302dfca4d5
Merge remote-tracking branch 'origin/master' into doc/host-client-group-readmes
...
# Conflicts:
# packages/README.i18n.yaml
# packages/README.md
# packages/README.zh.md
# packages/client/connection/src/index.ts
# packages/client/connection/src/native-dialog-request.ts
# packages/client/connection/tests/node-half.spec.ts
# packages/host/apiproxy/README.i18n.yaml
2026-07-28 21:01:20 +08:00
bc988ca4a9
Merge remote-tracking branch 'origin/master' into xtr/identified-immutable-messages
...
# Conflicts:
# docs/cordis-catalog/events.md
# docs/core-data-structures/core.i18n.yaml
# docs/event-producer-consumer.md
# examples/acp-agent/tests/snapshots/cordis-inspect-jsdoc/session.jsonl
# packages/core/agent-loop/README.i18n.yaml
# packages/core/agent/README.i18n.yaml
2026-07-28 18:49:23 +08:00
2f93614efb
Merge remote-tracking branch 'origin/master' into feature/subagent-policy-inheritance
...
# Conflicts:
# examples/acp-agent/tests/snapshots/cordis-inspect-jsdoc/session.jsonl
# packages/subagent/subagent-inprocess/README.i18n.yaml
2026-07-28 18:37:46 +08:00
d69e1ada97
Merge remote-tracking branch 'origin/master' into feature/subagent-policy-inheritance
...
# Conflicts:
# .agents/notes/implemented/feature/2026-07-06-sandbox.i18n.yaml
# docs/cordis-catalog/services.md
# docs/core-data-structures/persistence.i18n.yaml
# docs/persistence-catalog.md
# packages/core/session/README.i18n.yaml
# packages/sandbox/sandbox-policy/README.i18n.yaml
# packages/subagent/subagent-inprocess/README.i18n.yaml
2026-07-28 18:19:30 +08:00
e8e40d7dd3
Merge branch 'master' into worktree/python-sdk-max-output-tokens
2026-07-28 18:17:45 +08:00
9220dbd271
Merge remote-tracking branch 'origin/master' into xtr/identified-immutable-messages
...
# Conflicts:
# docs/event-producer-consumer.md
# packages/client/connection/src/client/fixture.ts
# packages/goal/command-goal/tests/command-goal.spec.ts
# packages/host/apiproxy/src/api-proxy.ts
# packages/host/apiproxy/src/api/events.schema.ts
# packages/host/apiproxy/src/api/events.ts
# packages/host/apiproxy/tests/api-proxy-view.spec.ts
# packages/host/apiproxy/tests/rpc-schemas.spec.ts
# tsconfig.base.json
2026-07-28 18:11:13 +08:00
1fd06eae89
Merge remote-tracking branch 'origin/master' into worktree/skill-invocation-controls
...
# Conflicts:
# packages/host/apiproxy/README.i18n.yaml
# packages/host/apiproxy/README.md
# packages/host/apiproxy/README.zh.md
# packages/host/apiproxy/src/api-proxy.ts
2026-07-28 18:00:40 +08:00
c4bf919895
fix(host,client): default-export the picker seam; invalidate stale kind reads
...
ds-review-bot round 3. The seam package broke the service-package export
contract (named export only), so the config catalog filed it under Other
libraries and default imports failed; it now default-exports DirectoryPicker
like every abstract seam, and the regenerated catalog lists it as one.
The picker-kind effect also let a settlement from a superseded flow open
leak into the current one (close/reopen mid-describe, or a reconnect that
swaps the backend): the read now resets the affordance on every open and a
cleanup-toggled flag discards obsolete settlements, both directions pinned
by jsdom races.
2026-07-28 17:56:03 +08:00
5358168787
feat(sdk): support max output tokens
2026-07-28 17:36:44 +08:00
3764778be3
Merge remote-tracking branch 'origin/master' into worktree/skill-invocation-controls
2026-07-28 17:22:56 +08:00
e133e4bddb
feat(skill): add invocation controls
2026-07-28 17:22:41 +08:00
6e299cd55a
Merge remote-tracking branch 'origin/doc/host-client-group-readmes' into feat/directory-picker
2026-07-28 17:10:00 +08:00
772653464d
fix(connection): hold markerless requests to the Host fence — plain-HTTP browser reads carry no markers
...
Fetch-Metadata and Origin are only attached to trustworthy destinations, so
over plain HTTP a rebound page's same-origin GET (EventSource, images,
navigations) arrives with no browser markers and a readable response. Remove
the marker shortcut; non-browser clients pass the same fence via loopback,
the CLI-derived LAN IP literals, or a declared authority.
