[{"name":"src","kind":"directory","size":0,"lastCommitHash":"61eb64748eb077e2a084432db92d101a2a83e146","lastCommitWhen":"2026-08-26T15:24:10-07:00","lastCommitMessage":"Minimal CPython REPL runtime (rlm.repl) (#1685)\n\n* feat(coding-agent): add async-by-default bash() to the kernel runtime\n\n* chore(coding-agent): tighten bash() comments and changelog fragment\n\n* feat(coding-agent): add a standalone CPython REPL runtime speaking JSON lines over stdio\n\n* chore(coding-agent): tighten REPL runtime comments\n\n* feat(coding-agent): run the kernel on the REPL runtime over stdio\n\n* fix(coding-agent): reject pending host requests on kernel teardown\n\nThe runtime now fails pending host_request futures when stdin hits EOF or\na shutdown request arrives, so a cell awaiting a host reply can no longer\nblock _serve from consuming the shutdown and wedge the process. Startup\nand busy-kernel messages plus the ipython tool description now say Python\nkernel, matching the default REPL runtime client.\n\n* chore(coding-agent): describe the kernel-heavy test tag client-neutrally\n\n* feat(coding-agent): make the REPL runtime the only kernel\n\nRemoves the Jupyter/ipykernel/ZMQ kernel client, the fork server, the\nPRIME_AGENT_KERNEL escape hatch, and the %%bash/%cd/%env cell rewriting.\nMagic-style cells (%/%%/!) return a one-line error naming the Python or\nbash() replacement. The kernel venv no longer installs ipykernel;\nexisting venvs are rebuilt once via the bootstrap schema bump. Old\nsnapshot artifacts still restore through the runtime's pickle compat.\n\n* fix(coding-agent): close MCP transports in REPL shutdown\n\n* fix(coding-agent): address bash() review findings — exact tail retention, foreground-status lifecycle with group anchoring, post-kill forkserver reap, Windows start-id parity, executor-free await\n\n* fix(coding-agent): tree-kill bash() process trees on Windows and make running reflect group liveness\n\n* fix(runtime): address repl runtime review findings\n\n- revalidate targeted interrupts through SIGINT delivery so a stale signal\n  cannot cancel a later request\n- preserve a parked untargeted interrupt while another request is inflight\n- reject non-string interrupt ids and validate snapshot options\n  (prune_oversized bool, max_bytes/max_variable_bytes present => int)\n- guard str(exc) in error/skip/fail reasons so a broken __str__ cannot\n  kill the runtime\n- fail the snapshot when the manifest write fails (before any pruning)\n- report 'snapshot not found' reason on restore of a missing path\n- wait unbounded for the output-pump drain marker so done never precedes\n  captured output and marker bytes never leak\n- document that aggregate-cap skips are not pruned\n\n* fix(coding-agent): carry bash() status pipe as stdin so strict-POSIX shells accept single-digit fd redirections\n\n* fix(coding-agent): address host-swap review findings — runtime-neutral kernel wording, %cd/%env rewrite fidelity, linear-time magic regexes, restart supersession guard\n\n* fix(coding-agent): reject stale column-0 line magics on any cell line, not just the first\n\n* fix(coding-agent): close status fds when wake-pipe creation fails and gate bash() commands on orphan-journal registration\n\n* fix(coding-agent): strip quoted %cd targets, use UTF-16-safe %env parsing, and expand $var/${var} values PEP-215-style\n\n* fix(coding-agent): fail rlm.run fast outside a live kernel so vitest workers cannot hang on a comm that never replies\n\n* fix(coding-agent): clear the active cell id before terminal events so late background output is never tagged with a finished cell\n\n* fix(coding-agent): update legacy IPython-era tests to assert cutover behavior\n\n* fix(coding-agent): describe the column-0 magic scan without referencing the removed rewrite backend\n\n* fix(coding-agent): consume parked interrupts on compile failures and survive user-closed stdio in the drain path\n\n* fix(coding-agent): redact bare %env listings, prefer '=' in %env parsing, echo %cd targets, and keep graceful shutdowns owning their cleanup\n\n* fix(coding-agent): reject kernel startup promptly on spawn errors and commit %cd previous-dir tracking only after chdir succeeds\n\n* fix(coding-agent): trim ParsedIpythonBashCell to the body field its callers use\n\n* fix(coding-agent): kill full process trees in the Windows orphan reaper via taskkill /T\n\n* fix(coding-agent): survive compile-phase crashes and fd-reuse drain hangs in the REPL runtime\n\n* fix(coding-agent): shield