Commit Graph

12 Commits

Author SHA1 Message Date
Peter Steinberger c70aee247e refactor(scripts): migrate JavaScript tools to TypeScript (#121005)
* refactor(scripts): migrate JavaScript tools to TypeScript

* fix(ci): keep changed-scope preflight zero-install

* fix(ci): preserve zero-install script owners

* fix(ci): complete script migration follow-through

* fix(release): keep stable closeout zero-install

* fix(scripts): preserve standalone execution boundaries

* fix(scripts): repair standalone loader boundaries

* fix(scripts): normalize gateway observation ids

* fix(scripts): keep Docker packager standalone

* test(scripts): preserve rebase cleanup helpers

* test(sessions): use tracked temp directory
2026-08-09 07:21:35 -07:00
Vincent Koc 38039f5ea8 fix(secrets): preserve Windows ACL diagnostics (#120211)
* fix(secrets): preserve Windows ACL diagnostics

* fix(secrets): make Windows path security proof deterministic

* test(secrets): isolate Windows ACL tool failures

* test(secrets): preserve ACL preload process contract

* test(ci): route Doctor ACL proof to Windows

* test(qa): normalize Clack note borders

* test(ci): register Windows ACL preload for deadcode checks
2026-08-09 03:48:42 +08:00
wonfong 9fdc266f64 fix(subagents): wake the parent when a follow-up finishes a yielded child (#120187)
* fix(subagents): wake the parent when a follow-up finishes a yielded child

A sub-agent that calls sessions_yield on its own behalf parks its run and
correctly withholds the parent's announce. But a later follow-up to that same
child session registered a sibling registry row instead of continuing the paused
one, so the requester defaulted to the child's own main session and the original
parent — itself idle behind sessions_yield — was never woken. The paused row also
stayed an unsettled descendant, deferring the parent's settle batch forever with
nothing recorded explaining the silence.

Follow-up dispatch now adopts the paused row through the existing post-steer
replacement seam, inheriting the requester identity and carrying the settle-wake
credential forward with its frozen batch membership remapped to the new run id.
A follow-up that names its own requester keeps registering separately, since an
explicit requester is a delivery opt-in that adoption would silently drop.

Also stops frozen-result refill from targeting paused rows: a yield clears the
result on purpose, so refilling from the session would attribute a later turn's
text to the paused run.

Closes #120157

* fix(subagents): select the paused owner past a requester-bound sibling

Adoption looked up the newest run for the child session and adopted it only
when that row was itself paused. A requester-bound follow-up deliberately stays
a sibling, but it registers at a higher generation and becomes that newest row,
so any later default follow-up saw an unpaused newest row, declined adoption,
and registered yet another sibling. The original requester stayed parked behind
a paused row that can never announce -- the same silent stall this fix exists to
remove, reached through a valid mixed-delivery sequence.

The latest-run query now takes an optional predicate applied before the
generation comparison, so a caller that owns a specific row class selects the
newest row of that class. Adoption asks for the newest `sessions_yield` row
directly instead of inferring it from generation order.

Docs now state that continuation applies to default delivery, since a follow-up
carrying its own requester runs as a sibling by design.

* test(qa): prove post-yield follow-up delivery through the gateway boundary

The unit and gateway-method tests for paused-run adoption assert on registry
rows, which proves the bookkeeping but not that an operator ever sees the
result. This adds the boundary proof: a real gateway child, the QA mock channel,
and the mock provider driving a subagent that pauses itself and finishes only on
a later follow-up.

A fixture plugin owns both legs. Its `before_dispatch` hook spawns the child with
`completionDelivery: "current-requester"`, so the announce has the operator turn
as its audience. An HTTP route then dispatches the follow-up to that same paused
session using default delivery -- the path adoption is meant to catch. A
requester-bound follow-up would opt into its own audience and run as a sibling
instead, so the two legs must differ here.

The mock provider gains a child that yields on its own behalf. Both of its turns
match on the current prompt rather than the shared transcript, so the yielded
kickoff cannot make the follow-up turn yield a second time.

The scenario asserts both sides of the invariant: no outbound traffic while the
child is paused, and exactly one announce carrying the follow-up marker once it
ends.

Reverting the adoption call site fails this test in the way that matters: the
child still produces its marker and the run still ends with stopReason=stop, but
nothing reaches the requester and the wait times out. The result is computed and
then silently dropped -- which is the failure this repair exists to remove.

* fix(ci): match QA Lab fixture plugin entries as a group in knip

The all-exports pass listed one fixture entry by name, so every new QA Lab
fixture plugin lands as an unused file and turns check-dependencies red until
someone remembers this file. Nothing imports these entries by design: the
Gateway E2E loads them through plugin config paths.

* docs(subagents): scope yield continuation to plugin runtime follow-ups

Adoption is gated on plugin_subagent task tracking, which only
createGatewaySubagentRuntime().run sets, so api.runtime.subagent.run is the
sole route into it. Writing that as one example implied other follow-up paths
to a paused session continue the run too; they are not tracked as sub-agent
runs and announce nobody.

* fix(subagents): reject undurable paused-run adoption

Fail plugin follow-up admission closed when the paused-run ownership swap cannot be persisted, while retaining the existing restart-recovery return-false contract. Trim duplicate tests and keep boundary coverage for requester routing, wake-batch remapping, repeated yield, and persistence rollback.

