[{"name":"benchmarks","kind":"directory","size":0,"lastCommitHash":"4bf122bb6fd3455b09511791a16a00022098f8a7","lastCommitWhen":"2026-09-14T18:02:33-04:00","lastCommitMessage":"add a persistent update channel with a /nightly command (#2323)\n\n* add a persistent update channel with a /beta command\n\nSelf-updates read latest.json or beta.json based on the running version's\nprerelease tag, with no way to choose. This adds an updateChannel setting,\n--beta/--stable flags on prime-agent update that persist it, a /beta slash\ncommand that switches to beta and updates immediately (/beta off returns to\nstable, /beta status reports the choice), and routes startup version notices\nand compiled-install updates through the same preference.\n\n* apply formatter output from pre-commit check\n\n* warn and confirm before switching updates to the beta channel\n\n/beta no longer flips the setting itself. The update command prints that beta\nbuilds are unreleased and may be broken, asks for confirmation unless --force\nis given, persists the channel only after a yes, and then continues into the\nexisting busy-session confirmation.\n\n* let a channel switch install the current beta and read the channel from global settings\n\nA stable 1.2.3 never saw 1.2.3-beta.N as an update because prerelease ordering\nranks it lower. isReleaseUpdateCandidate keeps same-channel updates strictly\nnewer but accepts a different version with a base version that is not older\nwhen the user explicitly switched channels. The CLI, compiled updates, and\nstartup notices use it. getUpdateChannel now reads global settings only, so a\nproject settings file cannot override the user's choice, and ignores values\nother than stable or beta.\n\n* gate the beta switch before any update work and never persist it on cancel\n\nThe public update command now accepts --beta and --stable. The beta warning\nand confirmation run before extensions are touched, the channel is persisted\nonly after the busy-session confirmation succeeds or when nothing needs\ninstalling, and a beta manifest that cannot be resolved aborts instead of\nfalling back to the stable registry package. Cancelled or refused updates exit\nwith the not-attempted code when launched from the interactive client, so\n/beta declined is a no-op rather than a relaunch.\n\n* treat an unresolved beta manifest as a no-op for compiled installs and reject channel flags on extension-only updates\n\ngetNativeUpdatePlan now throws NativeReleaseUnavailableError when the manifest\ncannot be resolved, and the self-update plan maps that to the same\nnon-runnable beta-unavailable result the npm path uses, so /beta does not\nrelaunch the client when nothing was installed. --beta and --stable are\nrejected for extension-only targets rather than being accepted and ignored,\nmirroring --rollback.\n\n* keep exit code 1 when the session-loss prompt is declined\n\nThe interactive parent relies on a non-sentinel exit there, and an existing\ntest pins it. The not-attempted sentinel stays for the beta-specific\ncancellations: the beta warning declined, the non-TTY refusal, and an\nunresolvable beta manifest.\n\n* map every failed compiled-release lookup to the unavailable plan and save a confirmed channel even without an updater\n\nNetwork, timeout, and malformed-manifest errors from the compiled release\nlookup now surface as NativeReleaseUnavailableError with the cause attached,\nso a /beta run on a compiled install is a no-op instead of a failed update\nthat relaunches the client. When no self-update command exists for the\ninstall, the already-confirmed channel switch is still persisted before the\nmanual-update guidance is printed.\n\n* benchmarks: clamp CPU deltas at zero when a child exits mid-measurement\n\ncpu_total() sums CPU time over the live process tree, so a process exiting\nbetween the start and end samples lowers the total and the raw delta can go\nslightly negative. The report schema rejects negative observations, which\naborted the agents_view trial on the main baseline and left 19 measurements\nincomplete. cpu_delta() clamps at zero; all ten sites use it.\n\n* list the channel flags in the public update help\n\nThe public command registry renders its own usage for prime-agent update\n--help; it still advertised only --force and --rollback.