snapshot prune deletions from interrupts and pin the host comm probe to its real seam\n\n* fix(coding-agent): route list_names through the per-request backstop and skip non-string namespace keys\n\n* fix(coding-agent): reject snapshot requests whose manifest path aliases the payload path\n\n* fix(coding-agent): reject negative snapshot size caps that would prune every user variable\n\n* fix(coding-agent): kill one-shot await bash() on cancel, resolve Windows helpers via System32, retry taskkill after reap, and fail closed on orphan-journal enrollment\n\n* fix(coding-agent): attribute REPL stream output at write time so raw fd and user-thread bytes never carry another cell's id\n\n* fix(coding-agent): surface unattributed REPL stream output as separate background output instead of dropping or merging it\n\n* fix(coding-agent): confirm group exit before a cancelled one-shot bash() await propagates and complete-write orphan-journal records\n\n* fix(coding-agent): expose a working sys.stdout.buffer on the tagged REPL writer routing bytes through the null-attributed raw channel\n\n* fix(coding-agent): mark between-cell background output truncated when the pending buffer cap is hit\n\n* fix(coding-agent): shield the cancelled-await bash() confirm-exit from re-cancellation, fail clearly without bash on Windows, and fence slow pumps out of result assembly\n\n* fix(coding-agent): survive hostile protocol lines in the REPL reader thread and interrupt without pthread_kill on Windows\n\n* fix(coding-agent): send the protocol shutdown from dispose() so the runtime closes MCP servers and kills live bash groups before the hard kill\n\n* fix(coding-agent): flag the pump's read-to-commit window so the bash() drain fence cannot miss an in-flight chunk\n\n* fix(coding-agent): guard the whole REPL request line against hostile input, reject duplicate in-flight ids, complete short buffer-pipe writes, and clean the snapshot temp file on KeyboardInterrupt\n\n* fix(coding-agent): drop stale between-cell background output on kernel teardown so it cannot surface after a restart\n\n* fix(coding-agent): assert the tagged channel only in the large buffer-write REPL test since cross-channel ordering is not guaranteed\n\n* fix(coding-agent): resolve taskkill via absolute System32 path in the host orphan reaper\n\n* fix(coding-agent): write the inactive orphan-journal record only after a delivered kill so undelivered signals leave the host reaper in charge\n\n* fix(coding-agent): keep a REPL request interrupt-targetable through its trailing-expression repr and output drain until done is emitted\n\n* fix(coding-agent): count an already-exited leader as delivered in the Windows bash() reap so clean exits still journal inactive\n\n* fix(coding-agent): reject NaN and Infinity in emit() payloads before they corrupt REPL protocol framing\n\n* chore(coding-agent): correct the stale ipykernel requirement on the python override doc\n\n* chore(coding-agent): drop migration-era wording from kernel comments\n\n* fix(coding-agent): resolve trusted absolute shell host-side and close Windows journal/reap gaps\n\n* fix(coding-agent): best-effort-kill pid-only orphan records in daemon force-stop and recovery reaps\n\n* refactor(coding-agent): drop the magic-cell rejection gate\n\n%-prefixed and !-prefixed cells now reach CPython and fail with its own\nSyntaxError, which names the offending line. The rejection layer guarded\nagainst model-produced IPython syntax, but with the shipped prompt fresh\nsessions do not produce it, and the plain SyntaxError is protection enough.\nparseIpythonBashCell stays: transcripts from ipykernel-era sessions render\n%%bash cells with shell highlighting forever.\n\n* fix(coding-agent): report a committed destructive snapshot as success even when an interrupt was parked\n\n* chore(ai): drop stray live-regen drift in models.generated.ts\n\nad657d7ec accidentally committed generate-models output produced by a local\nbuild; the catalog belongs to its own regen PRs.