eb9e7c19eb
Merge remote-tracking branch 'origin/master' into worktree/ci-native-windows-20260808
...
# Conflicts:
# .agents/notes/archived/process/2026-07-27-wine-windows-gates-experiment.i18n.yaml
# .agents/notes/implemented/process/2026-07-21-serial-cross-platform-ci-reference.i18n.yaml
# .agents/notes/implemented/process/2026-07-21-serial-cross-platform-ci-reference.zh.md
# .agents/notes/implemented/process/2026-07-23-portable-required-pull-request-ci.i18n.yaml
# .agents/notes/implemented/process/2026-07-23-portable-required-pull-request-ci.zh.md
2026-08-09 13:26:11 +08:00
f1fafe0872
test(windows): keep repository helpers in git subpath
2026-08-09 13:25:18 +08:00
da23756dea
Merge remote-tracking branch 'origin/stack/agent-profiles-5-web-ui' into stack/agent-profiles-8-authoring
...
# Conflicts:
# packages/client/connection/README.i18n.yaml
# packages/client/connection/README.zh.md
# packages/core/tools/README.i18n.yaml
# packages/core/tools/README.zh.md
2026-08-09 13:22:10 +08:00
d500c9e627
Merge remote-tracking branch 'origin/stack/agent-profiles-3-wire' into stack/agent-profiles-5-web-ui
...
# Conflicts:
# packages/host/apiproxy/README.i18n.yaml
# packages/host/apiproxy/README.zh.md
2026-08-09 13:18:22 +08:00
2ebe078ad9
Merge remote-tracking branch 'origin/stack/agent-profiles-1-seam' into stack/agent-profiles-3-wire
2026-08-09 13:16:14 +08:00
30e3e5a50c
Merge remote-tracking branch 'origin/master' into xjt/generated-docs-zh-translation-apply
...
# Conflicts:
# .agents/notes/implemented/architecture/2026-07-12-agent-scope-runtime-design.i18n.yaml
# .agents/notes/implemented/architecture/2026-07-12-agent-scope-runtime-design.zh.md
# .agents/notes/implemented/architecture/2026-07-19-gui-layering-and-rpc-protocol.i18n.yaml
# .agents/notes/implemented/architecture/2026-07-19-gui-layering-and-rpc-protocol.zh.md
# .agents/notes/implemented/architecture/2026-07-19-gui-web-client-architecture.i18n.yaml
# .agents/notes/implemented/architecture/2026-07-19-gui-web-client-architecture.zh.md
# .agents/notes/implemented/architecture/2026-07-27-compiler-independent-typert-model.i18n.yaml
# .agents/notes/implemented/architecture/2026-07-27-compiler-independent-typert-model.zh.md
# .agents/notes/implemented/architecture/2026-07-28-directory-picker-capability-seam.i18n.yaml
# .agents/notes/implemented/architecture/2026-07-28-directory-picker-capability-seam.zh.md
# .agents/notes/implemented/architecture/2026-07-30-static-repository-plugin-format.i18n.yaml
# .agents/notes/implemented/architecture/2026-07-30-static-repository-plugin-format.zh.md
# .agents/notes/implemented/architecture/2026-07-31-claimed-pre-step-inbox-lifecycle.i18n.yaml
# .agents/notes/implemented/architecture/2026-07-31-claimed-pre-step-inbox-lifecycle.zh.md
# .agents/notes/implemented/architecture/2026-07-31-code-runtime-portable-identifier-seam.i18n.yaml
# .agents/notes/implemented/architecture/2026-07-31-code-runtime-portable-identifier-seam.zh.md
# .agents/notes/implemented/architecture/2026-08-01-packaged-ripgrep-search.i18n.yaml
# .agents/notes/implemented/architecture/2026-08-01-packaged-ripgrep-search.zh.md
# .agents/notes/implemented/architecture/2026-08-04-websocket-downlink-carrier.i18n.yaml
# .agents/notes/implemented/architecture/2026-08-04-websocket-downlink-carrier.zh.md
# .agents/notes/implemented/architecture/2026-08-05-large-session-jsonl-restore-pipeline.i18n.yaml
# .agents/notes/implemented/architecture/2026-08-05-large-session-jsonl-restore-pipeline.zh.md