\n\n* rename the channel surface to nightly\n\n/nightly, --nightly, the saved updateChannel value, and every message now say\nnightly. The release bucket still publishes these builds as beta (beta.json and\n-beta.N version tags), so that mapping stays internal to version-check.\n\n* never install a lower base version, even with --force\n\n--force is also how a channel switch is scripted without a TTY, so it must not\ndouble as permission to downgrade. Both the npm and compiled update plans now\nrefuse a release whose major.minor.patch is below the installed version and\nleave the channel unchanged; compiled installs are pointed at --rollback.\n\n* report being ahead of a channel as nothing to update\n\nA channel whose current release is below the installed base version is still\nnever installed, but without --force that is now a green no-op with the\nnot-attempted exit code, so a plain update or /nightly off while ahead does\nnot fail or relaunch the client. With --force the refusal stays explicit. The\ncompiled path returns the refusal in its plan instead of throwing, so the\ninteractive client treats it the same way.\n\n* guard a missing nightly manifest by the effective channel\n\nA -beta install with no saved preference is on the nightly channel by\ninference, so an unresolvable manifest must abort for it too instead of\nfalling through to the stable registry package.\n\n* reload settings after the updater child returns without relaunching\n\n/nightly persists the channel inside the update child. When that child installs\nnothing, the interactive parent keeps running with its in-memory settings, so\n/nightly status could report the old channel. Reload from disk before reporting.\n\n* say what was not updated instead of claiming nothing was installed\n\nWith an all target, extensions may already have been updated before the\nnightly manifest lookup fails or a downgrade is refused. Both messages now\nstate that Prime Agent itself was not updated.\n\n* keep a successful extension update when the self update is unavailable\n\nFor an all target the extensions are updated before the self update is\nplanned. A missing nightly manifest or refused downgrade now reports that\nPrime Agent was not updated without failing the run that already updated\nextensions.\n\n---------\n\nCo-authored-by: Seth Karten <32787133+sethkarten@users.noreply.github.com>"},{"name":"evals","kind":"directory","size":0,"lastCommitHash":"6af0e1a4efdfa4f20b1e680f57797397f38090db","lastCommitWhen":"2026-09-14T08:25:03+02:00","lastCommitMessage":"[RSI] swarm-fanout capability eval harness (#2283)\n\n* feat(evals): add swarm-fanout capability eval harness\n\nMeasures multi-agent orchestration under one prompt: per-shard RLM\ndelegation, fan-in, dedup, and receipt accounting, scored from\non-disk artifacts (spawn ledger, sub-* child session dirs, parent\ntranscript, combined index) rather than agent claims.\n\n- Two model-free fixtures (JSONL event logs, CSV host metrics), eight\n  machine-checkable shards each with recomputable expected answers.\n- Pure scorer with an anti-cheat rubric: coverage, delegation evidence\n  (a no-spawn parent fails), dedup with a one-retry budget, and receipt\n  completeness (silent drops and delete-to-hide fail).\n- Runner mirroring the swe-fix-loop contract: --mode json headless run,\n  isolated agent home, deterministic ledger path (sha256 of the\n  canonical sessions dir), protocol-envelope daemon teardown, scored\n  result JSON in every failure mode.\n- 29 model-free self-tests including a stub-agent end-to-end fan-out,\n  every cheat case, and live-verified launch/teardown mechanics.\n\n* fix(evals): harden swarm-fanout scoring against review round one\n\nReview round one (Macroscope, Cursor Bugbot) found five valid gaps;\neach is fixed with a regression test (35 self-tests total):\n\n- delegation evidence now requires a live depth-1 ledger edge for\n  every shard worker, with each edge backed by its recorded child\n  session file on disk; helper-named spawns and unrelated sub-*\n  dirs can no longer satisfy the rubric.\n- dedup replay tracks only the fan-out's own depth-1 children, so a\n  renamed grandchild can no longer shadow a worker name and flag a\n  legitimate spawn as duplicate.\n- ledger parsing validates each record's fields against the product\n  schema (parseLedgerLine) before replay; structurally invalid\n  spawn lines count as malformed, never as delegation evidence.