\n\n* test(coding-agent): expect a plain SyntaxError for legacy %%bash cells after the magic-rejection gate removal\n\n* fix(coding-agent): consume a finishing-targeted interrupt after a completed state request instead of failing the done\n\n* fix(coding-agent): exit the REPL runtime when its owner dies even during a busy cell\n\n* fix(coding-agent): resolve the kernel bash shell only from trusted absolute paths on Windows\n\n* fix(coding-agent): contain Windows bash children with kill-on-close job objects\n\n* test(coding-agent): cover owner death during a non-yielding REPL cell\n\n* fix(coding-agent): skip concurrently deleted names during snapshot instead of aborting\n\n* fix(coding-agent): fall back to taskkill when job termination fails\n\n* fix(coding-agent): stop telling REPL-default users they need ipykernel\n\n* fix(coding-agent): clear the SIGINT target when its request finishes\n\n* test(coding-agent): drop migration-era wording from the %%bash rejection comment\n\n* fix(coding-agent): start Windows bash children suspended and fail closed when job containment cannot be established\n\n* fix(coding-agent): re-assert the kernel SIGINT handler between cells so a cell rebinding SIGINT cannot break interrupts\n\n* fix(coding-agent): kill the whole tree for enriched orphan records on Windows force-stop\n\nstopTrackedProcess signals only the shell pid on Windows; use killOrphanProcess (taskkill /T) after the identity check, matching the owned-session-worker and daemon-supervisor reapers.\n\n* docs(coding-agent): describe current magic-cell behavior in release notes\n\nMagic-style cells fail with a plain SyntaxError; the migration error and %cd/%env rewrites were removed, so the notes stop claiming them.\n\n* fix(coding-agent): skip the liveness check when the orphan identity is stale\n\nA reused pid looked like a failed kill after the identity re-check skipped taskkill, blocking worker cleanup with a spurious failure.\n\n* fix(coding-agent): journal Windows bash() children before job assignment so a kernel kill mid-spawn cannot leak an unjournaled suspended process\n\n* fix(coding-agent): pre-create the Windows bash() job before spawn and contain the child before the journal start-id query\n\n* fix(coding-agent): create Windows bash() children atomically inside the kill-on-close job via PROC_THREAD_ATTRIBUTE_JOB_LIST, closing the Popen-to-assignment leak window\n\n* chore(coding-agent): compress the atomic-job-association comments to one-line rationale\n\n* fix(coding-agent): send duplicate-id protocol errors outside the interrupt lock and reject int payloads in the captured stdout buffer\n\n* docs(coding-agent): update the kernel provisioner docstring for the REPL/IPython split\n\n* fix(coding-agent): retain the Windows bash() process handle through job cleanup and taskkill fallbacks so a recycled pid can never be killed\n\n* fix(coding-agent): serialize Windows bash() abort cleanup under the kill lock so shutdown taskkill can never race the process-handle close\n\n* fix(coding-agent): commit REPL snapshot payload and manifest atomically via unique temp files with guaranteed cleanup and parked-SIGINT restore\n\n* fix(coding-agent): stage REPL restore before an interrupt-parked apply and recover committed snapshot/restore results from protocol interrupts so a committed operation is never misreported as failed\n\n* chore(coding-agent): compress restore-shield rationale comments to one line each\n\n* fix(coding-agent): surface unattributed background output in IPython cell details and render it after the traceback in the expanded cell view\n\n* docs(coding-agent): replace stale Jupyter comm vocabulary in rlm-runtime failure modes and focused validation with stdio-transport equivalents\n\n* docs(coding-agent): describe the REPL trust boundary and runtime-bootstrap failure in stdio terms and drop the removed TokenUsage export\n\n* fix(runtime): address REPL review findings\n\n* fix(runtime): preserve near-cap snapshots\n\n---------\n\nCo-authored-by: Seth <seth@primeintellect.ai>"},{"name":"pyproject.toml","kind":"file","size":583,"lastCommitHash":"42ea9046ab9f75bc0fcf9f455d853f530cc15ae7","lastCommitWhen":"2026-07-23T17:52:00-07:00","lastCommitMessage":"feat(coding-agent): agent-callable refine skill (#504)\n\n* feat(coding-agent): background refine planning to not block conversation\n\nSplit the synchronous _refine() flow into two phases:\n- Planning (background): LLM call via completeSimple without\n  disconnecting from agent events or aborting the agent\n- Application (synchronous, fast): waits for agent idle, then\n  disconnects briefly, applies proposal, saves harness state,\n  rebuilds system prompt, emits refine_complete event\n\nrefine() public method signature unchanged. _waitForRefineIdle()\nonly blocks for the application phase. Interactive mode\nhandleRefineCommand fires refine without blocking the UI.