Co-authored-by: zhou.huanfeng <woundfongv3@163.com>

* docs(subagents): clarify yielded-run steering

Co-authored-by: zhou.huanfeng <woundfongv3@163.com>

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-08-08 06:46:19 -07:00
Josh Avant 618fba92bf feat(audit): add execution identity inspection (#117034)
* feat(audit): add opt-in execution identity inspection

* fix(audit): gate recovery identity retention

* fix(audit): keep recovery identity type private

* test(audit): type internal recovery fixture

* test(audit): split recovery identity coverage

* docs(audit): define operator read trust boundary

* test(qa): register identity scenario child

* fix(audit): enforce shared identity retention bounds

* fix(audit): seal public ingress identity boundary

* fix(audit): keep ingress guard lint-clean

* fix(gateway): preserve advertised method order

* chore(protocol): sync advertised method order

* fix(protocol): encode audit selector invariants

* test(audit): prove exact execution guard

* fix(audit): keep identity storage lazy
2026-08-04 20:05:15 -05:00
Peter Steinberger 73535e4ede improve(ui): cut E2E shard runtime by reusing the bundle (#118697)
* test(ui): reuse bundled runtime across e2e files

* test(ui): isolate bundled E2E build output

* test(ui): align bundled E2E output paths

* test(ui): register E2E setup entrypoints

* test(ui): preserve bundled E2E gateway semantics

---------

Co-authored-by: Peter Steinberger <steipete@mac-studio-sf2.local>
2026-08-03 08:01:44 -07:00
Peter Steinberger e4d1b7e0d3 refactor(plugins): move plugin contributions into the registry bundle (#117372)
* refactor(plugins): move plugin contributions into the registry bundle

* fix(plugins): guard embedding owner union and drop unused test-util imports

* fix(plugins): break registry facade import cycles

* fix(plugins): remove obsolete registry snapshot seams

* test(gateway): preserve plugin runtime mock exports

* test(auto-reply): install builder registry in diagnostics fixture

* test(plugins): activate registry-backed capability fixtures
2026-08-01 06:57:01 -07:00
Vincent Koc 08da74849b Merge remote-tracking branch 'origin/main' into pr-93985-prep
* origin/main: (3706 commits)
  refactor(ui): unify filtered session list ownership (#117158)
  refactor(agents): consolidate context budgets and compaction recovery (#117149)
  fix(net-policy): redact sig and x-* auth params in URLs and bodies (#116957)
  refactor(agents): remove duplicate generated-media delivery fallbacks (#117150)
  refactor(reply): unify turn lifecycle state ownership (#117145)
  fix(ui): preserve emoji agent avatar initials (#104912)
  refactor(auto-reply): unify command and directive ownership (#117143)
  refactor(plugins): consolidate descriptor and startup ownership (#117146)
  fix(messages): reply actions leak citation markers and reply/poll answers draw the no-reply fallback (#116909)
  fix(slack): let durable ingress retry transient thread lookups (#117135)
  refactor(doctor): consolidate shipped state migration ownership (#117142)
  fix(ai): Codex stream shows internal parser text on a malformed frame (#116966)
  fix: guard every migrated session accessor path (#117140)
  fix(terminal): measure unicode display width consistently (#117062)
  fix(openai): clear ChatGPT SSE fallback per session (#117123)
  fix(mistral): reject incomplete streamed tool terminals (#117137)
  fix(ai): preserve structured chat content and refusals (#117136)
  fix(doctor): persist normalized agent roster (#117115)
  fix(signal): avoid replay after ambiguous quote delivery errors (#117134)
  fix(cron): reject disabled delivery accounts when scheduling (#116899)
  ...
2026-08-01 10:16:40 +08:00
Vincent Koc 8530edb057 fix(plugins): deliver subagent completion to current requester (#116091)
* fix(plugins): deliver subagent completion to requester

Co-authored-by: ambitioncn <36698505+ambitioncn@users.noreply.github.com>

* test(qa): register current-requester plugin fixture

* fix(plugins): scope requester authority per hook

---------

Co-authored-by: ambitioncn <36698505+ambitioncn@users.noreply.github.com>
2026-07-30 07:06:17 +08:00
Peter Steinberger b3e2af7eb2 refactor(scripts): remove orphaned secret provider proof (#112875) 2026-07-23 00:29:44 -04:00
陈杨俊0668000971 5c8cc947b7 fix(ci): format sandbox E2E script with oxfmt 2026-07-20 23:17:31 +08:00
Sash Zats ff95d0c269 improve(ci): replace boundary guards with focused Oxlint rules (#95368)
* perf(ci): move boundary guards to oxlint

Co-authored-by: Sash Zats <sash@zats.io>

* fix(ci): avoid dead editor URL export

Co-authored-by: Sash Zats <sash@zats.io>

* fix(ci): declare path-loaded boundary guard roots

Co-authored-by: Sash Zats <sash@zats.io>

* fix(ci): model Oxlint plugin export in Knip

Co-authored-by: Sash Zats <sash@zats.io>

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-07-17 11:37:35 +01:00
Peter Steinberger bae9752c5a refactor(deadcode): enforce repository hard zero (#108641) 2026-07-15 22:40:00 -07:00