# .agents/notes/implemented/architecture/2026-08-06-agent-event-payload-objects.i18n.yaml
# .agents/notes/implemented/architecture/2026-08-06-agent-event-payload-objects.zh.md
# .agents/notes/implemented/architecture/2026-08-06-subagent-list-identity-projection.i18n.yaml
# .agents/notes/implemented/architecture/2026-08-06-subagent-list-identity-projection.zh.md
# .agents/notes/implemented/architecture/2026-08-06-web-markdown-incremental-ast-renderer.i18n.yaml
# .agents/notes/implemented/architecture/2026-08-06-web-markdown-incremental-ast-renderer.zh.md
# .agents/notes/implemented/architecture/2026-08-08-client-tool-presentation-ownership.i18n.yaml
# .agents/notes/implemented/architecture/2026-08-08-client-tool-presentation-ownership.zh.md
# .agents/notes/implemented/bug-fix/2026-07-27-glob-sampling.i18n.yaml
# .agents/notes/implemented/bug-fix/2026-07-27-glob-sampling.zh.md
# .agents/notes/implemented/bug-fix/2026-07-28-themed-scrollbars-and-reserved-gutter.i18n.yaml
# .agents/notes/implemented/bug-fix/2026-07-28-themed-scrollbars-and-reserved-gutter.zh.md
# .agents/notes/implemented/bug-fix/2026-07-28-web-gui-feedback-loop.i18n.yaml
# .agents/notes/implemented/bug-fix/2026-07-28-web-gui-feedback-loop.zh.md
# .agents/notes/implemented/bug-fix/2026-07-29-human-transcript-append-origin.i18n.yaml
# .agents/notes/implemented/bug-fix/2026-07-29-human-transcript-append-origin.zh.md
# .agents/notes/implemented/bug-fix/2026-07-29-web-details-session-lifecycle.i18n.yaml
# .agents/notes/implemented/bug-fix/2026-07-29-web-details-session-lifecycle.zh.md
# .agents/notes/implemented/bug-fix/2026-07-30-web-transcript-log-ordered-projection.i18n.yaml
# .agents/notes/implemented/bug-fix/2026-07-30-web-transcript-log-ordered-projection.zh.md
# .agents/notes/implemented/bug-fix/2026-07-31-fork-anchor-floors-to-event-seq.i18n.yaml
# .agents/notes/implemented/bug-fix/2026-07-31-fork-anchor-floors-to-event-seq.zh.md
# .agents/notes/implemented/bug-fix/2026-07-31-web-stop-preserves-queue.i18n.yaml
# .agents/notes/implemented/bug-fix/2026-07-31-web-stop-preserves-queue.zh.md
# .agents/notes/implemented/bug-fix/2026-08-02-goal-round-wrapup-message.i18n.yaml
# .agents/notes/implemented/bug-fix/2026-08-02-goal-round-wrapup-message.zh.md
# .agents/notes/implemented/bug-fix/2026-08-03-hmr-initial-scan-boot-deadlock.i18n.yaml
# .agents/notes/implemented/bug-fix/2026-08-03-hmr-initial-scan-boot-deadlock.zh.md
# .agents/notes/implemented/bug-fix/2026-08-06-onboarding-step-owned-takeover-chrome.i18n.yaml
# .agents/notes/implemented/bug-fix/2026-08-06-onboarding-step-owned-takeover-chrome.zh.md
# .agents/notes/implemented/bug-fix/2026-08-06-provider-credential-lifecycle.i18n.yaml
# .agents/notes/implemented/bug-fix/2026-08-06-provider-credential-lifecycle.zh.md
# .agents/notes/implemented/bug-fix/2026-08-06-token-surface-unpriced-replace-compatibility.i18n.yaml
# .agents/notes/implemented/bug-fix/2026-08-06-token-surface-unpriced-replace-compatibility.zh.md
# .agents/notes/implemented/feature/2026-07-05-skill-system.i18n.yaml
# .agents/notes/implemented/feature/2026-07-05-skill-system.zh.md
# .agents/notes/implemented/feature/2026-07-08-background-subagent-tasks.i18n.yaml
# .agents/notes/implemented/feature/2026-07-08-background-subagent-tasks.zh.md
# .agents/notes/implemented/feature/2026-07-20-dsh-cli-personal-config.i18n.yaml
# .agents/notes/implemented/feature/2026-07-20-dsh-cli-personal-config.zh.md
# .agents/notes/implemented/feature/2026-07-21-continuable-background-subagents.i18n.yaml