\n\nRace condition fixes found by Macroscope and Cursor Bugbot:\n- Serialize concurrent refine calls via _refineApplyPending flag\n- Remove abort() from apply phase to preserve concurrent work\n- Narrow _refineInFlight to only cover disconnect+apply+reconnect\n- Re-check _refineApplyPending at turn handoff guards\n- Block turns during apply transition window\n- Clear _refineApplyPending on dispose\n- Re-sync systemPrompt after refine completes at handoff\n\n* fix(coding-agent): harden refine error paths and in-flight guard\n\n- Schedule pending message resume on planning failure and cancellation\n  so queued turns started during background planning are not stranded\n- Set _refineInFlight before calling _applyRefine so synchronous\n  listeners on refine_complete see the guard\n- Wrap refine_complete _emit in try/catch so listener failures do not\n  flip a successful refinement into a reported failure\n\nFound by Cursor Bugbot and Macroscope.\n\n* fix(coding-agent): preserve extension systemPrompt at handoff re-sync\n\nRestore extensionResult?.systemPrompt ?? this._baseSystemPrompt at\nline 3056 which was accidentally changed to just this._baseSystemPrompt\nduring the handoff re-sync refactor. Without this, heartbeat and other\nextension-modified system prompts were clobbered.\n\n* fix(coding-agent): preserve extension systemPrompt at handoff re-sync\n\nLift extensionResult declaration outside the try block so it can be\nreferenced at the handoff re-sync point. After _waitForRefineIdle,\nre-apply extensionResult?.systemPrompt ?? this._baseSystemPrompt\ninstead of just this._baseSystemPrompt so extension-modified prompts\nsurvive a concurrent refine.\n\nFound by Macroscope.\n\n* fix(coding-agent): harden background refinement (fixes #497)\n\n* feat(coding-agent): agent-callable refine skill\n\nAdd a  Python skill (SKILL.md + kernel package) that lets the\nmodel schedule continual harness refinement from IPython via\n, mirroring how the compact skill works as both an\nagent-callable tool and a user command.\n\nChanges:\n- New  skill with  and  API\n  in packages/coding-agent/skills/refine/\n- Add  to AgentSession:  stores a\n  pending request and returns immediately (non-blocking);\n  reports pending/in-flight state\n- Register  and  handlers in the kernel host\n  bridge, gated by\n- Add  fired at the turn boundary after\n  compaction checks; calls  fire-and-forget so it cannot\n  deadlock the active tool call\n- Filter the  skill from  when auto-refine\n  is not available (non-persisted sessions, subagent depth > 0)\n- Clean up  in the dispose path\n- Update RLM prompt and harness state instructions to reference\n   instead of\n- Add  constant to refinement module\n- 16 tests covering scheduling, status, turn-boundary consumption,\n  validation, gating, and dispose cleanup\n\n* test(coding-agent): align refine skill prompt assertions\n\n* feat(coding-agent): serialize refinement and persist initial goals\n\nSerialize automatic refinement at turn boundaries, abort stale branch work,\nprotect concurrent harness writes with baseline conflict checks, and preserve\nsubagent model selection across daemon rehydration.\n\nAdd durable top-level initial goals, daemon/SDK plumbing, immediate session\nflushes, inherited daemon-worker environment scrubbing, refine_complete\nevents, and real JSON CLI/socket/supervisor/worker process coverage.\n\n* fix: preserve serialized refine and snapshot catch-up\n\n* fix: guard agent_end auto-refine scheduling in serialized mode\n\nIn serialized mode, _scheduleAutoRefineAfterAgentEnd was called\nunconditionally at agent_end. When a background plan failed at the\nshouldStopAfterTurn boundary (cooldownMs=0, turn threshold met),\n_maybeAutoRefine fired from the interactive path via setTimeout(0),\nrunning a duplicate review+refine the boundary explicitly skipped.\n\nGuard _scheduleAutoRefineAfterAgentEnd behind the existing\n!this._serializedRefine check at the agent_end handler, matching\nthe _consumePendingRequestedRefine guard one line above.\n\nRegression test proves agent_end does not schedule _maybeAutoRefine\nafter a checkpoint failure (cooldownMs=0, turnInterval=1).\n\n* test: drive agent_end event path in serialized auto-refine guard regression\n\nThe previous test only waited after the checkpoint without actually\ninvoking the agent_end code path, so it passed even with the guard\nreverted. Now sets _lastAssistantMessage, spies\n_scheduleAutoRefineAfterAgentEnd, mocks _checkCompaction(false), and\ndrives _handleAgentEvent({type:'agent_end'}) through\n_processAgentEvent → _agentEventQueue. Verified the test fails when\nthe guard is temporarily reverted and passes when restored.