arcane-os 0.88.1 → 0.90.0

package/docs/reference/sdk-api.md

@@ -1857,7 +1857,7 @@ create `arcane.lock.json` before serving, refreshing app import maps, or packagi
 ### Signature and result
 
 ```text
-async materializeInstalledSdkRuntime({workspaceRoot,sdkPackageSource,workspaceOperationLease,signal,onEvent}={})
+async materializeInstalledSdkRuntime({workspaceRoot,sdkPackageSource,browserDecisions=false,workspaceOperationLease,signal,onEvent}={})
 ```
 
 Import it through the exact dependency key declared by the workspace: normally
@@ -1868,6 +1868,16 @@ whole-tree replacement. The mutable result includes the installed-package
 location, materialized workspace runtime paths, and `workspaceLock` path and
 document. It does not install dependencies or merge application source.
 
+Explicit `browserDecisions: true` also acquires the bundled Transformers.js
+4.3.0 entry and matching ONNX Runtime 1.31.0-dev.20260914-8d85527a0 asyncify
+module/WASM and license files from their upstream distributions into
+`arcane/sdk/ai/decisions-runtime/`. It returns their `directory`,
+`transformersVersion`, `onnxRuntimeVersion` and `files` under
+`workspaceRuntime.browserDecisions`. The default `false` performs no optional
+acquisition. Select this option on each refresh that should retain those files.
+The [extension-local decision guide](ai/browser-decisions.md#extension-local-executables-manifest-v3)
+describes `runtime.local: true`, complete resource ownership and MV3 usage.
+
 Ordinary acquisition automatically recovers a workspace-operation lock when
 the recorded owner process is confirmed absent, without waiting solely for its
 six-hour expiry. Retry this public operation normally; `workspaceOperationLease`
@@ -1910,13 +1920,24 @@ the installed-package lock document owned by `materializeInstalledSdkRuntime()`.
 ### Signature and result
 
 ```text
-async materializeWorkspaceRuntimeContent({workspaceRoot,runtimeRoot=path.join(getSdkRoot(), 'runtime'),browserRuntimeRoot=getSdkBrowserRuntimeRoot(),signal,onEvent}={})
+async materializeWorkspaceRuntimeContent({workspaceRoot,runtimeRoot=path.join(getSdkRoot(), 'runtime'),browserRuntimeRoot=getSdkBrowserRuntimeRoot(),sdkVersion=SDK_VERSION,browserDecisions=false,signal,onEvent}={})
 ```
 
 The operation stages the complete projection, replaces the prior tree at the
 commit boundary, restores it if commit fails, and removes paths absent from the
 selected sources.
 
+`browserDecisions: true` acquires the same upstream executable closure described
+by `materializeInstalledSdkRuntime()` before replacement. Its result is at
+`result.browserDecisions` because this lower-level operation returns the
+workspace runtime directly. Full downloaded content remains unchanged; model
+and tokenizer data are not materialized. `workspace.decisions.started` and
+`workspace.decisions.progress` report completed files and the fixed total.
+Cancellation, HTTP failures and throwing/rejecting observers abort and join
+pending acquisitions before returning; the prior runtime remains in place.
+An HTTP failure retains its complete response in `error.response`, or in the
+corresponding member of `AggregateError.errors` when several operations fail.
+
 ### Availability and normalization
 
 **Node.** Complete workspace runtime content and a mutable materialization result. Deep protocol: [Installed SDK runtime materialization](protocols.md#installed-sdk-runtime-materialization).
@@ -3810,12 +3831,21 @@ async repositoryPull({ workspaceRoot=process.cwd(), target, signal, onEvent, run
 
 Import it from `arcane-os`. The signature above states whether settlement is synchronous or promise-based. The overview and owning group define result authority, side effects, callbacks, events, cancellation, and lifecycle.
 
-Optional `target:{remote,ref}` captures exact nonempty native-representable
-strings before any wait and selects `git pull --ff-only -- <remote> <ref>:`.
+Optional `target:{remote,ref,remoteBase?}` captures the exact nonempty
+native-representable `remote` and `ref` strings before any wait and selects
+`git pull --ff-only -- <remote> <ref>:`.
 The current clean branch receives a fast-forward-only integration; the SDK
 never switches branches, resets or changes configuration. Without a target,
 the existing configured pull and result remain unchanged. Targeted results
 add `target`, complete `stdout` and `stderr` to the existing pull result.
+
+Supplying `target.remoteBase` explicitly selects a local filesystem locator:
+only the Git remote argument becomes `path.resolve(remoteBase, remote)`, captured
+once at acceptance before status work. Relative bases, including `''`, use the
+working directory at that moment. The returned target retains the original
+`remote`, `ref` and supplied base text. Omission preserves Git remote names,
+URLs, SCP-like addresses and remote-helper strings without guessed parsing.
+Unrepresentable base text reports `TypeError` without transformation.
 See [checkout configuration and selected targets](core-repositories.md#existing-checkout-configuration-and-selected-targets).
 