2026-07-28 17:02:39 +08:00
def1b5c55a
Merge remote-tracking branch 'origin/master' into worktree/pr742-retarget-20260728
...
# Conflicts:
# docs/event-producer-consumer.md
2026-07-28 16:59:10 +08:00
de56936c87
docs: fix test and docs conflicts
2026-07-28 16:50:07 +08:00
7ff8da56df
fix(connection): require trustedHosts entries in canonical authority form
...
A dangling colon (harness.internal:) or zero-padded port parses cleanly while
WHATWG silently rewrites it, turning an intended exact-port grant into an
any-port grant. Replace the character blacklist with a round-trip check: an
entry must read back from parsing exactly as written (case aside), refusing
the whole rewrite class at load.
2026-07-28 16:49:52 +08:00
0fcfc5214b
Merge remote-tracking branch 'origin/doc/host-client-group-readmes' into feat/directory-picker
2026-07-28 16:42:36 +08:00
b9cbe2f029
fix(connection): fail the load on a trustedHosts entry that is not a bare authority
...
WHATWG parsing would quietly read a hostname out of harness.internal/path or
user@harness.internal , authorizing the typo's hostname; other typos would sit
silently ignored until requests 403. Refuse every URL part beyond host[:port]
at plugin load.
2026-07-28 15:57:02 +08:00
019b0abb68
Merge remote-tracking branch 'origin/master' into xtr/identified-immutable-messages
...
# Conflicts:
# .agents/notes/implemented/architecture/2026-07-24-separate-context-injection-from-turn-execution.i18n.yaml
# docs/cordis-catalog/services.md
# docs/core-data-structures/core.i18n.yaml
# docs/core-data-structures/session.i18n.yaml
# docs/event-producer-consumer.md
# docs/persistence-catalog.md
# packages/core/session/README.i18n.yaml
# packages/session-title/session-title/tests/persistence.spec.ts
2026-07-28 15:45:53 +08:00
7fd2abd828
feat(host): directory-picker capability seam with dialog and browse backends
...
The web GUI's folder picking was hardwired to one interaction: a native
OS chooser compiled into the gateway, unusable for remote deployments
and swappable only by editing apiproxy source.
Directory picking becomes a three-package capability seam in
packages/host: ctx.directoryPicker returns a discriminated capability —
dialog (the extracted native chooser; host-display only) or browse
(new: one-level listing + child creation over Node stdlib, hidden flags
host-stamped, symlinks followed, ancestry crumbs; remote-capable). The
gateway injects the seam, advertises the kind via
host.describe.directoryPicker, serves host.listDirectory /
host.createDirectory under browse, and answers
directory-picker-unavailable across kinds. cordis.yml is the swap
point; apps/cli keeps dialog mounted, so behavior is unchanged until
the in-app browser PR flips the default. The connection fixture serves
a deterministic browse tree; WorkspacesService gains the browse calls
the browser UI will drive. Decision record:
.agents/notes/implemented/architecture/2026-07-28-directory-picker-capability-seam.md
2026-07-28 15:44:53 +08:00
01eea07bab
fix(connection): keep LAN serving working under the /api browser-trust fence
...
Markerless requests pass on any Host (a non-browser sender is the principal
and forges headers anyway); browser Host matching gains port-less entries and
WHATWG normalization; dsh derives LAN IP-literal authorities for an
all-interfaces bind and web grows --trusted-host for named ones.
2026-07-28 15:40:02 +08:00
01d68dee4e
fix(connection): fence every /api request behind one browser-trust check
...
The only browser-trust guard covered host.pickDirectory, while the
consequential methods (session.prompt drives bash) accepted any Host —
open to DNS rebinding, where a rebound page reads and writes the API as
if same-origin and only the Host header betrays the attacker's domain.
The pickDirectory-specific loopback guard becomes a prefix-wide fence:
Host must be loopback or an exact host[:port] from the new trustedHosts
config, an attached Origin must equal that authority, and explicit
cross-site markers are refused; requests without browser markers (curl,
tests, native clients) pass, because without a browser there is no
confused deputy. The loopback-socket check is dropped — binding policy
expresses reachability, and the fence is not an auth layer. The Agent
Note records the full threat model and the alternatives.
2026-07-28 14:56:45 +08:00
cee0666a4d
refactor(session): remove synthetic log-only turns
2026-07-28 14:41:51 +08:00
fbf87e660c
refactor: identify and freeze messages at creation
2026-07-28 13:55:59 +08:00
1dede11506
Merge remote-tracking branch 'origin/master' into worktree/web-model-request-retry
...