\n- the runner strips GIT_DIR, GIT_INDEX_FILE, GIT_WORK_TREE, and the\n  object/common-dir overrides before initializing the fixture repo,\n  so inherited git location variables cannot redirect the fixture\n  commit into the caller's repository.\n- the csv-metrics task prompt's worked example now names its own\n  fixture's shards (worker-metrics-01, not the json fixture's\n  events-01), so a compliant model cannot be sent to missing files.\n\n* fix(evals): harden swarm-fanout scoring per review round two\n\nSeven more review findings fixed, each with a regression test\n(43 self-tests total):\n\n- coverage keeps every duplicate shard bullet and fails conflicting\n  ones, so a fabricated answer can no longer overwrite a correct\n  one by appearing later in the index.\n- delegation claims each verified worker's child session (dir and\n  file) exclusively, so one child session can no longer back\n  multiple worker edges.\n- dedup binds a shard's worker name to the child's spawn-time name:\n  renaming the first child away no longer frees the name for a\n  duplicate spawn while it is still live.\n- receipts require an explicit fromRelationship of child; records\n  missing the stamp can no longer receipt a dropped child.\n- ledger path handling splits on both separators, so Windows\n  backslash-joined child paths verify delegation and receipts.\n- the runner strips RLM_DEPTH and RLM_MAX_DEPTH from the eval agent\n  environment (an embedding RLM session must not shift the eval\n  parent's depth or block spawning), and platform-independent\n  parent-file matching for ledger discovery.\n- daemon teardown retries the socket for a bounded window after a\n  timed-out launch, so a daemon that binds after the CLI died is\n  still shut down instead of leaking as an orphan.\n\n* fix(evals): complete review round two fixes and reject Windows\n\nCompleting three fixes that review round three flagged (44\nself-tests total):\n\n- parse_answers now really keeps every duplicate shard bullet and\n  coverage fails conflicting duplicates order-independently (the\n  earlier commit claimed this but lost the edit before writing;\n  the regression test now also covers a correction landing after a\n  wrong bullet).\n- ledger replay keys edges by (childId, canonical child path),\n  mirroring the product's edgeKey: two spawns sharing a childId\n  but naming different child sessions stay distinct edges, and a\n  rename or delete applies only to the edge its own path names.\n- the runner refuses to run on Windows with an explicit message\n  (the per-workdir Unix daemon socket and AF_UNIX shutdown client\n  have no named-pipe support), and ledger parent discovery no\n  longer crashes on a type-valid record with an empty parent."},{"name":"lib","kind":"directory","size":0,"lastCommitHash":"b5807b6f932ae3b208bc190176bc04a72126ff23","lastCommitWhen":"2026-08-20T10:01:49-07:00","lastCommitMessage":"Changelog fragments: conflict-free changelog entries (#1589)\n\n* feat(coding-agent): add changelog fragments with CI check and release-time aggregation (ENG-5408)\n\n* refactor: flag-day cutover — remove [Unreleased] sections entirely\n\nPer review: drop the transition machinery. All four changelogs lose their\n[Unreleased] header; coding-agent's pending entries move into a fragment.\nrelease.mjs no longer re-adds the header; the CI check accepts only\nfragments (or the no-changelog label). The stray-[Unreleased] absorption\nstays in buildReleaseSection so an accidentally merged old-style entry is\nfolded into the release instead of stranded. Test file removed.\n\n* fix: address bot findings — escape version in dry-run regex, refuse empty fragments\n\nCodeQL: the dry-run preview regex embedded the CLI version argument\nunescaped. Macroscope: empty fragments were git rm'd without appearing in\nthe changelog; the release now aborts on them and the CI check requires\nthe added fragment to have content. Cursor: normalizeFragment unexported.\n\n* fix(ci): verify fragment content, not just line additions\n\nA whitespace-only fragment passed the additions>0 guard but aborts the\nrelease. The check now reads each candidate fragment's content via its\ncontents_url (head-repo scoped, so fork PRs work) and requires non-blank\ntext.