 ### Availability and normalization
@@ -3856,20 +3886,29 @@ detached HEAD, then, without `target`, runs plain `git push`; the repository's c
 configured upstream/remote, Git credentials, hooks, and server policy remain
 authoritative. Unlike `repositoryPull()`, this function does **not** require a
 clean worktree. It does not create a commit or choose an application destination.
-Optional `target:{remote,ref}` captures the original nonempty
-native-representable strings before any wait and runs
+Optional `target:{remote,ref,remoteBase?}` captures the original nonempty
+native-representable `remote` and `ref` strings before any wait and runs
 `git push --no-follow-tags -- <remote> HEAD:<ref>`. This publishes current HEAD
 to the caller-selected ref without force or implicit configured tag following.
 It changes no branch or Git configuration; credentials, URL interpretation,
 hooks and remote rejection remain Git-owned.
 
+Supplying `target.remoteBase` explicitly selects a local filesystem locator:
+only the Git remote argument becomes `path.resolve(remoteBase, remote)`, captured
+once at acceptance before status work. Relative bases, including `''`, use the
+working directory at that moment. Later directory or target-object changes do
+not redirect accepted work. Omission preserves Git remote names, URLs, SCP-like
+addresses and remote-helper strings without guessed parsing. Unrepresentable
+base text reports `TypeError` without transformation.
+
 The promise resolves to
 `{action:'push', repositoryRoot, branch, output}`. `output` is trimmed stdout,
 or trimmed stderr when stdout is empty. A missing Git executable, failed status
 probe, rejected/nonzero push, cancellation, or event-callback failure rejects
 with the normalized process error. Cancellation stops the local process tree;
 it cannot prove that a remote accepted no objects before the interruption.
-Targeted results also contain the captured `target` and complete
+Targeted results also contain the captured `target`, retaining original
+`remote`, `ref` and any supplied `remoteBase`, and complete
 `stdout`/`stderr`; omitting the target preserves the existing result shape.
 See [checkout configuration and selected targets](core-repositories.md#existing-checkout-configuration-and-selected-targets).
 
@@ -5346,7 +5385,7 @@ a dedicated bare Git cache. It does not create or alter a working checkout.
 ### Signature, lifecycle, and result
 
 ```text
-createGitTextSnapshot({cacheDirectory,remote,ref,selectPath,gitIdentity,onEvent,run=runProcess}={})
+createGitTextSnapshot({cacheDirectory,remote,remoteBase,ref,selectPath,gitIdentity,onEvent,run=runProcess}={})
 ```
 
 Import from `arcane-os`. The application owns the cache location, remote, ref,
@@ -5358,6 +5397,16 @@ await accepted refresh/process cleanup. Errors remain observable instead of
 returning stale or partial success. See [Git text snapshots](git-text-snapshot.md)
 for complete inputs, text semantics, errors, events and Core service composition.
 
+Optional `remoteBase` explicitly selects `remote` as a local filesystem locator.
+Only its Git fetch argument is derived using `path.resolve(remoteBase, remote)`,
+once at construction, independently of the cache location and later changes to
+the working directory. Relative bases, including `''`, use the construction-time
+working directory. Original locator/options remain unchanged. Omission preserves
+Git remote names, URLs, SCP-like addresses and remote-helper strings without
+guessed parsing. Unrepresentable base text reports `TypeError` without
+transformation; actual Git failures retain their existing error behavior.
+See [relative local repository locators](core-repositories.md#relative-local-repository-locators).
+
 Optional `gitIdentity:{name?,email?,username?}` captures a child-process-only
 selection for init/fetch and subsequent Git commands, preserving shared refresh
 cancellation and complete content. See [Git identity configuration](core-repositories.md#git-identity-configuration)
@@ -7122,6 +7171,21 @@ no engine. The native routes of `AI.fetchTTS(payload, signal)` and
 `AI.fetchSTT(audio, signal)` forward their signals through these calls and
 normalize cancellation to `AbortError` with `ARCANE_AI_REQUEST_ABORTED`.
 
+`facade.window.state({signal}?)` reads the calling document's native window;
+`facade.window.setState({state}, {signal}?)` selects `normal`, `maximized` or
+`fullscreen` for that same window. The matching Windows host returns
+`{platform:'windows', supported:true, state}`, with observed `state` also able
+to be `minimized`. Fullscreen removes the frame and fills the selected monitor;
+leaving it restores the preceding normal bounds and frame controls before any
+requested maximization. Visible state transitions prevent activation/focus
+assignment to the requesting window without changing TopMost, Core, origin or
+profile. Optional `native.window.state` selects startup state after initial
+sizing; omission preserves host behavior. Saved Settings remain application-owned.
+Cancellation does not undo an already-applied change. Other hosts retain their
+actual unavailable-method/transport errors; the facade provides no fallback.
+See [current-window state](core-client.md#current-window-state) for complete
+native errors, partial-state evidence, navigation and cleanup ownership.
+
 `facade.window.setTheme(presentation, {signal}?)` forwards the complete
 presentation to the current native window, independently of OS-user appearance.
 Optional `backgroundColor` and `textColor` accept `{red,green,blue,alpha}` or
@@ -7777,6 +7841,17 @@ published SDK/runtime dependencies and the canonical Core entry/client into a
 fresh output directory. Service factories are imported only when a real native
 host later launches the generated Core entry, never during packaging.
 
