@kodax-ai/kodax 0.7.97-beta.1 → 0.7.97-beta.2

package/CHANGELOG.md

@@ -8,6 +8,67 @@ All notable changes to this project will be documented in this file.
 
 ---
 
+## [0.7.97-beta.2] - 2026-11-04
+
+Second beta of the v0.7.97 line: Script execution reliability hardening —
+VM call paths expose complete collision-safe tool aliases beside original
+names, typed program data carries normalized read windows and trusted
+structured JSON, and duplicate model output is projected only when the
+original receipt stays fully readable. Native tool names are encoded at the
+Anthropic-compatible wire boundary and restore canonical identity, arguments,
+permissions and deltas; an isolated optional sourceContent view preserves
+original content beside display output and JSON data, and Host tools may
+declare outputSchema served on demand through `mcp_describe` without
+enlarging default menus; missing Node globals gain bounded contextual
+guidance without displacing original QuickJS error JSON, settled receipts or
+authorized tool aliases. Shared Host recovery hardens: promoted observers
+refresh, owner-bound pending input recovery is preserved with idempotent
+withdrawal receipts, proven dead history locks are reclaimed, and trusted
+Agent mode is enforced before execution; Host-owned repo diagnostics/prewarm
+and durable Workflow finalization with physical task draining, protected
+project references and precise cleanup retry land. Bounded real-model
+validation records Script model-facing reliability as recommend-iterate
+without efficiency or general intelligence claims. Every v0.7.96 stable and
+v0.7.97-alpha.1 through beta.1 contract is retained. npm publication remains
+a manual maintainer action.
+
+### Fixed
+
+- Harden shared Host recovery and Script lifecycle: refresh promoted
+  observers, preserve owner-bound pending input recovery with persistent
+  idempotent withdrawal receipts, reclaim proven dead history locks, enforce
+  trusted Agent mode before execution, and add Host-owned repo
+  diagnostics/prewarm plus durable Workflow finalization with physical task
+  draining, protected project references and precise cleanup retry.
+- Expose complete VM call paths with collision-safe aliases beside original
+  tool names; carry normalized read windows and trusted structured JSON
+  without parsing presentation, projecting duplicate model output only while
+  full receipts and original readback stay readable.
+- Encode native tool names at the Anthropic-compatible wire boundary and
+  restore canonical identity, arguments, permissions, deltas and opaque
+  history; validate effective forced names against the current canonical
+  menu and document async helper lifetime in the Script code contract.
+- Keep an isolated optional sourceContent view beside display content and
+  JSON data through Script receipts and original-result readers; serve
+  optional Host outputSchema registration through IPC and `mcp_describe`
+  on-demand output contracts without enlarging default menus or adding
+  result validators.
+- Re-audit the CLI startup bundle budget from 5056 kB to 5064 kB (5 MiB minus
+  56 KiB): the Script reliability additions end the five-native release build
+  about 2 kB past the former 64 KiB headroom; audited program data stays in
+  packaged resources and no trimming behavior changes.
+- Keep the structured display section inside the capacity guard: deep-but-valid
+  provider DTOs no longer fail the whole render when local stringify/clone
+  budgets overflow — original tool evidence is retained with the same optional
+  projection warning, and the pilot tests probe the local clone capacity
+  instead of assuming one fixed stack depth.
+- Append bounded runtime and receipt guidance only for exact missing Node
+  globals, preserving original QuickJS error JSON, settled receipts and
+  authorized tool aliases without reading guest globals, displacing original
+  evidence or replaying effects.
+
+---
+
 ## [0.7.97-beta.1] - 2026-11-02
 
 First beta of the v0.7.97 line: Space-facing Host execution and Session

package/README.md

@@ -58,7 +58,10 @@ FEATURE_302 provider/OAuth credential parity stack, and the 2026-11-01
 full-chain audit's Windows recovery, credential and permission fixes;
 the `v0.7.97-beta.1` tag completes the Space-facing Host execution and
 Session seams with Main default Skills, Quick Ask Session promotion and
-atomic core-config publication.
+atomic core-config publication; the `v0.7.97-beta.2` tag hardens Script
+execution reliability with typed program data, native tool-name wire
+fidelity, on-demand output contracts and shared Host recovery/Workflow
+finalization fixes.
 Issue 371's historical first-read latency and Script model-efficiency
 acceptance remain open.
 
@@ -825,6 +828,29 @@ starts, upgrades, or waits. See
 Every v0.7.96 stable and v0.7.97-alpha.1/alpha.2/alpha.3 contract is
 retained.
 