\n\n* fix: re-queue explicit refine.run on serialized background plan failure\n\nWhen serialized background planning for an explicit refine.run fails\nat the turn boundary, the consumed request was silently dropped — the\nagent received 'scheduled: true' but no refinement ran.\n\nSerializedBackgroundPlanResult failure now carries explicit, options,\nand branchVersion. At the checkpoint, when the failure was for an\nexplicit request (skipReview=true), branchVersion is still current,\nand no newer _pendingRequestedRefine exists, the original options are\nrestored to _pendingRequestedRefine and fall through to the existing\nsynchronous pending path. Newer requests retain priority; interval\nfailures keep no-retry cooldown semantics; stale branch failures never\nrequeue.\n\nTests: (1) explicit bg plan fails then boundary replan/apply succeeds,\n(2) interval bg failure does not retry, (3) stale branch failure does\nnot requeue, (4) newer pending supersedes failed older request.\n\n* fix: prevent disposal double-refine after explicit drain\n\nIn _drainPendingRefinementForDisposal, after draining a pending\nrefine.run via _runSerializedRefine, _assistantTurnsSinceAutoRefine\nand _lastAutoRefineReviewAt were not reset. The subsequent interval\ncheck could trigger a second refinement during teardown.\n\nStamp cooldown and reset counter immediately after the explicit\ndrain, mirroring the background-plan drain path above.\n\nRegression test proves: one explicit plan/apply and zero subsequent\ninterval review/apply during disposal when the turn counter was due.\nTest verified to fail (2 planCalls) when the bookkeeping is reverted\nand pass (1 planCall) when restored.\n\nNote: public refine() vs _serializedPlanInFlight coordination deferred\npending independent design review — that hunk was reverted.\n\n* fix: coordinate public refine with serialized background planning\n\nPublic refine() now waits for _serializedPlanInFlight in its\nserialization loop. When a serialized background plan is in flight\n(started during an active turn at message_end), public refine first\nawaits the plan promise (no overlapping model calls), then waits for\nagent idle so the active turn's shouldStopAfterTurn checkpoint\nconsumes and applies the plan. Only then does public planning start.\n\nThis prevents: (1) overlapping _planRefine model calls, (2) mid-turn\n_applyRefine via _applySerializedPlan, (3) duplicate consumers of\nthe same serialized plan promise.\n\nRegression test uses a real active turn with a blocking gate tool:\nwhile the tool executes, an explicit refine.run starts bg planning,\nthen public refine() is called concurrently. Asserts max _planRefine\nconcurrency=1, bg plan applied once, public plan applied once.\nVerified mutant-sensitive: fails (planCalls=2, concurrent) without\nthe guard, passes (planCalls sequential) with it.\n\nAlso fixes disposal double-refine: after draining a pending\nrefine.run via _runSerializedRefine, stamps cooldown and resets\n_assistantTurnsSinceAutoRefine so the interval check doesn't trigger\na second refinement during teardown.\n\n* test: strengthen public-refine concurrency regression\n\nGate tool now signals from execute entry; asserts isStreaming===true\nbefore calling handleRefineHostRequest (no manual isStreaming\nfalsification). Replaces Promise.allSettled with Promise.race against\na bounded 10s timeout so failures surface. Captures plan objects and\noptions on _applyRefine, asserts apply order/identity: bg plan-1\nwith instructions 'bg' first, then public plan-2 with instructions\n'public'. Mutant-sensitive: fails (planCalls=2, concurrent) on\npre-fix source, passes with the guard.\n\n* Fix quiescence, aborted-refine, and prompt race in refine apply\n\nSnapshot _baseSystemPrompt before extension hooks so a refine that\ncompletes during the hook is detected and its stale extension prompt\ndiscarded. Replace bare waitForIdle in _applyRefine with requestAbort +\nPromise.allSettled over agent, event queue, compaction, and branch\nsummary to ensure full session quiescence without cancelling child\nruns. Clear _pendingRequestedRefine on aborted turns so stale requests\ndo not leak to subsequent checkpoints. Force pending message resume\nafter refine to re-arm queue drained by requestAbort.