+The generated `runtime/arcane-core.mjs` also accepts
+`--arcane-app-entry <app-relative-module>` through the host's supported Node
+executable; the portable provider supplies no executable. Include that module
+and its complete source closure through `package.nativeResources`. The flag
+imports it from the packaged `app/` directory, preserves complete `process.argv`,
+and runs its top-level work rather than invoking an export or making it
+`import.meta.main`. The entry owns explicit launch-context reads, services,
+signals and shutdown; ordinary Core startup is skipped only in this mode.
+See [app-owned runtime entry](core-native-packaging.md#app-owned-runtime-entry)
+and [packaged MCP commands and lifetime](mcp-stdio.md#launch-from-a-native-package).
+
 Explicit `native.launchContext.coreListener:{endpoint}` also composes one passive
 model observation service after `startCoreHost()` and before listener binding,
 using that runtime and existing services exposing `localai.status`, `image.status`
@@ -7784,11 +7859,13 @@ and `decisions.status`. Missing owners remain `null`; renderer attachment stays
 application-owned. Ordinary stdio and shared/headless branches gain no model
 startup or readiness barrier. See [native observation composition](core-native-packaging.md#launch-time-locations).
 
-An optional `appDescriptor.native.window` record carries `width`, `height` and
-`resizable` into `manifest.window`. Dimensions are positive integral logical
-client units; `resizable` is an optional boolean. Omitted fields remain omitted.
-The portable payload records the selection; the selected platform host owns
-its window behavior. See [initial native window size](core-native-packaging.md#initial-native-window-size).
+An optional `appDescriptor.native.window` record carries `width`, `height`,
+`resizable` and `state` into `manifest.window`. Dimensions are positive integral
+logical client units; `resizable` is an optional boolean, and `state` selects
+`normal`, `maximized` or `fullscreen`. Omitted fields remain omitted. The portable
+payload records the selection; the matching Windows host applies it, while
+current other-platform hosts retain their existing window behavior. See
+[initial native window size and state](core-native-packaging.md#initial-native-window-size).
 
 ### Availability and normalization
 
@@ -7905,11 +7982,25 @@ The matching Windows host consumes `appDescriptor.native.window` through
 `manifest.window`. Optional `width` and `height` select initial client dimensions
 in 96-DPI logical units; the host scales them for its actual DPI and fits the
 outer window within the current screen's usable area. Optional `resizable:false`
-selects a fixed-size border and disables maximizing. Omitted fields preserve
-the existing host defaults. Initial sizing preserves a window already restored
-to a non-normal state and does not add saved-bounds storage. The initial-fit
-logic is not reapplied during later user resizing. See [initial native window size](core-native-packaging.md#initial-native-window-size)
-for a complete descriptor example and the other-platform boundary.
+selects a fixed-size border and disables the maximize control. Optional `state`
+selects `normal`, `maximized` or `fullscreen`; the host applies an explicit state
+after its initial sizing pass and before the composing launcher's `Load` handler.
+Initial sizing runs only for a Normal window. Omitted fields preserve existing
+host choices, including the current state when `state` is omitted. Fullscreen
+retains normal bounds and frame controls for restoration. No saved-bounds store
+is added, and initial-fit logic is not reapplied during later user resizing.
+See [initial native window size and state](core-native-packaging.md#initial-native-window-size)
+for the complete descriptor and unchanged other-platform behavior.
+
+The packaged `runtime/ArcaneCore.exe` also accepts
+`--arcane-app-entry <app-relative-module>` directly, without a script argument
+or the GUI launcher. Include the entry and complete source closure through
+`package.nativeResources`. It imports the selected packaged `app/` module with
+complete `process.argv` unchanged, running top-level work without invoking an
+export or making it `import.meta.main`. The entry owns explicit launch-context
+reads, services, signals and shutdown; this mode skips ordinary Core startup,
+while omission retains it. See [app-owned runtime entry](core-native-packaging.md#app-owned-runtime-entry)
+and [packaged MCP commands and lifetime](mcp-stdio.md#launch-from-a-native-package).
 