+**v0.7.97-beta.2 release:** Script execution reliability hardening — VM
+call paths expose complete collision-safe tool aliases beside original
+names, typed program data carries normalized read windows and trusted
+structured JSON, and duplicate model output is projected only when the
+original receipt stays fully readable. Native tool names are encoded at
+the Anthropic-compatible wire boundary and restore canonical identity,
+arguments, permissions and deltas; an isolated optional sourceContent
+view preserves original content beside display output, and Host tools
+may declare outputSchema served on demand through `mcp_describe` without
+enlarging default menus; missing Node globals gain bounded contextual
+guidance without displacing original QuickJS error JSON or settled
+receipts. Shared Host recovery refreshes promoted observers, preserves
+owner-bound pending input recovery with idempotent withdrawal receipts,
+reclaims proven dead history locks and enforces trusted Agent mode before
+execution; Host-owned repo diagnostics/prewarm and durable Workflow
+finalization with physical task draining and protected project references
+land. Bounded real-model validation records Script model-facing
+reliability as recommend-iterate; no efficiency or general intelligence
+improvement is claimed. Tagging and publication remain separate. See the
+[v0.7.97-beta.2 release notes](docs/release.md#v0797-beta2-release-preparation).
+Every v0.7.96 stable and v0.7.97-alpha.1 through beta.1 contract is
+retained.
+
 **v0.7.97-beta.1 release:** Space-facing Host execution and Session seams
 complete — Main-owned capability-gated default Skills and consumption-time
 execution bindings select committed expert/connector state with fresh
@@ -2215,7 +2241,7 @@ This development tree exposes 17 SDK subpaths plus the root. Shared product
 applications use `@kodax-ai/kodax/client`; independent libraries and trusted Host
 APIs remain available through the other subpaths. See the [Client contract](docs/CLIENT_CONTRACT.md)
 and [SDK migration guide](docs/SDK_MIGRATION.md). This documentation was checked
-against package version `0.7.97-beta.1`; npm publication is separate from
+against package version `0.7.97-beta.2`; npm publication is separate from
 the current development-tree contract.
 
 ```bash

package/README_CN.md

@@ -51,7 +51,9 @@ CLI 使用 `--work-mode`，REPL 使用 `/work-mode`，Product Client 使用 Sess
 `v0.7.97-alpha.12` 标签发布统一共享 Host 收口、FEATURE_302 供应商/OAuth 凭据
 对齐栈，以及 2026-11-01 全链路审计的 Windows 恢复、凭据与权限修复；
 `v0.7.97-beta.1` 标签完成 Space 侧 Host 执行与会话接缝——Main 默认 Skills、
-Quick Ask Session promotion 与核心配置原子发布。
+Quick Ask Session promotion 与核心配置原子发布;`v0.7.97-beta.2` 标签加固
+Script 执行可靠性——类型化程序数据、原生工具名 wire 保真、按需输出契约与
+共享 Host 恢复/Workflow 终结修复。
 Issue 371 的历史首次读取延迟及 Script 模型效率验收仍未关闭。
 
 ## 30 秒上手
@@ -332,6 +334,21 @@ SDK 系统代码契约更新，但没有放宽 shell/sandbox 的 fail-closed 边
 [v0.7.97-alpha.4 发布清单](docs/release.md#v0797-alpha4-release-preparation)。
 所有 v0.7.96 稳定与 v0.7.97-alpha.1/alpha.2/alpha.3 契约全部保留。
 
+**v0.7.97-beta.2 发布**：Script 执行可靠性加固——VM 调用路径在原名之外提供
+无冲突安全别名,类型化程序数据承载规范化读取窗口与可信结构化 JSON,仅在原
+回执保持完整可读时才投影重复的模型输出。原生工具名在 Anthropic 兼容 wire
+边界编码并恢复 canonical 身份、参数、权限与增量;独立可选 sourceContent 视图
+在展示输出之外保留原文,Host 工具可声明 outputSchema 经 `mcp_describe` 按需
+返回而不扩大默认菜单;缺失 Node 全局仅追加有界上下文指引,不覆盖原始 QuickJS
+错误 JSON 或已定回执。共享 Host 恢复刷新已提升观察者、以幂等撤回回执保留
+owner 绑定的 pending 输入恢复、回收已证死锁并在执行前核验可信 Agent 模式;
+Host 自有的 repo 诊断/预热与持久 Workflow 终结（物理任务排空、受保护项目
+引用）一并落地。有界真实模型验证将 Script 面向模型的可靠性记为
+recommend-iterate,不宣称效率或通用智能提升。代码提交、版本标签与实际发布
+分别判断。
+详见 [v0.7.97-beta.2 发布清单](docs/release.md#v0797-beta2-release-preparation)。
+所有 v0.7.96 稳定与 v0.7.97-alpha.1 至 beta.1 契约全部保留。
+
 **v0.7.97-beta.1 发布**：Space 侧 Host 执行与会话接缝收尾——Main 持有的
 能力门禁默认 Skills 与消费时执行绑定在实际 Product 输入消费点选取已提交