# .agents/notes/implemented/feature/2026-07-21-continuable-background-subagents.zh.md
# .agents/notes/implemented/feature/2026-07-22-durable-subagent-catalog-and-list-agents.i18n.yaml
# .agents/notes/implemented/feature/2026-07-22-durable-subagent-catalog-and-list-agents.zh.md
# .agents/notes/implemented/feature/2026-07-23-web-assistant-markdown.i18n.yaml
# .agents/notes/implemented/feature/2026-07-23-web-assistant-markdown.zh.md
# .agents/notes/implemented/feature/2026-07-23-web-permission-and-approval.i18n.yaml
# .agents/notes/implemented/feature/2026-07-23-web-permission-and-approval.zh.md
# .agents/notes/implemented/feature/2026-07-25-session-list-browsing-and-manual-order.i18n.yaml
# .agents/notes/implemented/feature/2026-07-25-session-list-browsing-and-manual-order.zh.md
# .agents/notes/implemented/feature/2026-07-27-skill-catalog-hot-refresh.i18n.yaml
# .agents/notes/implemented/feature/2026-07-27-skill-catalog-hot-refresh.zh.md
# .agents/notes/implemented/feature/2026-07-27-web-session-fork-actions.i18n.yaml
# .agents/notes/implemented/feature/2026-07-27-web-session-fork-actions.zh.md
# .agents/notes/implemented/feature/2026-07-27-web-session-search.i18n.yaml
# .agents/notes/implemented/feature/2026-07-27-web-session-search.zh.md
# .agents/notes/implemented/feature/2026-07-27-web-subagent-conversations.i18n.yaml
# .agents/notes/implemented/feature/2026-07-27-web-subagent-conversations.zh.md
# .agents/notes/implemented/feature/2026-07-28-continuable-subagent-conversations.i18n.yaml
# .agents/notes/implemented/feature/2026-07-28-continuable-subagent-conversations.zh.md
# .agents/notes/implemented/feature/2026-07-28-skill-invocation-policy.i18n.yaml
# .agents/notes/implemented/feature/2026-07-28-skill-invocation-policy.zh.md
# .agents/notes/implemented/feature/2026-07-28-web-terminal-card.i18n.yaml
# .agents/notes/implemented/feature/2026-07-28-web-terminal-card.zh.md
# .agents/notes/implemented/feature/2026-07-30-deepseek-onboarding-credential-setup.i18n.yaml
# .agents/notes/implemented/feature/2026-07-30-deepseek-onboarding-credential-setup.zh.md
# .agents/notes/implemented/feature/2026-07-30-search-render-card.i18n.yaml
# .agents/notes/implemented/feature/2026-07-30-search-render-card.zh.md
# .agents/notes/implemented/feature/2026-07-30-web-diff-card.i18n.yaml
# .agents/notes/implemented/feature/2026-07-30-web-diff-card.zh.md
# .agents/notes/implemented/feature/2026-07-30-web-read-card.i18n.yaml
# .agents/notes/implemented/feature/2026-07-30-web-read-card.zh.md
# .agents/notes/implemented/feature/2026-07-30-web-result-card-frontend.i18n.yaml
# .agents/notes/implemented/feature/2026-07-30-web-result-card-frontend.zh.md
# .agents/notes/implemented/feature/2026-07-30-web-result-card.i18n.yaml
# .agents/notes/implemented/feature/2026-07-30-web-result-card.zh.md
# .agents/notes/implemented/feature/2026-07-31-code-mode-language-dispatch.i18n.yaml
# .agents/notes/implemented/feature/2026-07-31-code-mode-language-dispatch.zh.md
# .agents/notes/implemented/feature/2026-07-31-telemetry-anonymous-user-id.i18n.yaml
# .agents/notes/implemented/feature/2026-07-31-telemetry-anonymous-user-id.zh.md
# .agents/notes/implemented/feature/2026-07-31-web-workspace-file-links.i18n.yaml
# .agents/notes/implemented/feature/2026-07-31-web-workspace-file-links.zh.md
# .agents/notes/implemented/feature/2026-08-01-pwsh-tool-and-executor.i18n.yaml
# .agents/notes/implemented/feature/2026-08-01-pwsh-tool-and-executor.zh.md
# .agents/notes/implemented/feature/2026-08-02-pwsh-tool-bash-parity.i18n.yaml