 The returned `arcane-native-builder/1` provider exposes `describe`, `doctor`,
 `prepare`, `build`, `verify` and `run`. Build returns `{app,target,manifest}`
@@ -8285,7 +8376,7 @@ explicit existing path. The application owns the remote, branch and Core API.
 ### Signature and result
 
 ```text
-createRepositoryWorkspace({name,directory,dataRoot,remote,branch,longPaths,gitIdentity,onEvent,run=runProcess}={})
+createRepositoryWorkspace({name,directory,dataRoot,remote,remoteBase,branch,longPaths,cloneIdentity,gitIdentity,onEvent,run=runProcess}={})
 ```
 
 Returns `{directory,open,status,configuration,pull,push,write,close,drain,dispose}`. Construction does
@@ -8296,6 +8387,16 @@ work and preserves the checkout. No CLI cwd, launch state, preference, snapshot
 cache or existing user-data location changes. See the [complete inputs, results,
 errors and lifecycle](core-repositories.md#one-connected-working-checkout).
 
+Optional factory `remoteBase` explicitly selects the initial-clone `remote` as
+a local filesystem locator. Only its Git argument is derived through the host's
+native `path.resolve(remoteBase, remote)`, once at construction. Relative bases,
+including `''`, use the construction-time working directory. The caller's
+original locator remains unchanged; Git clone may save the derived argument as
+its ordinary origin setting. Omission preserves Git remote names, URLs, SCP-like
+addresses and remote-helper strings without guessed parsing. Unrepresentable
+base text reports `TypeError` without transformation.
+See [relative local repository locators](core-repositories.md#relative-local-repository-locators).
+
 Optional `longPaths` captures a boolean for new Windows clones. Explicit true
 or false supplies clone-local `core.longpaths` before the first checkout and
 persists it only in the new repository. Omission preserves inherited/template
@@ -8304,6 +8405,16 @@ unchanged; no global setting or data migration is performed. Git's ordinary
 configuration precedence, hooks and single-clone lifecycle remain in effect.
 See [Windows long paths](core-repositories.md#windows-long-paths-for-a-new-checkout).
 
+Optional `cloneIdentity:{name?,email?}` captures exact author strings and saves
+only supplied fields in a newly created checkout through Git's `clone --config`
+before its first checkout, on every supported platform. Empty strings are
+explicit values; omitted or `undefined` fields preserve inherited and template
+configuration. Existing repositories are never reconfigured. Unrepresentable
+process arguments fail without changing the supplied text. This option changes
+no global configuration, credentials, remote or branch, and does not identify
+the authenticated account. Command-local `gitIdentity` remains independent.
+See [clone-local author selection](core-repositories.md#clone-local-author-selection).
+
 Optional `gitIdentity:{name?,email?,username?}` captures explicit non-secret
 settings for child Git operations without writing global/local configuration.
 Selected author fields override inherited child author/committer fields;
@@ -8321,11 +8432,15 @@ reports `ARCANE_GIT_CONFIGURATION_NOT_TEXT` with full diagnostics.
 
 `pull({target,signal})`, `push({target,signal})` and
 `write({files:[{path,content}],message,target,signal})` accept optional
-`target:{remote,ref}`, captured as original strings at acceptance. The target
+`target:{remote,ref,remoteBase?}`, captured as original strings at acceptance. The target
 selects a fast-forward-only pull into the current branch or a non-force push
 of current HEAD to the selected ref, without switching branches or changing
-configuration. It is independent of initial-clone `remote`/`branch`; omission
-preserves ordinary configured behavior. See the [complete configuration and
+configuration. An operation's own `remoteBase` declares local-path intent and
+captures the native absolute Git argument once at acceptance, before queueing.
+It is independent of initial-clone `remote`/`remoteBase`/`branch`; omission of
+`target` preserves ordinary configured behavior. Targeted pull/push results and
+writer results/failure outcomes retain original `remote`, `ref` and any supplied
+`remoteBase`, including relative or empty base text. See the [complete configuration and
 target contract](core-repositories.md#existing-checkout-configuration-and-selected-targets).
 
 `write` snapshots the exact selected
@@ -8396,15 +8511,16 @@ Construction selects no model and installs no runtime or transport.
 ### Signature and result
 
 ```text
-createCoreLocalAIProvider({client,id='llama.cpp'}={})
+createCoreLocalAIProvider({client,id='llama.cpp',prepareModel}={})
 ```
 
 Import it from `arcane-os/ai/core-local`. The provider implements
 `arcane-ai-provider/2` and exposes `catalog`, `status`, `inspect`, `load`,
 `request`, `unload` and `dispose`. Register it with the shared AI provider runtime,
 select the exact provider/model with `localOnly:true`, and load that selection.
-Requests wait for the requested model's actual readiness, preserve complete
-payloads and parsed streaming chunks, and cancel on observed readiness loss.
+`load()` waits for the selected model's actual readiness; inference requests
+require that load to have completed successfully. Requests preserve complete
+payloads and parsed streaming chunks and cancel on observed readiness loss.
 Missing Core reports unavailability; it does not choose a browser or cloud route.
 Dispose/unregister at the caller's owning lifecycle boundary.
 
@@ -8418,6 +8534,17 @@ client, so never-loaded and already-unloaded providers send no native unload.
 The provider/2 runtime reconciles status at its operation boundaries; this
 does not add an idle role-state subscription.
 
