth alpha of the v0.7.97 line: public product execution converges on the
+independent shared Host with retired embedded/default construction, inline
+owner switching and function-based external-agent Hosts, plus abandoned-owner
+policy migration with a one-way fence; FEATURE_302 lands native
+provider/OAuth credential parity across the Responses transport, ordered
+history, native cloud protocols, Mistral Pi, native media classification,
+shared file credentials and hidden API-key setup; Claude 5.5 history fragments
+and per-message effort controls join the LLM layer; and the 2026-11-01
+full-chain audit's Windows recovery, credential and permission hardening
+ships. Every v0.7.96 stable and v0.7.97-alpha.1 through alpha.11 contract is
+retained. npm publication remains a manual maintainer action.
+
+### Changed
+
+- Store execution statistics in append-only, Session-root-scoped journals;
+  retain legacy projections and expire pagination cursors after projection
+  recovery. Keep unknown outcomes non-authoritative for execution.
+- Load optional Node CLI auth, doctor, storage maintenance and one-shot
+  components on demand within the existing size reserve; standalone binaries
+  embed those components and public SDK entry points remain unchanged.
+- Add native Claude 5.5 history fragments, ordered thinking/tool blocks,
+  inline tool/system updates and per-message effort controls. Preserve
+  admitted images across restore and keep cache policy out of tool arguments.
+
+- Converge public Runtime ownership on the independent shared Host. Retire
+  embedded/default construction, inline owner switching and function-based
+  in-process external-agent Hosts. Keep the explicit daemon launcher and its
+  new-owner policy bootstrap; independent libraries remain usable.
+- Migrate eligible abandoned owner policies under profile and real Session-root
+  ownership checks. Persist a one-way policy that verified old readers reject,
+  preventing inline rollback after Host idle exit. Live/unknown owners and
+  unsafe Run recovery remain protected; old private unfenced writers must stop
+  and upgrade before sharing data. See the SDK migration guide for breaking
+  API and downgrade limits.
+
+### Fixed
+
+- Refresh rejected OAuth credential generations through the existing broker
+  without replaying the failed request or changing the selected account.
+  Preserve trusted account identity across refresh and fence revoked leases.
+- Publish migration/OAuth/storage lock owners completely; add explicit local
+  inspection, retained backups, repair fences and separately attested recovery
+  for supported damaged ledgers/snapshots and unidentified historical locks.
+- Prevent ambient Anthropic SDK headers from replacing the selected credential;
+  keep unsupported Claude sampling/prefill and hook effort overrides off wire.
+- Preserve explicit non-retryable provider facts through returned child
+  failures while retaining configured fallback for transient HTTP failures.
+- Prevent terminal quota, authentication and explicitly non-retryable child
+  failures from triggering cross-provider fallback. Diagnose retained Session
+  writer locks and lock-record syntax without disclosing owner fields or
+  reclaiming unknown ownership; add a Windows streaming-history PTY CI gate.
+- Keep help, version and read-only doctor available with corrupt configuration;
+  retain execution/write fencing and diagnose exact lock locations without
+  exposing config contents or following directory aliases.
+- Pin Windows CLI-provider child birth identities through delayed exit events
+  and retain captured descendants across intermediate-parent exit.
+- Preserve explicit SDK Skill catalogs, including empty overrides, across SA/AMA
+  learned bindings and compaction. Keep the stricter CLI size reserve using an
+  audited, lazily assembled broker program resource with identical emitted bytes.
+
+- Restore AMA Root learned Skill admission and owned finalization; explicit SDK
+  Skill calls now settle the existing policy and hooks without a model request.
+  Keep empty learned stores off foreground initialization and discover protected
+  formal names when a review actually commits a Skill.
+- Correct verified model ceilings, generic Skill aliases, cache pricing and Kimi
+  cache-write usage; retain default output budgets, fixed IDs and account choices.
+  Project unsupported historical images explicitly without rewriting history.
+- Derive SDK build/type entries from package exports and compile published examples.
+  Share current Runtime guardrail facts while retaining independent minimums.
+  Add explicit storage-capacity inspection and isolate cleanup state by directory.
+- Discover Windows source regressions automatically and retain the native OS gate.
+  Publish complete config/Host lock records, recover verified dead owners without
+  TTL stealing, and retry completed migration/release cleanup. Config and extension
+  publication failures retain original bytes, including legacy credential fields.