 专家/连接器状态并重新获取凭证/工具 lease;Quick Ask 通过 Host 掌握的修订

package/dist/chunks/agent-DS7M57WD.js

@@ -0,0 +1,2 @@
+// @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
+import{Ba as d,Ca as e,Da as f,Fb as k,_a as g,ab as h,xb as i,yb as j}from"./chunk-D36OIMV7.js";import"./chunk-BBZWF2EA.js";import"./chunk-F6GJXQNA.js";import"./chunk-XDMNJW6J.js";import"./chunk-RYBUYHDL.js";import"./chunk-4Y6U7AH4.js";import{a as c}from"./chunk-EPK6EWRI.js";import"./chunk-ISLK6R2P.js";import"./chunk-OGTRDK4Q.js";import"./chunk-GZUWQZJD.js";import"./chunk-W2CWO4PQ.js";import"./chunk-TQ475LOI.js";import"./chunk-65652LR4.js";import"./chunk-5MUVRFMU.js";import{Lb as a,Mb as b}from"./chunk-2HH5AS7E.js";import"./chunk-J2L2NK6E.js";import"./chunk-KDSO7V4O.js";import"./chunk-SK3RRGHJ.js";import"./chunk-WMMESRP3.js";import"./chunk-QP47JIWP.js";import"./chunk-52EN2777.js";import"./chunk-UF3GZ5PO.js";import"./chunk-KE2NBMAP.js";import"./chunk-V5RCDBKU.js";import"./chunk-KDLOPBFZ.js";import"./chunk-V4WSBIXB.js";export{e as bucketProviderPayloadSize,g as buildAutoRepoIntelligenceContext,f as checkPromiseSignal,b as cleanupIncompleteToolCalls,h as describeTransientProviderRetry,c as emitResilienceDebug,d as estimateProviderPayloadBytes,k as runKodaX,j as saveRequiredSessionSnapshot,i as saveSessionSnapshot,a as validateAndFixToolHistory};

package/dist/chunks/agent-adapter-TLWGGK3V.js

@@ -0,0 +1,2 @@
+// @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
+import{a,b}from"./chunk-DV5YPYLW.js";import"./chunk-XDMNJW6J.js";import"./chunk-OGTRDK4Q.js";import"./chunk-GZUWQZJD.js";import"./chunk-65652LR4.js";import"./chunk-5MUVRFMU.js";import"./chunk-2HH5AS7E.js";import"./chunk-J2L2NK6E.js";import"./chunk-KDSO7V4O.js";import"./chunk-SK3RRGHJ.js";import"./chunk-WMMESRP3.js";import"./chunk-QP47JIWP.js";import"./chunk-52EN2777.js";import"./chunk-UF3GZ5PO.js";import"./chunk-KE2NBMAP.js";import"./chunk-V5RCDBKU.js";import"./chunk-KDLOPBFZ.js";import"./chunk-V4WSBIXB.js";export{b as createCodingWorkflowBackend,a as resumeWorkflowGenerationTurn};

package/dist/chunks/argument-completer-OGCXKTRQ.js

@@ -0,0 +1,2 @@
+// @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
+import{ab as a,bb as b}from"./chunk-MCDZNQWD.js";import"./chunk-ZQYWDI4O.js";import"./chunk-EISRVOBJ.js";import"./chunk-DCE7XQUG.js";import"./chunk-QSZCR5GC.js";import"./chunk-V2XJSFFE.js";import"./chunk-JAF2YLZO.js";import"./chunk-DV5YPYLW.js";import"./chunk-X5M7TLJV.js";import"./chunk-C6JGLEYD.js";import"./chunk-D36OIMV7.js";import"./chunk-BBZWF2EA.js";import"./chunk-F6GJXQNA.js";import"./chunk-XDMNJW6J.js";import"./chunk-RYBUYHDL.js";import"./chunk-4Y6U7AH4.js";import"./chunk-EPK6EWRI.js";import"./chunk-ISLK6R2P.js";import"./chunk-OGTRDK4Q.js";import"./chunk-GZUWQZJD.js";import"./chunk-W2CWO4PQ.js";import"./chunk-TQ475LOI.js";import"./chunk-65652LR4.js";import"./chunk-5MUVRFMU.js";import"./chunk-2HH5AS7E.js";import"./chunk-J2L2NK6E.js";import"./chunk-KDSO7V4O.js";import"./chunk-SK3RRGHJ.js";import"./chunk-WMMESRP3.js";import"./chunk-QP47JIWP.js";import"./chunk-52EN2777.js";import"./chunk-UF3GZ5PO.js";import"./chunk-KE2NBMAP.js";import"./chunk-V5RCDBKU.js";import"./chunk-KDLOPBFZ.js";import"./chunk-V4WSBIXB.js";export{a as ArgumentCompleter,b as createArgumentCompleter};

package/dist/chunks/{cell-ABNYMGXV.js → cell-LV7MNPNQ.js}

@@ -1,2 +1,2 @@
 // @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
-import{a,b,c}from"./chunk-ED7D73C3.js";import"./chunk-65652LR4.js";import"./chunk-V4WSBIXB.js";export{c as resolveScriptWorkerUrl,b as runScriptCell,a as validateScriptCell};
+import{a,b,c}from"./chunk-TQ475LOI.js";import"./chunk-65652LR4.js";import"./chunk-V4WSBIXB.js";export{c as resolveScriptWorkerUrl,b as runScriptCell,a as validateScriptCell};