+Optional `prepareModel({selection,signal,progress})` runs at actual load and
+returns `{assetProjectionId,resourcePaths,executionTarget,release?}`. Direct
+`load` fields with those names override preparation when defined; an explicit
+`executionTarget:null` requests the runtime default. Preparation release is
+awaited after native load settles, including failure, cancellation and late
+preparation results. The current successfully completed load owns readiness
+and inference; a failed replacement cannot reuse an older model's ready state.
+Native cleanup owns the last dispatched selection, while preparation alone
+creates no native unload obligation. `status().execution` forwards native
+execution diagnostics, including configured and observed targets separately.
+
 ```javascript
 import {createCoreLocalAIProvider} from 'arcane-os/ai/core-local';
 import {getAIProviderRuntime} from 'arcane-os/ai-provider-runtime';
@@ -8440,7 +8567,7 @@ separate states; prompts, models and application policy remain caller-owned.
 ### Signature and result
 
 ```text
-createLocalAIService(configuration,{appRoot,runtimes=[],signal,onEvent,prepare}={})
+createLocalAIService(configuration,{appRoot,runtimes=[],signal,onEvent,prepare,executionDevices}={})
 ```
 
 Import it from `arcane-os/core/local-ai`. `configuration` is the authored local-AI
@@ -8473,6 +8600,19 @@ Explicit load retains startup and exact catalog-membership checks.
 carry original parsed chunks with `streamId`; terminal responses remain complete.
 There is no background health polling or implicit model choice.
 
+For managed llama.cpp loading, `llama.load` also accepts `assetProjectionId`,
+`resourcePaths:{model}` and `executionTarget`. The existing model-assets owner
+retains the exact projected GGUF through actual server exit. An omitted target
+retains the same model's selection or configured default; `null` requests the
+runtime default. `{deviceId}` uses this computer's execution-device catalog.
+Windows NVIDIA selection resolves that physical device to its CUDA identity;
+unsupported or unavailable targets report their actual failure. Runtime
+`execution` reports requested, resolved and configured targets with
+`observedTarget:null`; configuration does not establish physical execution.
+An optional `executionDevices` catalog is borrowed by ONNX and llama.cpp; its
+supplying owner retains disposal responsibility. Existing external listeners
+retain their own model/device selection and reject managed reconfiguration.
+
 ```javascript
 import {createLocalAIService} from 'arcane-os/core/local-ai';
 
@@ -8905,7 +9045,7 @@ import createLocalAIService from 'arcane-os/core/local-ai';
 
 ### Overview
 
-Reuses matching managed runtimes or installs complete selected official
+Reuses matching managed runtimes or installs complete selected
 llama.cpp/Ollama/ONNX/image distributions or NeMo libraries in an explicitly supplied directory.
 