+- Isolate corrupt execution statistics, pending inputs and agent event ledgers
+  without replaying unknown effects or discarding queued intent. Retry failed CLI
+  credential bootstrap and load linked OAuth registrations only when selected;
+  preserve profile/account binding, revocation and Host replacement fences.
+- Reject unreadable or invalid existing core configuration in CLI and SDK
+  execution instead of selecting default credentials. Retain the original bytes,
+  permit first-use missing configuration, and retry after explicit repair.
+- Prevent native Anthropic API-key requests from inheriting ambient Bearer auth,
+  and omit unsigned foreign thinking on native Anthropic OAuth tool history.
+  Constrain SDK shell prefix fallback and protect governed Memory mutation at
+  sandbox and obvious direct Host targets. Plan recovery names the actual
+  `exit_plan_mode` approval flow.
+- Ship configuration templates, static prompts and audited native scripts in standalone
+  archives; load the byte-identical native programs lazily within the CLI budget.
+
+- Resolve explicit and queued Skill references against the executing Host's
+  config home, keeping separate Hosts' user Skills and registries isolated.
+- Keep admitted Skill catalogs available under Markdown Agent and SDK profile instructions across Solo, Adaptive and public Runner entries; reuse the bounded catalog formatter for Runtime bindings while preserving complete caller prompt overrides and pinned authorization.
+- Restore already-authorized tool evidence to the next model request when an actual Host/guardrail refusal or failed read makes its saved preview unrecoverable; retain read denials and Run isolation. Unknown Skill errors no longer enumerate hidden or budget-omitted registry entries.
+- Preserve complete MCP/tool results inline when active Skill restrictions or read hooks could block recovery, without speculative hook execution or permission bypasses.
+- Discover project `.agents/skills` and nested Skill collections with native-source precedence, support-directory boundaries and cycle protection; report shadowed sources and bound model Skill catalogs with visible shortening/omission diagnostics.
+- Stabilize executor registration revision fingerprints using normalized JSON
+  content, including persisted and rediscovered registrations.
+- Distinguish POSIX sandbox dependency, interpreter and seccomp diagnostics while
+  preserving authorized once-only host fallback and its actual isolation state.
+- Put standalone Windows Shell commands and environment probes behind a registered
+  Job gate. Verify descendant drain before retiring recovery records; fail cleanup
+  acceptance instead of only warning when verification is unavailable.
+- Compare checkpoint write times at millisecond precision so a filesystem's
+  fractional timestamp cannot discard fresh recovery state as future-dated.
+- Drain admitted Session view and item reads before Host-owner disposal completes,
+  preventing released reads from recreating storage indexes after shutdown.
+
+- Give Partner the selected generic Agent surface without persona-based restrictions.
+  Evaluate explicit policies against the Host catalog, retain metadata ceilings across
+  native/MCP/child routes, and keep allowed Actor lease calls working. Persist and
+  expose actual executable/model tool scopes, including after Host restart.
+  Repeated root recovery preserves original tool ceilings, persona and verification
+  while intersecting fresh authority; arbitrary callbacks still require rebinding.
+
+- Support Partner on the unified Host through trusted Main execution-profile
+  snapshots, intersecting Agent mode with existing profile/tool/lease ceilings.
+  Expose actual Run workMode and honor extension activeTools in effective scope;
+  keep standalone profile compatibility and specialist child declarations.
+- Preserve Actor checkpoint followup across daemon IPC and restart, and route
+  SA Script through its managed executor. Apply live plan effort to actual
+  Provider requests as well as the view.
+- Keep numeric token configuration typed, capture saved output/cache/LSP/tier
+  defaults for new Runs, and expose per-field application boundaries. Clearing
+  defaults cannot revive old bootstrap projections or remove external env values;
+  older Hosts retain unknown application support.
+- Refresh `kodax_manual` topic guidance for retired verification/journal paths,
+  work modes, original tool results, token estimates, task reports, question
+  deadlines, Skill policy and sandbox readiness. Exact query IDs/aliases now
+  take precedence over keyword ranking, preserving custom SDK manual topics.
+- Keep trusted-text, POSIX sandbox and storage-repair test fixtures on
+  canonical temporary roots so macOS runner paths under the `/var` symbolic
+  link satisfy the hardened agent-home and filesystem-alias fences.
+
+---
+
+## [0.7.97-alpha.11] - 2026-10-29
+
+### Added
+
+- Add explicit Agent, Coding and experimental Script work modes through the
+  CLI, interactive `/work-mode` command and managed SDK/Session paths. Coding
+  remains the default. Script executes supported leaf tools through the existing
+  permission and receipt boundaries; SDK profiles and specialist agents retain
+  their declared capabilities.