# Conflicts:
# .agents/notes/implemented/architecture/2026-06-21-bounded-llm-request-recovery.i18n.yaml
# .agents/notes/implemented/architecture/2026-06-21-bounded-llm-request-recovery.md
# .agents/notes/implemented/architecture/2026-06-21-bounded-llm-request-recovery.zh.md
# apps/web/tests/session-title.snapshot.ts
# docs/config-catalog.md
# packages/client/runtime/README.i18n.yaml
# packages/client/runtime/README.md
# packages/client/runtime/README.zh.md
# packages/client/ui-conversation/README.i18n.yaml
# packages/client/ui-conversation/src/client/chat/ChatView.tsx
# packages/client/ui-conversation/tests/chat-view.spec.tsx
# packages/llm/llm-retry/README.i18n.yaml
# packages/llm/llm-retry/README.md
# packages/llm/llm-retry/README.zh.md
2026-07-28 11:39:42 +08:00
bc3e776225
Merge remote-tracking branch 'origin/master' into feature/subagent-policy-inheritance
...
# Conflicts:
# .agents/notes/implemented/feature/2026-07-06-sandbox.i18n.yaml
# docs/cordis-catalog/services.md
# docs/persistence-catalog.md
# examples/acp-agent/tests/snapshots/cordis-inspect-jsdoc/session.jsonl
# packages/core/session/README.i18n.yaml
# packages/subagent/subagent-inprocess/README.i18n.yaml
# packages/ui/user-approval/src/index.ts
2026-07-28 11:19:46 +08:00
a3bdec4450
Merge remote-tracking branch 'origin/master' into worktree-guifork
2026-07-28 10:23:48 +08:00
05d4c19085
Merge remote-tracking branch 'origin/master' into codex/basic-session-search
...
# Conflicts:
# apps/web/tests/snapshots/question-composer/answered.expected.md
# packages/client/connection/tests/fake-api.ts
# packages/client/runtime/README.i18n.yaml
# packages/client/runtime/tests/fake-api.ts
# packages/client/ui-workspace/README.i18n.yaml
# packages/client/ui-workspace/README.md
# packages/client/ui-workspace/README.zh.md
# packages/client/ui-workspace/src/client/WorkspaceBrowser.tsx
# packages/client/ui-workspace/tests/apply.spec.ts
# packages/host/apiproxy/README.i18n.yaml
# packages/host/apiproxy/README.md
# packages/host/apiproxy/README.zh.md
# packages/host/apiproxy/src/api-proxy.ts
# packages/host/apiproxy/src/api/index.ts
# packages/host/apiproxy/src/api/sessions.schema.ts
# packages/host/apiproxy/src/fetch/client.ts
# packages/host/apiproxy/src/fetch/handler.ts
# packages/host/apiproxy/tests/fetch-carrier.spec.ts
# packages/host/apiproxy/tests/rpc-schemas.spec.ts
# packages/session-query/session-query/tests/search-helpers.spec.ts
2026-07-28 09:27:28 +08:00
a7cbdd83d7
Merge newer master into skill catalog hot refresh
2026-07-28 01:57:14 +08:00
b5930f4aa5
Merge latest master into skill catalog hot refresh
2026-07-28 01:23:10 +08:00
9ebd0075e9
Merge master into fix/pty-handoff-grace
2026-07-28 01:19:58 +08:00
b557bfbde5
Merge newer master into skill catalog hot refresh
2026-07-28 01:12:11 +08:00
2612a4b587
Merge latest master into skill catalog hot refresh
2026-07-28 01:10:33 +08:00
c10edbbc85
docs: regenerate catalogs and graphs for the projection seam; classify its types
...
gen-cordis-catalog type-link rows for the ProjectionDefinition surface and
CommandExecution; a sessionProjections service-role row for gen-doc-graphs;
regenerated module graph, persistence/config/cordis catalogs and api-catalog;
packages/README rows condensed back under the word ceiling; the RFC's sketch
fences marked ignore-check on both language sides (pairing re-recorded).
2026-07-28 01:09:55 +08:00
ca676178b5
Merge branch 'master' into fix/worker-timer-clamp
2026-07-28 01:06:22 +08:00
730657375f
Merge branch 'master' into worktree/web-session-model-selector
2026-07-28 00:56:56 +08:00
af70af4020
Merge remote-tracking branch 'origin/master' into worktree/web-session-model-selector
2026-07-28 00:39:24 +08:00
cc8f6a30c0
Merge remote-tracking branch 'origin/master' into worktree/pr703-ci-fix-20260727
...