# .agents/notes/implemented/feature/2026-08-02-pwsh-tool-bash-parity.zh.md
# .agents/notes/implemented/feature/2026-08-02-web-thinking-tail-scroll.i18n.yaml
# .agents/notes/implemented/feature/2026-08-02-web-thinking-tail-scroll.zh.md
# .agents/notes/implemented/feature/2026-08-05-pwsh-ui-bash-parity.i18n.yaml
# .agents/notes/implemented/feature/2026-08-05-pwsh-ui-bash-parity.zh.md
# .agents/notes/implemented/feature/2026-08-06-resolved-theme-color-metadata.i18n.yaml
# .agents/notes/implemented/feature/2026-08-06-resolved-theme-color-metadata.zh.md
# .agents/notes/implemented/feature/2026-08-06-web-skill-tool-row.i18n.yaml
# .agents/notes/implemented/feature/2026-08-06-web-skill-tool-row.zh.md
# .agents/notes/implemented/process/2026-06-17-ts-build-config.i18n.yaml
# .agents/notes/implemented/process/2026-06-17-ts-build-config.zh.md
# .agents/notes/implemented/process/2026-07-22-tsconfig-solution-root-two-aggregates.i18n.yaml
# .agents/notes/implemented/process/2026-07-22-tsconfig-solution-root-two-aggregates.zh.md
# .agents/notes/implemented/process/2026-07-31-installer-adopts-existing-checkout.i18n.yaml
# .agents/notes/implemented/process/2026-07-31-installer-adopts-existing-checkout.zh.md
# .agents/notes/implemented/process/2026-08-08-api-remotes-generated-contract-build.i18n.yaml
# .agents/notes/implemented/process/2026-08-08-api-remotes-generated-contract-build.zh.md
# .agents/notes/implemented/simplification/2026-07-20-remove-stdio-and-echo-agents.i18n.yaml
# .agents/notes/implemented/simplification/2026-07-20-remove-stdio-and-echo-agents.zh.md
# .agents/notes/implemented/simplification/2026-07-26-merge-subagent-control-service.i18n.yaml
# .agents/notes/implemented/simplification/2026-07-26-merge-subagent-control-service.zh.md
# .agents/notes/implemented/simplification/2026-07-31-one-route-to-add-a-workspace.i18n.yaml
# .agents/notes/implemented/simplification/2026-07-31-one-route-to-add-a-workspace.zh.md
# .agents/notes/implemented/testing/2026-07-24-web-gui-browser-e2e-lane.i18n.yaml
# .agents/notes/implemented/testing/2026-07-24-web-gui-browser-e2e-lane.zh.md
# .agents/notes/proposed/architecture/2026-07-29-durable-last-activity-index.i18n.yaml
# .agents/notes/proposed/architecture/2026-07-29-durable-last-activity-index.zh.md
# .agents/notes/proposed/architecture/2026-08-08-semantic-composer-chain-phases.i18n.yaml
# .agents/notes/proposed/architecture/2026-08-08-semantic-composer-chain-phases.zh.md
# .agents/notes/proposed/feature/2026-07-17-sdk-follow-up-capabilities.i18n.yaml
# .agents/notes/proposed/feature/2026-07-17-sdk-follow-up-capabilities.zh.md
# apps/cli/reference/README.i18n.yaml
# apps/cli/reference/README.zh.md
# docs/api-gateway.i18n.yaml
# docs/api-gateway.zh.md
# docs/cookbook/adding-a-package.i18n.yaml
# docs/cookbook/adding-a-package.zh.md
# docs/cookbook/adding-a-tool.i18n.yaml
# docs/cookbook/adding-a-tool.zh.md
# docs/development.i18n.yaml
# docs/development.zh.md
# docs/i18n/README.i18n.yaml
# docs/i18n/README.zh.md
# docs/i18n/style-samples.md
# docs/i18n/terminology.md
# docs/testing.i18n.yaml
# docs/testing.zh.md
# examples/web-cordis/README.i18n.yaml
# examples/web-cordis/README.zh.md
# packages/api/gateway/README.i18n.yaml
# packages/api/gateway/README.zh.md
# packages/bash/bash-env/README.i18n.yaml
# packages/bash/bash-env/README.zh.md
# packages/bash/tool-bash/README.i18n.yaml
# packages/bash/tool-bash/README.zh.md
# packages/bash/tool-pwsh/README.i18n.yaml