+
+- Refresh Ark, MiMo and MiniMax model catalogs and their reasoning/capacity
+  metadata. Provider-specific mappings and validation limits are documented in
+  the provider configuration guide.
+
+### Fixed
+
+- Run release builds alongside full CI while retaining all publication gates;
+  move the complete serial Node 20 system suite to its own runner, validate
+  archives before lengthy Electron checks, and bound bundle/archive execution
+  with retained failure evidence. Ordinary branch pushes still do not trigger CI.
+- Preserve the Windows PowerShell module search path in isolated archive tests,
+  avoiding stalled OS containment probes. Reject unverified supervised Hosts
+  before publishing incomplete capabilities and a misleading upgrade error.
+
+- Align current SDK, Client, design and user documentation with post-alpha.10
+  work modes, question deadlines, saved tool originals, structured task reports
+  and streaming token estimates; retain historical release/validation limits.
+
+- Preserve non-interactive question outcomes through the REPL client and reject
+  client-supplied timeout answers before daemon submission; the Host owns deadlines.
+- Constrain Skill `Bash(pattern)` rules to a single parsed command, preventing
+  wildcard matches from admitting additional shell statements, pipelines,
+  redirects or command substitutions. Bare Bash and absent Skill restrictions
+  continue through normal Host authorization.
+- Correct Windows stale-process recovery startup overhead and history browsing
+  cursor resynchronization; validate sandbox filesystem capabilities at startup.
+  Historical intermittent first-read latency remains under investigation.
+- Display estimated tokens consistently across model streaming progress surfaces.
+
+- Project existing task-result metadata into Product live views and recovered
+  history with explicit source, task identity, terminal/unknown status and
+  Markdown report bodies. Preserve multi-report order, literal report content,
+  existing full-body reads and raw canonical envelopes; decode only explicitly
+  sourced legacy deliveries and keep child failures separate from root Provider
+  errors. Deduplicate only identified task-message mirrors; preserve independent
+  same-text notices and ambiguous old UI records during history restoration.
+
+- Keep Skill discovery rooted at the repository when the SDK runs from a
+  subdirectory, synchronize catalogs with loader availability in SA/AMA, and
+  invalidate stale bodies across rediscovery and in-flight reads. Model loads
+  now apply the existing Skill action policies, lifecycle hooks and model
+  preference, retaining Host authorization and safe multi-Skill composition.
+
+- Preserve complete MCP tool output behind explicit SDK `part: 'original'`
+  reads, including daemon IPC and Host restart, while retaining existing preview
+  offsets. Keep results inline when recovery cannot be read, improve long JSON
+  previews, and stop Session-local automatic cleanup from deleting shared output
+  artifacts. Add simulated-provider/MCP E2E coverage against the built SDK.
+
+---
+
+## [0.7.97-alpha.10] - 2026-10-27
+
+Tenth alpha of the v0.7.97 line: live context-capacity recovery reaches
+durable generation boundaries — checkpointed Runs and task trees resume
+after Host restart with fresh scoped authority, Kimi K3.1 routes join the
+provider registry with full effort coverage, and AskUser interactions gain
+answer-aware policies with explicit skip semantics. Every v0.7.96 stable
+and v0.7.97-alpha.1 through alpha.9 contract is retained. npm publication
+remains a manual maintainer action.
+
+### Added
+
+- Forward actual Host initialization phases through the existing SDK startup callback and CLI indicator, including MCP prewarm and task recovery; reuse bounded bootstrap-log observation without extra readiness probes or waits.
+- Kimi K3.1 provider routes: all seven user effort levels map through the Anthropic-compatible endpoint exactly like the official Kimi client (explicit thinking enablement plus output_config effort), with live subscription results, inconclusive high self-reports, and the public account balance limitation documented.
+
+### Fixed
+
+- Repair bundled Skill shell declarations against the full-command glob contract while retaining Host authorization; make Git/TDD discoverable, separate tests-only and Skill creation/packaging/evaluation flows, and align visual preparation and unverified fallbacks. Skill Creator helpers now resolve public Skill SDK exports in installed tarballs and create fresh description-loop workspaces; semantic-screening output no longer implies observed model selection.
+- Classify trusted Skill loading and policy restoration failures as local execution failures with stable codes and path-safe Skill messages; preserve the facts through Runtime persistence, daemon IPC and Product Client outcomes without weakening trusted reloads or changing Provider error classification.