\n\n* fix(coding-agent): preserve refine completion event wiring\n\n* fix(coding-agent): defer serialized compaction refinement\n\n* fix(coding-agent): finish headless stack review fixes\n\nfixes #497\n\n* fix(coding-agent): cancel queued refinement on abort\n\nfixes #514\n\n* fix(coding-agent): harden refinement lifecycle (fixes #514)\n\n* fix(coding-agent): resolve serialized refine races (fixes #514)\n\n* fix(coding-agent): guard serialized planning (fixes #514)\n\n* fix(coding-agent): preserve injected prompt extensions (fixes #514)\n\n* fix(coding-agent): preserve empty injected prompts (fixes #514)\n\n* fix(coding-agent): harden combined refine stack (fixes #504)\n\n* fix(coding-agent): clear aborted refine options (fixes #504)\n\n* fix(coding-agent): make latest refine request win (fixes #504)\n\n* fix(coding-agent): record stale refine cooldown (fixes #504)\n\n* fix(coding-agent): prioritize explicit refine (fixes #504)\n\n* fix(coding-agent): close final refine races (fixes #504)\n\n* fix(coding-agent): invalidate superseded refine plans (fixes #504)\n\n---------\n\nCo-authored-by: Kevin Thomas <kevin.jt2007@gmail.com>"},{"name":"SKILL.md","kind":"file","size":2076,"lastCommitHash":"61eb64748eb077e2a084432db92d101a2a83e146","lastCommitWhen":"2026-08-26T15:24:10-07:00","lastCommitMessage":"Minimal CPython REPL runtime (rlm.repl) (#1685)\n\n* feat(coding-agent): add async-by-default bash() to the kernel runtime\n\n* chore(coding-agent): tighten bash() comments and changelog fragment\n\n* feat(coding-agent): add a standalone CPython REPL runtime speaking JSON lines over stdio\n\n* chore(coding-agent): tighten REPL runtime comments\n\n* feat(coding-agent): run the kernel on the REPL runtime over stdio\n\n* fix(coding-agent): reject pending host requests on kernel teardown\n\nThe runtime now fails pending host_request futures when stdin hits EOF or\na shutdown request arrives, so a cell awaiting a host reply can no longer\nblock _serve from consuming the shutdown and wedge the process. Startup\nand busy-kernel messages plus the ipython tool description now say Python\nkernel, matching the default REPL runtime client.\n\n* chore(coding-agent): describe the kernel-heavy test tag client-neutrally\n\n* feat(coding-agent): make the REPL runtime the only kernel\n\nRemoves the Jupyter/ipykernel/ZMQ kernel client, the fork server, the\nPRIME_AGENT_KERNEL escape hatch, and the %%bash/%cd/%env cell rewriting.\nMagic-style cells (%/%%/!) return a one-line error naming the Python or\nbash() replacement. The kernel venv no longer installs ipykernel;\nexisting venvs are rebuilt once via the bootstrap schema bump. Old\nsnapshot artifacts still restore through the runtime's pickle compat.\n\n* fix(coding-agent): close MCP transports in REPL shutdown\n\n* fix(coding-agent): address bash() review findings — exact tail retention, foreground-status lifecycle with group anchoring, post-kill forkserver reap, Windows start-id parity, executor-free await\n\n* fix(coding-agent): tree-kill bash() process trees on Windows and make running reflect group liveness\n\n* fix(runtime): address repl runtime review findings\n\n- revalidate targeted interrupts through SIGINT delivery so a stale signal\n  cannot cancel a later request\n- preserve a parked untargeted interrupt while another request is inflight\n- reject non-string interrupt ids and validate snapshot options\n  (prune_oversized bool, max_bytes/max_variable_bytes present => int)\n- guard str(exc) in error/skip/fail reasons so a broken __str__ cannot\n  kill the runtime\n- fail the snapshot when the manifest write fails (before any pruning)\n- report 'snapshot not found' reason on restore of a missing path\n- wait unbounded for the output-pump drain marker so done never precedes\n  captured output and marker bytes never leak\n- document that aggregate-cap skips are not pruned\n\n* fix(coding-agent): carry bash() status pipe as stdin so strict-POSIX shells accept single-digit fd redirections\n\n* fix(coding-agent): address host-swap review findings — runtime-neutral kernel wording, %cd/%env rewrite fidelity, linear-time magic regexes, restart supersession guard\n\n* fix(coding-agent): reject stale column-0 line magics on any cell line, not just the first\n\n* fix(coding-agent): close status fds when wake-pipe creation fails and gate bash() commands on orphan-journal registration\n\n* fix(coding-agent): strip quoted %cd targets, use UTF-16-safe %env parsing, and expand $var/${var} values PEP-215-style\n\n* fix(coding-agent): fail rlm.run fast outside a live kernel so vitest workers cannot hang on a comm that never replies\n\n* fix(coding-agent): clear the active cell id before terminal