 ### Signature and result
@@ -8918,14 +9058,22 @@ Import it from `arcane-os/local-ai`. Runtime requirements accept IDs or
 `{id,version?,url?}` records. The result is an array of absolute
 `{id,version,platform,architecture,root}` records, with `executable` for servers,
 `modulePath` for ONNX, image `libraryPath`/`bindingModulePath`/`variants`/`models`,
-or NeMo library directories. Image requirements also accept `backend` and
+or NeMo library directories. The SDK-selected Windows x64 ONNX `1.30.0`
+distribution also returns `nativeDistributionRevision: '1.30.0-directml-reshape-1'`.
+With no explicit `url`, an omitted ONNX version or explicit `1.30.0` selects
+the corrected native archive from the installed SDK's numeric release.
+Other ONNX versions, platforms/architectures and explicit URLs retain their
+upstream package path. Reuse requires the selected revision; older installation
+trees remain intact while a fresh installation is prepared. See
+[ONNX runtime preparation](local-ai.md#development).
+Image requirements also accept `backend` and
 `models`; their pinned default runtime, CPU/Metal selection and separate model
 preparation are described in [local image generation](local-image-generation.md).
 Matching concurrent
 installs share their work. Downloads retain runtime libraries and surface
 network/archive failures; cancellation and operation events remain observable.
 Installation changes no global PATH or system service and loads no model.
-Supported assets belong to the selected upstream distribution; see
+Supported assets belong to the selected distribution; see
 [platform and archive requirements](local-ai.md#native-bundling).
 
 ```javascript
@@ -8959,6 +9107,11 @@ contains the complete emitted inventory. Existing runtime destinations are
 preserved and reported as a conflict. Copying settles all started work and
 reports failures/cancellation without executing app services or models.
 
+The corrected Windows x64 ONNX selection retains its
+`nativeDistributionRevision` and complete native libraries. Its `modulePath`
+is relocated with the other runtime paths; bundling introduces no separate
+runtime selection. See [ONNX runtime preparation](local-ai.md#development).
+
 Image records relocate the complete library, binding and variant paths. Model
 URL descriptors retain their original acquisition metadata for preparation
 after launch. Runtime-contained native model paths become artifact-relative;
@@ -9156,7 +9309,8 @@ portable Node local IPC; other native host adapters do not yet implement these
 document operations. No application is launched, no desktop window is activated,
 and no automatic reconnect or action retry occurs.
 
-`status(options)` reports current app/window/document readiness.
+`status(options)` reports current app/window/document readiness, including
+observed window state `Normal`, `Maximized`, `Minimized` or `Fullscreen`.
 `inspect(parameters={},options)` returns complete selected DOM HTML/text
 and live control state. Inspection and actions accept optional `shadowPath`, an
 ordered array of unique CSS host selectors through open shadow roots; their
@@ -9171,7 +9325,8 @@ of the rendered viewport. `act(parameters,options)` requires a returned
 fields.
 
 `key(parameters,options)` requires the observed `documentGeneration` and
-`key:'Tab'`, `'Enter'` or `'Space'`; `shiftKey:true` is supported only for Tab.
+`key:'Tab'`, `'Enter'`, `'Space'` or `'Escape'`; `shiftKey:true` is supported only
+for Tab.
 It sends a fixed ordered press/release pair to the selected WebView's current
 focus, without selecting an element or activating the desktop window. Accepted
 pairs share one keyboard owner. Once a press is attempted, its matching release
@@ -9183,9 +9338,9 @@ or navigation can change between phases.
 
 `resize(parameters,options)` accepts positive integral native client `width`
 and `height` supported by WinForms, plus optional `documentGeneration`. It changes
-only `ClientSize` while the actual window is `Normal`; maximized or minimized
-windows fail before size mutation. Results retain immediate `previous`/`actual`
-native dimensions, requested dimensions, attempted/completed flags and a later
+only `ClientSize` while the actual window is `Normal`; maximized, minimized or
+fullscreen windows fail before size mutation. Results retain immediate
+`previous`/`actual` native dimensions, requested dimensions, attempted/completed flags and a later
 observed CSS `viewport`. Platform constraints can change actual dimensions;
 native and CSS observations are not an atomic snapshot. Restore explicitly with
 the same operation's `previous.width` and `previous.height`, not CSS dimensions
@@ -9990,9 +10145,21 @@ selections report its failure without precision fallback. For Laya FP32, pass
 Cancellation terminates that client's Worker and rejects its in-flight work.
 No decisions are inserted into chat history or durable storage.
 
+For explicitly selected extension-local execution, supply `runtime: {local:
+true}` after materializing with `browserDecisions: true`. The SDK directly
+imports its deployment-local `decisions-runtime/transformers.min.js` and
+matched asyncify module/WASM. Explicit `runtime.moduleUrl` and
+`runtime.wasmPaths: {mjs, wasm}` may select other compatible files in that same
+deployment; a directory string is also accepted for `wasmPaths`. This mode
+disables executable Blob preparation and upstream WASM cache/proxy creation,
+selects one WASM thread, and preserves the caller's model, precision and
+inference backend. With `store`, only the exact selected executable URLs bypass
+it; model, tokenizer, configuration and external-data resources retain that