\n\n* refactor: decouple CI from release semantics for empty fragments\n\nThe fail-closed release abort forced CI to predict exactly what release\nwould reject, which pulled content fetching and fork-ref handling into\nthe workflow. Empty fragments have nothing to lose, so the release now\nwarns and leaves them unconsumed instead of aborting; CI goes back to a\nplain added-file presence check. Also trims comments and doc blocks.\n\n* fix(ci): fail closed when a PR exceeds the listFiles cap\n\nAbove 3000 changed files the API cannot return the full list, so the\ncheck could miss a src change. The no-changelog label remains the\nexplicit escape hatch."},{"name":"assemble-release-archives.mjs","kind":"file","size":3071,"lastCommitHash":"ebe299ee599d2e7444c034d1b38af38808036e74","lastCommitWhen":"2026-09-15T14:43:17-04:00","lastCommitMessage":"publish musl and baseline linux archives so linux stops falling back to node (#2344)\n\n* publish musl and baseline linux archives so linux stops falling back to node\n\nAdds linux-arm64-musl, linux-x64-baseline, linux-x64-musl, and\nlinux-x64-musl-baseline to the compiled release set, and teaches the\ninstaller to select them from the host's libc and CPU flags.\n\n* name the missing libstdc++ package instead of routing musl hosts to node\n\nCompiled musl archives link libstdc++, which Alpine does not preinstall. On a\nbare Alpine host the probe failed, the installer printed sixty raw relocation\nerrors and then `the compiled executable cannot run on this machine`, which is\nfalse: one `apk add --no-cache libstdc++` makes the same binary run. With the\ndefault auto method it was worse - the installer announced the Node fallback and\nthen died on `Node.js 20.6.0 or newer is required`, telling a bare-Alpine user to\ninstall Node when the real fix is a 2 MB package.\n\nThe installer now recognises that loader failure (the named library, or musl's\nC++ relocation signature), hides the relocation wall, and prints three lines\nnaming the package and the Alpine command.\n\nAuto mode deliberately stops there instead of falling back to Node: the host can\nrun the compiled build, so downloading a 377 MB Node installation is the wrong\ndefault, and on the most common musl host that fallback cannot even succeed.\n`PRIME_AGENT_INSTALL_METHOD=node` remains the explicit escape hatch and is named\nin the message. Every other probe failure keeps the previous behaviour, including\nthe auto fallback to Node.\n\nSecond fix, same path: a failed first install left `.managed` plus empty `bin/`\nand `releases/` behind, so a later run saw a managed native root with no\nexecutable. The root is now given back when this run adopted it and never\nactivated a release; a root an earlier successful install owns, or one holding\nanything else, is left alone.\n\nVerified on a real bare arm64 alpine:3.21 container against a local release feed\nbefore and after the change, including that the install still succeeds after\n`apk add --no-cache libstdc++`."},{"name":"bench-attach-bytes.mjs","kind":"file","size":4260,"lastCommitHash":"7c4df72953572312bfbf919dc6292b24a2295e13","lastCommitWhen":"2026-06-09T23:15:13-07:00","lastCommitMessage":"speed up daemon startup and tui streaming performance (#117)\n\n* perf: daemon early-listen, single ensure, faster polls, streaming benches + identity tests\n\n* perf: lazy-load extension bundles, cli-highlight, and typebox/compile off the startup path\n\n* perf: slim attach payload for capable clients (skip event + top-level state/messages)\n\n* perf: reconcile assistant message at render time + per-block markdown render cache\n\n* perf: stop double-sending partial message in daemon message_update events\n\n* test: add attach payload benchmark script\n\n* perf: spawn interactive daemon before importing the heavy module graph\n\n* test: isolate session dirs in runtime tests to stop leaking into the shared sessions dir\n\n* perf: bundle cli entry with esbuild for ~3x faster startup\n\n* add --dist flag to prime-agent.sh to run the bundled build\n\n* address review bot findings: honor --cwd in early daemon spawn, fix theme null colors check, fix bench script edge cases"},{"name":"bench-daemon-startup.mjs","kind":"file","size":2171,"lastCommitHash":"7c4df72953572312bfbf919dc6292b24a2295e13","lastCommitWhen":"2026-06-09T23:15:13-07:00","lastCommitMessage":"speed