# packages/bash/tool-pwsh/README.zh.md
# packages/client/ui-conversation/README.i18n.yaml
# packages/client/ui-conversation/README.zh.md
# packages/client/ui-tool/README.i18n.yaml
# packages/client/ui-tool/README.zh.md
# packages/feedback/command-feedback/README.i18n.yaml
# packages/feedback/command-feedback/README.zh.md
# packages/host/webserver/README.i18n.yaml
# packages/host/webserver/README.zh.md
# packages/pty/tool-bash-persistent/README.i18n.yaml
# packages/pty/tool-bash-persistent/README.zh.md
# packages/subagent/subagent-claude-code/README.i18n.yaml
# packages/subagent/subagent-claude-code/README.zh.md
# packages/subagent/subagent-codex/README.i18n.yaml
# packages/subagent/subagent-codex/README.zh.md
# packages/typert/type-meta/README.i18n.yaml
# packages/typert/type-meta/README.zh.md
# packages/util/atomic-write/README.i18n.yaml
# packages/util/atomic-write/README.zh.md
# scripts/snapshots/translation-prompt-v4/request-response.expected.json
2026-08-09 13:15:27 +08:00
1471f7c081
Merge remote-tracking branch 'origin/master' into stack/agent-profiles-1-seam
...
# Conflicts:
# packages/core/scope/README.i18n.yaml
# packages/core/scope/README.zh.md
2026-08-09 13:14:51 +08:00
76b3353452
docs: call waterfall interception short-circuiting
2026-08-09 13:13:37 +08:00
5a6738f94a
Merge remote-tracking branch 'origin/master' into xjt/generated-docs-zh-translation-apply
...
# Conflicts:
# .agents/notes/implemented/architecture/2026-07-30-static-repository-plugin-format.i18n.yaml
# .agents/notes/implemented/architecture/2026-07-30-static-repository-plugin-format.zh.md
# .agents/notes/implemented/feature/2026-07-30-config-only-repository-plugins.i18n.yaml
# .agents/notes/implemented/feature/2026-07-30-config-only-repository-plugins.zh.md
2026-08-09 13:08:49 +08:00
c7ea0f6468
Merge worktree/ci-native-windows-coverage-20260808 into worktree/ci-native-windows-multicore-20260809
2026-08-09 13:01:37 +08:00
cbba728f03
Merge worktree/ci-native-windows-20260808 into worktree/ci-native-windows-coverage-20260808
2026-08-09 13:01:04 +08:00
f157719690
Merge origin/master into worktree/ci-native-windows-20260808
...
# Conflicts:
# vendor/README.md
2026-08-09 13:00:19 +08:00
461f2aaaf2
ci: use multicore native Windows runner
2026-08-09 12:43:45 +08:00
17360907f6
docs(i18n): address terminology review findings
2026-08-09 12:35:06 +08:00
01a3b454f6
fix(sandbox): extend the restricted token's default DACL with a write-SID ACE
...
New objects created without an explicit security descriptor take
their DACL from the token's default DACL, which CreateRestrictedToken
builds from the user's ambient SIDs — none of them a restricting SID.
Confined children therefore failed the write pass-2 check when
creating anonymous pipes (CreatePipe: ERROR_ACCESS_DENIED, surfaced
as Node EPERM), breaking PowerShell pipelines and other CreatePipe
consumers. Merge a full-access write-SID ACE (Everyone under
read-only) into the token default DACL at init via
SetTokenInformation(TokenDefaultDacl).
Named pipes are EXEMPT: their default security descriptor is the
kernel's PUBLIC template (owner/SYSTEM/Admins full, Everyone
read-only), which no token change influences, so libuv's piped stdio
capture stays denied for confined grandchildren — the POC-documented
boundary, now pinned by the runner suite (inherit/ignore OK, pipe
DENIED) and documented in the README pair. The NUL paragraph is
corrected to the measured matrix (Everyone has 0x1201BF on the
device: cmd/node writes land; Set-Content fails at the PS layer).