+store. Local mode is opt-in; default browser behavior remains unchanged.
+
 Optional `store` is an existing SDK DBOPFS model or speech store exposing
 `fetchResource(input, options)`. It remains outside cloned Worker configuration.
-Explicit activation first stores the complete selected `runtime.moduleUrl`
+Without `runtime.local`, explicit activation first stores the complete selected `runtime.moduleUrl`
 entry and materializes it as a JavaScript object URL without rewriting source.
 The configured original URL remains the resource selection for later loads.
 The selected loader also routes its actual model/configuration/tokenizer

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcane-os",
-  "version": "0.88.1",
+  "version": "0.90.0",
   "description": "Arcane OS JavaScript SDK, project-local CLI, browser runtime, and repository-portable application packager.",
   "type": "module",
   "main": "./src/index.mjs",
@@ -129,7 +129,7 @@
   "scripts": {
     "test": "npm run test:unit && npm run test:functional && npm run test:integration && npm run test:regression",
     "test:release": "node ./bin/arcane-test.mjs test/npm-release.test.mjs",
-    "test:unit": "node ./bin/arcane-test.mjs test/app-descriptor.test.mjs test/app-schema.test.mjs test/app-selection.test.mjs test/contracts.test.mjs test/conversation-closing-report.test.mjs test/doctor.test.mjs test/mail-credentials.test.mjs test/mail-outbox.test.mjs test/mail-public-api.test.mjs test/mail-send.test.mjs test/mail-transport.test.mjs test/native-windows-icon.test.mjs test/targets.test.mjs test/workspace-operation-lock.test.mjs",
+    "test:unit": "node ./bin/arcane-test.mjs test/app-descriptor.test.mjs test/app-schema.test.mjs test/app-selection.test.mjs test/contracts.test.mjs test/conversation-closing-report.test.mjs test/doctor.test.mjs test/mail-credentials.test.mjs test/mail-outbox.test.mjs test/mail-public-api.test.mjs test/mail-send.test.mjs test/mail-transport.test.mjs test/native-windows-icon.test.mjs test/risk-signal-analyzer.test.mjs test/targets.test.mjs test/workspace-operation-lock.test.mjs",
     "test:functional": "node ./bin/arcane-test.mjs test/ai-ollama-readiness.test.mjs test/core-ollama-lifecycle.test.mjs test/ai-request-model.test.mjs test/ai-request-retry.test.mjs test/ai-stream-cancellation.test.mjs test/browser-decisions.test.mjs test/browser-kokoro-complete-input.test.mjs test/browser-speech-providers.test.mjs test/browser-speech-artifacts.test.mjs test/browser-speech-resource-bridge.test.mjs test/browser-wasm-gpu-notice.test.mjs test/browser-wasm-download-resume.test.mjs test/chat-input.test.mjs test/chat-stream-speech.test.mjs test/chat-transcript-scroll.test.mjs test/chat-transient-retention.test.mjs test/cli.test.mjs test/continuous-voice-capture.test.mjs test/codex-app-server.test.mjs test/mcp-stdio-server.test.mjs test/core-classic-source.test.mjs test/core-client.test.mjs test/core-client-installation.test.mjs test/core-ai-installation.test.mjs test/core-llama-lifecycle.test.mjs test/core-development.test.mjs test/core-host.test.mjs test/core-shared-host.test.mjs test/core-model-assets.test.mjs test/core-native-services.test.mjs test/core-packaged-web.test.mjs test/core-runtime.test.mjs test/core-stdio.test.mjs test/dbopfs-committed-events.test.mjs test/dbopfs-document-library.test.mjs test/dbopfs-model-resources.test.mjs test/dbopfs-png.test.mjs test/dbopfs.test.mjs test/dev-server.test.mjs test/dev-pwa.test.mjs test/document-acquisition.test.mjs test/dom-event-instrumentation.test.mjs test/event-manager.test.mjs test/events.test.mjs test/execution-devices.test.mjs test/file-preview.test.mjs test/import-map.test.mjs test/local-image-editing.test.mjs test/mail-cli.test.mjs test/mail-runtime.test.mjs test/mail-server.test.mjs test/markdown-editor.test.mjs test/markdown-media.test.mjs test/markdown-source-map.test.mjs test/modal.test.mjs test/model-resource-bridge.test.mjs test/native-decisions.test.mjs test/native-onnx.test.mjs test/native-module-packaging.test.mjs test/native-module-resource-references.test.mjs test/packaging.test.mjs test/pwa-packaging.test.mjs test/pwa-client.test.mjs test/pwa-install.test.mjs test/pwa-worker.test.mjs test/persistent-ai-chat-session.test.mjs test/reference-completeness.test.mjs test/rendered-print.test.mjs test/runtime-api-behavior.test.mjs test/runtime.test.mjs test/scaffold.test.mjs test/speech-playback.test.mjs test/site.test.mjs test/theme-manager.test.mjs test/twin-cloud-images.test.mjs test/twin-cloud.test.mjs test/websocket-client-import-map.test.mjs test/websocket.test.mjs test/update-check.test.mjs test/user-explicit-updates.test.mjs",
     "test:integration": "node ./bin/arcane-test.mjs test/installed-package-runtime.test.mjs test/root-app-layout.test.mjs test/integrated-shared.test.mjs test/integrated-workspace.test.mjs test/mail-browser.test.mjs test/native-macos-provider.test.mjs test/native-plan.test.mjs test/native-portable-provider.test.mjs test/native-provider-loader.test.mjs test/npm-release.test.mjs test/release-bundle.test.mjs test/release-capability-smoke.test.mjs test/shared-payload-batch.test.mjs test/tarball.test.mjs test/browser-wasm-cpu.test.mjs test/wllama-webgpu-runtime.test.mjs",
     "test:regression": "node ./bin/arcane-test.mjs test/channel-workflows.test.mjs test/html-import-registration.test.mjs test/html-import-packaged-script.test.mjs test/logging-regression.test.mjs test/markdown-speech.test.mjs test/prepared-speech.test.mjs test/ai-audio-output.test.mjs test/native-provider-generation.test.mjs test/speech-queue-regression.test.mjs test/testing.test.mjs test/test-sets.test.mjs",

package/runtime/arcane/modules/RiskSignalAnalyzer.js

@@ -8,12 +8,8 @@ const DEFAULT_LEVELS=[
     {minimum:0,id:'low'},