up daemon startup and tui streaming performance (#117)\n\n* perf: daemon early-listen, single ensure, faster polls, streaming benches + identity tests\n\n* perf: lazy-load extension bundles, cli-highlight, and typebox/compile off the startup path\n\n* perf: slim attach payload for capable clients (skip event + top-level state/messages)\n\n* perf: reconcile assistant message at render time + per-block markdown render cache\n\n* perf: stop double-sending partial message in daemon message_update events\n\n* test: add attach payload benchmark script\n\n* perf: spawn interactive daemon before importing the heavy module graph\n\n* test: isolate session dirs in runtime tests to stop leaking into the shared sessions dir\n\n* perf: bundle cli entry with esbuild for ~3x faster startup\n\n* add --dist flag to prime-agent.sh to run the bundled build\n\n* address review bot findings: honor --cwd in early daemon spawn, fix theme null colors check, fix bench script edge cases"},{"name":"browser-smoke-entry.ts","kind":"file","size":155,"lastCommitHash":"3e5ad67e0f325d4888f82f9b82966218eb4407f5","lastCommitWhen":"2026-05-07T15:59:42+02:00","lastCommitMessage":"chore: migrate pi packages to earendil works scope\n"},{"name":"build-binaries.sh","kind":"file","size":5918,"lastCommitHash":"62d3d855861908cd2772f8181f1ae74ce89003ca","lastCommitWhen":"2026-06-23T14:26:06-07:00","lastCommitMessage":"ship bundled skills in the release layouts (#240)\n\nThe default skills (edit, goal, rlm-heartbeat, …) resolve from\n<packageDir>/skills, but no release path copied skills/ into the\nshipped layout, so deployed agents silently loaded zero built-in\nskills.\n\n- copy skills/ in copy-assets, build-binaries.sh, and the release packer\n- warn loudly when the bundled skills dir is missing or empty so a\n  packaging slip can't degrade silently again\n- add regression tests for the diagnostic and the packaging scripts"},{"name":"capture-alibaba-session.mjs","kind":"file","size":2928,"lastCommitHash":"3300d5024544c751178578349aa38164d669b3d8","lastCommitWhen":"2026-09-17T07:09:25+03:00","lastCommitMessage":"feat(usage): host-driven feeds for every provider, plus the extension seam\n\nThe first pass had one provider and one shape. dawn wants /usage to cover what she actually\npays for - antigravity, hyper, opencode-go, zai, deepseek, alibaba - and to reuse the same\nrules from a macOS app, so the query became a definition instead of a function.\n\nA feed is now driven by the host: `advance(state, responses)` returns either the requests to\nsend or the finished report. The host owns HTTP, which is what lets one definition run in the\nCLI, in the Zig core, and in a tray. It also covers the providers that need more than one call\n- hyper reads /v1/teams before it can ask for that team's billing - without inventing a second\nconcept for them.\n\n- packages/ai/docs/usage-feeds.md is the contract: report shape, credential kinds, and the unit\n  rules (percent vs fraction vs remaining-fraction vs dollars; epoch seconds vs milliseconds vs\n  ISO-8601) that every provider gets wrong in its own way.\n- seven feeds: openai-codex, anthropic (the normalised limits[] array, not the codenamed\n  windows), google-antigravity (including the antigravity/... user-agent its endpoint gates on),\n  hyper (plan allocation vs remaining credits, two-step, dollar balance), opencode-go, zai, and\n  deepseek, which is balance-only and therefore has no windows at all.\n- reports gained `balance` and `notes`, so a provider without a percentage is not forced into\n  one, and `skipped` became {provider, reason} - a key-only alibaba now says \"needs a session\n  credential\" instead of going quiet.\n- credentials are provider-defined: oauth, apiKey, or a captured session. alibaba's token-plan\n  keys are inference-only, so its quota needs a console session, and\n  scripts/capture-alibaba-session.mjs turns a browser HAR export into the 0600 session file the\n  bridge reads.\n- pi.registerProvider(..., { usage }) registers a feed from an extension into the same lookup, so\n  a provider dawn builds herself is covered by /usage with no new wiring, and unregistering drops\n  it. Documented in docs/custom-provider.md.