2026-08-09 12:34:48 +08:00
acf75a8af3
Merge origin/master into xjt/incremental-proofreading-275-apply
2026-08-09 12:17:59 +08:00
30923a7a0a
Merge remote-tracking branch 'origin/stack/agent-profiles-5-web-ui' into stack/agent-profiles-8-authoring
...
# Conflicts:
# packages/core/tools/README.i18n.yaml
# packages/core/tools/README.md
# packages/core/tools/README.zh.md
2026-08-09 11:55:11 +08:00
53e30d7652
Merge remote-tracking branch 'origin/stack/agent-profiles-3-wire' into stack/agent-profiles-5-web-ui
2026-08-09 11:52:23 +08:00
62f8eecbba
Merge remote-tracking branch 'origin/stack/agent-profiles-1-seam' into stack/agent-profiles-3-wire
2026-08-09 11:51:13 +08:00
cb442eb31d
Merge remote-tracking branch 'origin/master' into stack/agent-profiles-1-seam
2026-08-09 11:47:41 +08:00
aad0030fe0
Merge remote-tracking branch 'origin/master' into xjt/generated-docs-zh-translation-apply
...
# Conflicts:
# packages/boot/app-boot/README.i18n.yaml
# packages/boot/app-boot/README.zh.md
2026-08-09 11:45:58 +08:00
0c3354e582
Merge origin/master into xjt/incremental-proofreading-275-apply
2026-08-09 11:44:26 +08:00
8d76ddaa6c
fix(repository-plugin): enforce published prepare dependency
2026-08-09 11:41:40 +08:00
cc7bd4948d
fix(repository-plugin): reject incomplete MCP publication
2026-08-09 11:41:40 +08:00
29b3e3fa84
fix(repository-plugin): require published prepare dependency
2026-08-09 11:41:40 +08:00
e91ff6d499
test(repository-plugin): cover MCP activation cleanup
2026-08-09 11:41:40 +08:00
913ecf5f1d
fix(mcp-client): await Cordis startup discovery
2026-08-09 11:41:40 +08:00
a7832cbfbf
fix(repository-cache): isolate Git package dependencies
2026-08-09 11:41:40 +08:00
033fa4b0b1
feat(repository-plugin): load trusted package code
2026-08-09 11:41:40 +08:00
a0c64f4906
ci(repository-plugin): authenticate private GitHub source
2026-08-09 11:41:40 +08:00
b91b1fdefe
fix(repository-plugin): make GitHub source preparation self-contained
2026-08-09 11:41:40 +08:00
a7af54a8d3
docs(i18n): standardize contract terminology
2026-08-09 11:33:14 +08:00
7ff0cbcb7e
docs: complete Chinese proofreading and generated reference pairing
2026-08-09 11:02:16 +08:00
bb50783002
test(sandbox): cover the temp-grant cleanup-failure AggregateError path
2026-08-09 10:57:01 +08:00
10ef3d4924
docs,feat(doc-gates): fix 15 dead anchor fragments; verify-md-links now validates fragments
...
A corpus sweep under the doc/prose standards found 15 links whose #fragment
named no anchor in its target — reworded headings, one relocated contract
(tool-fs → the group README's no-timeout rule), and zh sides citing English
slugs their Chinese headings never produce. Fixed all 15 (zh sides get the
conventional explicit <a id> + English fragment), fixed the one generator-owned
instance at its source (gen-doc-graphs), and extended verify-md-links to
resolve fragments onto Markdown targets — same-file anchors included — against
heading slugs and explicit <a id>, so the class is gated instead of manually
grepped. Remaining probes (narrated history, duplication shingles, comment
transcripts, budgets) came back clean; sibling-adapter README symmetry and
implemented-note contrasts are deliberate keeps.
2026-08-09 10:56:42 +08:00
8119bc3401
test(sandbox): fix grant-count and dispose-warning assertions
...
The reparse case reuses the standing workspace grant of the preceding
case (same workspace -> map hit), so the failed temp grant is the third
grant, not the fourth; the dispose-warning text carries 'failure(s)'.
2026-08-09 10:51:02 +08:00
5fea4b7c4b
feat(sandbox): derive the windows-acl write SID per workspace, not per session
...