events so late background output is never tagged with a finished cell\n\n* fix(coding-agent): update legacy IPython-era tests to assert cutover behavior\n\n* fix(coding-agent): describe the column-0 magic scan without referencing the removed rewrite backend\n\n* fix(coding-agent): consume parked interrupts on compile failures and survive user-closed stdio in the drain path\n\n* fix(coding-agent): redact bare %env listings, prefer '=' in %env parsing, echo %cd targets, and keep graceful shutdowns owning their cleanup\n\n* fix(coding-agent): reject kernel startup promptly on spawn errors and commit %cd previous-dir tracking only after chdir succeeds\n\n* fix(coding-agent): trim ParsedIpythonBashCell to the body field its callers use\n\n* fix(coding-agent): kill full process trees in the Windows orphan reaper via taskkill /T\n\n* fix(coding-agent): survive compile-phase crashes and fd-reuse drain hangs in the REPL runtime\n\n* fix(coding-agent): shield snapshot prune deletions from interrupts and pin the host comm probe to its real seam\n\n* fix(coding-agent): route list_names through the per-request backstop and skip non-string namespace keys\n\n* fix(coding-agent): reject snapshot requests whose manifest path aliases the payload path\n\n* fix(coding-agent): reject negative snapshot size caps that would prune every user variable\n\n* fix(coding-agent): kill one-shot await bash() on cancel, resolve Windows helpers via System32, retry taskkill after reap, and fail closed on orphan-journal enrollment\n\n* fix(coding-agent): attribute REPL stream output at write time so raw fd and user-thread bytes never carry another cell's id\n\n* fix(coding-agent): surface unattributed REPL stream output as separate background output instead of dropping or merging it\n\n* fix(coding-agent): confirm group exit before a cancelled one-shot bash() await propagates and complete-write orphan-journal records\n\n* fix(coding-agent): expose a working sys.stdout.buffer on the tagged REPL writer routing bytes through the null-attributed raw channel\n\n* fix(coding-agent): mark between-cell background output truncated when the pending buffer cap is hit\n\n* fix(coding-agent): shield the cancelled-await bash() confirm-exit from re-cancellation, fail clearly without bash on Windows, and fence slow pumps out of result assembly\n\n* fix(coding-agent): survive hostile protocol lines in the REPL reader thread and interrupt without pthread_kill on Windows\n\n* fix(coding-agent): send the protocol shutdown from dispose() so the runtime closes MCP servers and kills live bash groups before the hard kill\n\n* fix(coding-agent): flag the pump's read-to-commit window so the bash() drain fence cannot miss an in-flight chunk\n\n* fix(coding-agent): guard the whole REPL request line against hostile input, reject duplicate in-flight ids, complete short buffer-pipe writes, and clean the snapshot temp file on KeyboardInterrupt\n\n* fix(coding-agent): drop stale between-cell background output on kernel teardown so it cannot surface after a restart\n\n* fix(coding-agent): assert the tagged channel only in the large buffer-write REPL test since cross-channel ordering is not guaranteed\n\n* fix(coding-agent): resolve taskkill via absolute System32 path in the host orphan reaper\n\n* fix(coding-agent): write the inactive orphan-journal record only after a delivered kill so undelivered signals leave the host reaper in charge\n\n* fix(coding-agent): keep a REPL request interrupt-targetable through its trailing-expression repr and output drain until done is emitted\n\n* fix(coding-agent): count an already-exited leader as delivered in the Windows bash() reap so clean exits still journal inactive\n\n* fix(coding-agent): reject NaN and Infinity in emit() payloads before they corrupt REPL protocol framing\n\n* chore(coding-agent): correct the stale ipykernel requirement on the python override doc\n\n* chore(coding-agent): drop migration-era wording from kernel comments\n\n* fix(coding-agent): resolve trusted absolute shell host-side and close Windows journal/reap gaps\n\n* fix(coding-agent): best-effort-kill pid-only orphan records in daemon force-stop and recovery reaps\n\n* refactor(coding-agent): drop the magic-cell rejection gate\n\n%-prefixed and !-prefixed cells now reach CPython and fail with its own\nSyntaxError, which names the offending line. The rejection layer guarded\nagainst model-produced IPython syntax, but with the shipped prompt fresh\nsessions do not produce it, and the plain SyntaxError is protection enough.