 ];
 
-function normalizeText(value){
-    return String(value??'').normalize('NFKC');
-}
-
 export function analyzeRiskSignals(input,{signals=[],levels=DEFAULT_LEVELS}={}){
-    const text=normalizeText(input);
+    const text=String(input??'');
     const matches=[];
     let score=0;
 

package/schemas/arcane-app.schema.json

@@ -139,11 +139,12 @@
         "window": {
           "type": "object",
           "additionalProperties": false,
-          "description": "Initial native client dimensions in logical pixels at 96 DPI, and whether the user can resize the window. Omitted fields retain the host defaults.",
+          "description": "Initial normal client dimensions in logical pixels at 96 DPI, resizing behavior, and optional native window state. Omitted fields retain the host defaults.",
           "properties": {
             "width": { "type": "integer", "minimum": 1 },
             "height": { "type": "integer", "minimum": 1 },
-            "resizable": { "type": "boolean" }
+            "resizable": { "type": "boolean" },
+            "state": { "enum": ["normal", "maximized", "fullscreen"] }
           }
         },
         "bundledApps": {
@@ -283,7 +284,9 @@
                 "properties": {
                   "id": { "enum": ["llama.cpp", "ollama", "onnx", "stable-diffusion.cpp"] },
                   "version": { "type": "string" },
-                  "url": { "type": "string" }
+                  "url": { "type": "string" },
+                  "backend": { "type": "string", "description": "llama.cpp: auto, cpu or cuda. Image runtimes: auto, metal or cpu." },
+                  "companionUrl": { "type": "string", "description": "Explicit CUDA runtime companion archive for a custom llama.cpp CUDA URL." }
                 }
               },
               { "$ref": "#/$defs/whisperRuntime" }
@@ -295,6 +298,13 @@
           "properties": {
             "url": { "type": "string" },
             "model": { "type": "string" },
+            "alias": { "type": "string" },
+            "executionTarget": {
+              "oneOf": [
+                { "type": "null" },
+                { "type": "object", "required": ["deviceId"], "properties": { "deviceId": { "type": "string" } } }
+              ]
+            },
             "modelsDirectory": { "type": "string" },
             "args": { "type": "array", "items": { "type": "string" } }
           }

package/schemas/arcane-package.schema.json

@@ -163,7 +163,9 @@
                 "properties": {
                   "id": { "enum": ["llama.cpp", "ollama", "onnx", "stable-diffusion.cpp"] },
                   "version": { "type": "string" },
-                  "url": { "type": "string" }
+                  "url": { "type": "string" },
+                  "backend": { "type": "string", "description": "llama.cpp: auto, cpu or cuda. Image runtimes: auto, metal or cpu." },
+                  "companionUrl": { "type": "string", "description": "Explicit CUDA runtime companion archive for a custom llama.cpp CUDA URL." }
                 }
               },
               { "$ref": "#/$defs/whisperRuntime" }
@@ -175,6 +177,13 @@
           "properties": {
             "url": { "type": "string" },
             "model": { "type": "string" },
+            "alias": { "type": "string" },
+            "executionTarget": {
+              "oneOf": [
+                { "type": "null" },
+                { "type": "object", "required": ["deviceId"], "properties": { "deviceId": { "type": "string" } } }
+              ]
+            },
             "modelsDirectory": { "type": "string" },
             "args": { "type": "array", "items": { "type": "string" } }
           }

package/src/app-descriptor.mjs

@@ -237,7 +237,7 @@ function validateDocumentCatalog(value){
 
 function validateNativeWindow(value){
     if(value===undefined)return undefined;
-    assertOnlyKeys(value,new Set(['width','height','resizable']),'descriptor.native.window');
+    assertOnlyKeys(value,new Set(['width','height','resizable','state']),'descriptor.native.window');
     for(const dimension of ['width','height']){
         if(value[dimension]!==undefined&&(!is.integer(value[dimension])||value[dimension]<=0)){
             fail(`descriptor.native.window.${dimension} must be a positive integer.`);
@@ -246,10 +246,14 @@ function validateNativeWindow(value){
     if(value.resizable!==undefined&&!is.boolean(value.resizable)){
         fail('descriptor.native.window.resizable must be a boolean.');
     }
+    if(value.state!==undefined&&!['normal','maximized','fullscreen'].includes(value.state)){
+        fail('descriptor.native.window.state must be normal, maximized, or fullscreen.');
+    }
     return completeValue({
         ...(value.width===undefined?{}:{width:value.width}),
         ...(value.height===undefined?{}:{height:value.height}),
-        ...(value.resizable===undefined?{}:{resizable:value.resizable})
+        ...(value.resizable===undefined?{}:{resizable:value.resizable}),
+        ...(value.state===undefined?{}:{state:value.state})
     });
 }
 

package/src/cli/app-control.mjs

@@ -18,7 +18,7 @@ an application or change its profile. --output selects the capture filename;
 the other Arcane commands retain their existing output-format option.
 Inspect --request reads the complete parameter object, including shadowPath and
 optional documentGeneration. It cannot be combined with --selector.
-Key --request selects Tab (optionally shiftKey:true), Enter, or Space and the
+Key --request selects Tab (optionally shiftKey:true), Enter, Space, or Escape and the
 observed documentGeneration. Resize --request supplies native client width and
 height for a Normal window; its result includes the previous dimensions.
 `;