+- Resume checkpointed Runs and task trees after Host restart: original history, tool receipts, pending input intent and iteration budgets are preserved across independent child and Host recovery; scoped authority rebinds freshly, suspended worktrees stay protected, and bounded verbatim constraint memory retains oversized requests (Issue 322 follow-up).
+- Converge client exit recovery without rewriting unknown outcomes: startup readiness is separated from historical client cleanup acknowledgements, exact Host/process/Job shutdown evidence is reverified, referenced outcomes are retained with late cleanup results preserved, and old exit requests can no longer fence or stop replacement Hosts.
+- Preserve non-interactive question settlement in one-shot CLI: report normal `unanswered/non_interactive` results without default answers or Run interruption, retain MCP protocol cancellation and independent permission rejection, and update the adjacent regression assertions.
+- Close adjacent question/restart regressions: retain checkpoints on unanswered recovery prompts, cancel unanswered MCP confirmation/URL requests, preserve UI callback errors through the SDK MCP bridge for protocol cancellation, surface ordinary prompt callback errors without overriding prior settlements, scope client Stop intent to its exact Run, and persist thread concurrency limits. Expose the existing new-Host question deadline through the Product launcher; repair classic assertions and capacity-test cleanup.
+- Honor a partially delivered durable Session Stop during Root/Actor generation recovery; its original request can finish through verified dead-owner checkpoint Stop takeover, while later Runs remain outside the old frontier.
+
+- Preserve prior summary failures when an irreducibly oversized user input
+  needs request-only degradation (Issue 322). Single-agent and managed
+  compaction no longer reset the breaker on an oversized partial result;
+  the single-agent capacity-error branch also retains its prior count.
+  Ordinary failures still accumulate, successful relief still rearms the
+  breaker, and oversized inputs retain their bounded recovery attempt. String
+  and mixed text/image user messages share this behavior; images and tool
+  receipts cannot independently qualify as irreducible user text.
+
+- Extend live context-capacity recovery with retrievable older assistant history,
+  cumulative request-only user-text paging (including mixed image messages),
+  budgeted runtime provenance, small-window safety accounting, and emergency
+  schema discovery through the existing tool bridge. Preserve protected tools,
+  canonical user messages, and completed execution receipts; paging requires an
+  authorized read capability and readable saved artifacts.
+- Retry rejected generations only after measured request reduction (at most four
+  recovery retries). A Host can save the transcript and wait in `recovering`, then
+  continue the same execution when model settings change or corrective input arrives.
+  Stop cancels the wait; the independent SDK keeps typed failure semantics unless
+  its caller supplies the recovery callback. Automatic continuation after Host death
+  or expired credential authority is not included.
+- Retry transient context-history and artifact I/O with cancellable backoff. Read
+  back a failed save acknowledgement before retrying, preserving newer metadata
+  and avoiding duplicate history transactions; permission failures still surface.
+
+- Keep the natural-eval fixture's `npm test` working on staged Node installs by
+  allowing reads of an npm CLI installed outside the binary directory, and
+  canonicalize the native test fixture root so hosted-runner 8.3 temp paths
+  (`RUNNER~1`) are not rejected by the native path policy.
+- Keep eval dump directories and unrelated `kodax-eval-*` directories out of orphan
+  worktree cleanup. Require a worktree gitfile and successful Git-owned removal;
+  isolate the cleanup regression from the shared system temporary directory.
+- AskUser questions wait indefinitely by default (timeout 0) and support explicit skip; skip and Host timeout return an `unanswered` result with its reason instead of cancelling the Run, defaults are never submitted automatically, and only Stop interrupts. Permission prompts keep their five-minute default; both accept 0 to disable their timer. MCP reverse elicitation and the client plane follow the same policy.
+- Close the A2A server task store when agent-card validation fails during
+  construction, so a rejected server no longer leaks its data-dir lock handle;
+  on Windows the leaked handle kept the data dir undeletable (`ENOTEMPTY`)
+  for the life of the process.
+- Deliver observation handoff events to event-stream observers. Daemon
+  `session.observe` subscribers never read the snapshot, so events published
+  while the snapshot materialized were silently deduplicated away whenever the
+  snapshot's seq raced past them — a late `run.failed` could be lost forever.
+  Snapshot consumers keep the existing no-duplicates handoff contract.
+
+---
+
 ## [0.7.97-alpha.9] - 2026-10-19
 
 Ninth alpha of the v0.7.97 line: shared Host Run inspection checks Session