\nparseIpythonBashCell stays: transcripts from ipykernel-era sessions render\n%%bash cells with shell highlighting forever.\n\n* fix(coding-agent): report a committed destructive snapshot as success even when an interrupt was parked\n\n* chore(ai): drop stray live-regen drift in models.generated.ts\n\nad657d7ec accidentally committed generate-models output produced by a local\nbuild; the catalog belongs to its own regen PRs.\n\n* test(coding-agent): expect a plain SyntaxError for legacy %%bash cells after the magic-rejection gate removal\n\n* fix(coding-agent): consume a finishing-targeted interrupt after a completed state request instead of failing the done\n\n* fix(coding-agent): exit the REPL runtime when its owner dies even during a busy cell\n\n* fix(coding-agent): resolve the kernel bash shell only from trusted absolute paths on Windows\n\n* fix(coding-agent): contain Windows bash children with kill-on-close job objects\n\n* test(coding-agent): cover owner death during a non-yielding REPL cell\n\n* fix(coding-agent): skip concurrently deleted names during snapshot instead of aborting\n\n* fix(coding-agent): fall back to taskkill when job termination fails\n\n* fix(coding-agent): stop telling REPL-default users they need ipykernel\n\n* fix(coding-agent): clear the SIGINT target when its request finishes\n\n* test(coding-agent): drop migration-era wording from the %%bash rejection comment\n\n* fix(coding-agent): start Windows bash children suspended and fail closed when job containment cannot be established\n\n* fix(coding-agent): re-assert the kernel SIGINT handler between cells so a cell rebinding SIGINT cannot break interrupts\n\n* fix(coding-agent): kill the whole tree for enriched orphan records on Windows force-stop\n\nstopTrackedProcess signals only the shell pid on Windows; use killOrphanProcess (taskkill /T) after the identity check, matching the owned-session-worker and daemon-supervisor reapers.\n\n* docs(coding-agent): describe current magic-cell behavior in release notes\n\nMagic-style cells fail with a plain SyntaxError; the migration error and %cd/%env rewrites were removed, so the notes stop claiming them.\n\n* fix(coding-agent): skip the liveness check when the orphan identity is stale\n\nA reused pid looked like a failed kill after the identity re-check skipped taskkill, blocking worker cleanup with a spurious failure.\n\n* fix(coding-agent): journal Windows bash() children before job assignment so a kernel kill mid-spawn cannot leak an unjournaled suspended process\n\n* fix(coding-agent): pre-create the Windows bash() job before spawn and contain the child before the journal start-id query\n\n* fix(coding-agent): create Windows bash() children atomically inside the kill-on-close job via PROC_THREAD_ATTRIBUTE_JOB_LIST, closing the Popen-to-assignment leak window\n\n* chore(coding-agent): compress the atomic-job-association comments to one-line rationale\n\n* fix(coding-agent): send duplicate-id protocol errors outside the interrupt lock and reject int payloads in the captured stdout buffer\n\n* docs(coding-agent): update the kernel provisioner docstring for the REPL/IPython split\n\n* fix(coding-agent): retain the Windows bash() process handle through job cleanup and taskkill fallbacks so a recycled pid can never be killed\n\n* fix(coding-agent): serialize Windows bash() abort cleanup under the kill lock so shutdown taskkill can never race the process-handle close\n\n* fix(coding-agent): commit REPL snapshot payload and manifest atomically via unique temp files with guaranteed cleanup and parked-SIGINT restore\n\n* fix(coding-agent): stage REPL restore before an interrupt-parked apply and recover committed snapshot/restore results from protocol interrupts so a committed operation is never misreported as failed\n\n* chore(coding-agent): compress restore-shield rationale comments to one line each\n\n* fix(coding-agent): surface unattributed background output in IPython cell details and render it after the traceback in the expanded cell view\n\n* docs(coding-agent): replace stale Jupyter comm vocabulary in rlm-runtime failure modes and focused validation with stdio-transport equivalents\n\n* docs(coding-agent): describe the REPL trust boundary and runtime-bootstrap failure in stdio terms and drop the removed TokenUsage export\n\n* fix(runtime): address REPL review findings\n\n* fix(runtime): preserve near-cap snapshots\n\n---------\n\nCo-authored-by: Seth <seth@primeintellect.ai>"}]