The per-session random write SID forced a full tree propagation per
session per server lifetime (minutes on large workspaces). The write
SID is now the per-workspace identity derived from the canonical
workspace path (workspaceWriteSid: sha256 -> S-1-4-x-y), stored
nowhere: the workspace-root ACE materializes once per workspace per
machine and every later provision hits the exact-ACE skip.
- workspace ACEs are STANDING (never revoked - the reuse cache); temp
ACEs stay revocable (disposed with the provider), so an inheritable
ACE never outlives its session's temp dir on the ambient temp root
- AclSandbox requires the write SID under workspace-write; read-only
parses/grants nothing; the runner derives the SID itself (the
--write-sid flag's presence still marks the seam-managed contract)
- the acl-session record drops writeSid (sessionId/workspace/tempDir
remain): the SID-tamper surface and its validation are gone
- sandbox-local holds two grant maps: standing workspace grants and
revocable per-session temp grants
Docs (README pair, design note pair, catalogs, type-equiv) and the
acl-session/grant/acl/probe/runner suites updated; workspace-sid.spec
pins the derivation contract.
2026-08-09 10:44:35 +08:00
5d46c11784
docs(i18n): reconcile source-drifted translations
2026-08-09 10:24:11 +08:00
dd2082c82c
test(windows): preserve E2B cleanup coverage
2026-08-09 05:16:25 +08:00
2ce8d88a4d
test(windows): eliminate final coverage races
2026-08-09 05:03:18 +08:00
91cae30fc5
test(windows): separate pwsh integration budgets
2026-08-09 04:20:52 +08:00
e7e75e7972
test(windows): cover final native branches
2026-08-09 03:50:06 +08:00
ed2e24f7eb
Merge branch 'stack/agent-profiles-5-web-ui' into stack/agent-profiles-8-authoring
...
# Conflicts:
# docs/cordis-catalog/services.md
# docs/module-graph.md
# packages/client/README.i18n.yaml
# packages/core/tools/README.i18n.yaml
2026-08-09 03:20:52 +08:00
bd659179f6
docs(i18n): reproofread updated Chinese documentation
2026-08-09 03:20:17 +08:00
1a6037c9fb
Merge remote-tracking branch 'origin/master' into fs-overwrite-diff-bound-v2
...
# Conflicts:
# docs/subsystems/lsp.i18n.yaml
# packages/fs/fs-local/README.i18n.yaml
# packages/fs/fs-local/README.md
# packages/fs/fs-local/README.zh.md
# packages/fs/fs-local/src/index.ts
2026-08-08 12:20:09 -07:00
46f74c652f
Merge branch 'stack/agent-profiles-3-wire' into stack/agent-profiles-5-web-ui
...
# Conflicts:
# AGENTS.md
# docs/architecture.i18n.yaml
# docs/cordis-catalog/services.md
# docs/module-graph.md
2026-08-09 03:16:18 +08:00
bfb456e0c6
test(windows): close native coverage gaps
2026-08-09 03:12:58 +08:00
4952afe5c0
Merge branch 'stack/agent-profiles-1-seam' into stack/agent-profiles-3-wire
...
# Conflicts:
# docs/cordis-catalog/services.md
# docs/module-graph.md
# docs/subsystems/persistence.i18n.yaml
# packages/client/ui-question/tsconfig.json
# pnpm-lock.yaml
2026-08-09 03:05:10 +08:00
101b074241
Merge remote-tracking branch 'origin/master' into stack/agent-profiles-1-seam
...
# Conflicts:
# docs/capability-seams.md
# docs/cordis-catalog/services.md
# docs/module-graph.md
# packages/README.i18n.yaml
# packages/README.md
# packages/README.zh.md
# packages/boot/app-boot/README.i18n.yaml
# pnpm-lock.yaml
# scripts/gen-cordis-catalog.ts
2026-08-09 02:55:11 +08:00
5e080849aa
Merge remote-tracking branch 'origin/feat/windows-pwsh-default' into feat/windows-acl-sandbox
...
# Conflicts:
# apps/cli/reference/README.i18n.yaml
# docs/cordis-catalog/services.md
# docs/module-graph.md
# docs/subsystems/sandbox.i18n.yaml
# packages/sandbox/sandbox/README.i18n.yaml
# pnpm-lock.yaml
# scripts/verify-package-readme-model-experience.ts
2026-08-09 02:53:48 +08:00
Tianyi Cui