# Conflicts:
# docs/architecture.i18n.yaml
# packages/core/agent-loop/src/agent.ts
2026-07-28 00:23:27 +08:00
3dc3e59b38
Merge remote-tracking branch 'origin/master' into fix/pty-handoff-grace
2026-07-28 00:17:25 +08:00
0982cc4fc0
Merge remote-tracking branch 'origin/master' into fix/worker-timer-clamp
2026-07-28 00:08:32 +08:00
f6a450102e
Merge updated origin/master into feat/tui-master-port
2026-07-27 23:55:53 +08:00
7111675b01
Merge remote-tracking branch 'origin/master' into fix/worker-timer-clamp
2026-07-27 23:45:05 +08:00
f843d2b238
Merge origin/master into feat/tui-master-port
2026-07-27 23:34:56 +08:00
29619eda77
Merge remote-tracking branch 'origin/master' into worktree/pr628-merge-20260727
...
# Conflicts:
# .agents/notes/implemented/architecture/2026-06-21-bounded-llm-request-recovery.i18n.yaml
# .agents/notes/implemented/architecture/2026-06-21-bounded-llm-request-recovery.md
# .agents/notes/implemented/architecture/2026-06-21-bounded-llm-request-recovery.zh.md
# docs/architecture.i18n.yaml
# docs/architecture.md
# docs/architecture.zh.md
# docs/cordis-catalog/events.md
# docs/core-data-structures/llm-streaming.i18n.yaml
# docs/core-data-structures/llm-streaming.md
# docs/core-data-structures/llm-streaming.zh.md
# docs/event-producer-consumer.md
# examples/acp-agent/tests/snapshots/empty-response-retry/session.jsonl
# packages/compact/compact-basic/src/index.ts
# packages/compact/compact-basic/tests/compact-basic.spec.ts
# packages/cordis/tool-cordis/src/api-catalog.ts
# packages/core/agent-loop/README.i18n.yaml
# packages/core/agent-loop/README.md
# packages/core/agent-loop/README.zh.md
# packages/core/agent-loop/src/loop.ts
# packages/core/agent-loop/tests/request-recovery.spec.ts
# packages/core/agent/src/types.ts
# packages/core/scope/tests/invariant.spec.ts
# packages/llm/llm-retry/README.i18n.yaml
# packages/llm/llm-retry/README.md
# packages/llm/llm-retry/README.zh.md
# packages/llm/llm-retry/src/index.ts
# packages/llm/llm-retry/src/invariant.ts
# packages/llm/llm-retry/tests/invariant.spec.ts
# packages/llm/llm-retry/tests/retry.spec.ts
# packages/plan/plan-mode/src/index.ts
# packages/plan/plan-mode/tests/integration.spec.ts
# packages/plan/plan-mode/tests/plan-mode.spec.ts
2026-07-27 23:29:26 +08:00
18882af947
Merge remote-tracking branch 'origin/master' into fix/pty-handoff-grace
2026-07-27 23:17:23 +08:00
4e8fd98110
Merge remote-tracking branch 'origin/master' into fix/worker-timer-clamp
2026-07-27 22:45:00 +08:00
8a952ab433
Merge remote-tracking branch 'origin/master' into worktree/pr628-merge-20260727
...
# Conflicts:
# .agents/notes/implemented/architecture/2026-06-21-bounded-llm-request-recovery.md
# docs/architecture.i18n.yaml
# docs/config-catalog.md
# docs/cordis-catalog/events.md
# docs/cordis-catalog/services.md
# docs/core-data-structures/llm-streaming.i18n.yaml
# docs/core-data-structures/llm-streaming.md
# docs/core-data-structures/llm-streaming.zh.md
# docs/event-producer-consumer.md
# docs/module-graph.md
# examples/headless-agent/tests/headless.snapshot.ts
# packages/compact/compact-basic/tests/compact-loop-repro.spec.ts
# packages/cordis/tool-cordis/src/api-catalog.ts
# packages/core/agent-loop/README.md
# packages/core/agent-loop/src/loop.ts
# packages/examples/agent-spine-demo/README.md
# packages/llm/README.md
# packages/llm/llm-deepseek/src/adapter.ts
# packages/llm/llm-pi-ai/src/adapter.ts
# packages/llm/llm-retry/README.md
# packages/llm/llm/README.md
# packages/llm/llm/src/index.ts
# packages/llm/llm/tests/service.spec.ts
# packages/support/llm-replay/src/index.ts
# packages/support/llm-replay/tests/llm-replay.spec.ts
2026-07-27 22:44:43 +08:00
7f333d8837
Merge branch 'master' into sdk/ts-client-and-subagent
2026-07-27 22:41:23 +08:00
55247b80b2
Merge origin/master (tsx lint lanes, session-telemetry-otel example dep)
2026-07-27 22:35:43 +08:00
ff4c9d9f9d
Merge remote-tracking branch 'origin/master' into fix/pty-handoff-grace
2026-07-27 22:17:23 +08:00
creatixchu