\n\nVerified: 64 tests across the five usage suites (every feed driven through the host loop with\nscripted responses, no network in any of them), coding-agent usage 12/12 plus the CLI and\ninteractive suites, tsgo and biome clean.\n"},{"name":"check-browser-smoke.mjs","kind":"file","size":1148,"lastCommitHash":"a80bbc22275d20bc35c0145b5f69c1d1451eb4c5","lastCommitWhen":"2026-03-14T04:48:52+01:00","lastCommitMessage":"fix(check): make browser smoke check cross-platform on windows\n"},{"name":"check-installer.mjs","kind":"file","size":13336,"lastCommitHash":"cd10724fe02bbe9a18592737de17c8101710bf73","lastCommitWhen":"2026-09-02T19:29:45+02:00","lastCommitMessage":"fix(installer): support npm 12 remote dependency policy (#1992)\n\n* fix(installer): support npm 12 remote dependency policy\n\n* fix(installer): allow verified npm 12 postinstall\n\n* refactor(installer): simplify npm 12 coverage\n\n* refactor(installer): consolidate installer checks"},{"name":"check-test-policy.mjs","kind":"file","size":25796,"lastCommitHash":"cf07c5a3f5eca98e7744f2df83050044c920252a","lastCommitWhen":"2026-09-16T16:28:13-04:00","lastCommitMessage":"delete dead tests and fix the races the flaky ones were hiding (#2336)\n\n* add an objective testing policy to AGENTS.md\n\n* fix flaky daemon supervisor monitor test\n\nThe supervisor availability check is a real async chain (registry stat,\nsocket probe, replacement launch) started from a timer callback, so the\ntest drove a bounded fake-timer pump and asserted on a probe counter.\nUnder a loaded CI shard the chain did not finish inside the iteration\nbudget, and the variant mixing fake timers with a real probe promise\ncould deadlock for the full 30s test timeout.\n\nExpose a settled promise per armed availability check and await it in\nthe tests, so each assertion runs after the check finished instead of\nafter an arbitrary number of clock advances.\n\n* remove vitest retry masking from ai and attach-image tests\n\nDeleted all 548 `retry:` options in packages/ai/test and the 2 in\nkernel-attach-image-skill.test.ts. Retries hid non-determinism instead of\nfixing it, so a broken code path could still go green.\n\n- Deleted 17 live-only cross-provider E2E matrices whose every case sits behind\n  skipIf(!API_KEY) and never runs in CI; stream.test.ts stays as the survivor\n  that owns the provider table.\n- Stripped the retry option from the 198 stream.test.ts cases and dropped the\n  live E2E describe (plus its now-unused helpers) from\n  anthropic-thinking-disable.test.ts, keeping its mocked payload contract.\n- Removed retry: 1 from the two attach-image kernel cases; they pass without it.\n\nMocked wire/SSE contract tests are untouched. Tests only, no product code.\n\n* make agent trace upload tests deterministic\n\nThe suite pumped a synthetic clock with advanceTimersUntil() and hoped real\nfs and promise work settled inside a 200-step budget, asserted schedule\ndelays through a global setTimeout spy whose fake clock had drifted, and\nremoved its temp dir while catch-up and cursor writers were still running.\nUnder a loaded CI shard that produced \"Timed out advancing fake timers\",\n\"expected 1000 to be 60000\" and \"ENOTEMPTY rmdir /tmp/agent-traces-test-*\".\n\nThe upload scheduler now reports the delay it arms and the outcome of each\ncycle, the upload reports every wait it arms before the next request, and\ninstallAgentTraceUpload returns a handle that resolves when the startup\ncatch-up and any in-flight upload have finished writing. Tests await those\nsignals and advance the fake clock by the exact reported delay, and teardown\nwaits for in-flight writers before removing the temp dir.\n\nThe ~15 retry, backoff and Retry-After variants collapse into one\ntable-driven it.each, per the MERGE verdict: 1569 -> 1141 lines, 44 -> 27\ntest blocks, with no lost coverage.\n\n* make the compiled artifact and installer probe tests deterministic\n\nThe compiled-artifact afterEach polled for supervisor exit with the same\n10s budget as vitest's hook timeout, so the poll could never report on the\nslower standalone runners. The teardown now escalates to SIGKILL and every\ninner deadline stays below the surrounding hook and test budgets.\n\nnative-probe-timeout decided pass/fail from wall-clock deadlines around a\nreal 10s installer probe. The installer probe deadline is now injectable\nthrough PRIME_AGENT_PROBE_TIMEOUT_SECONDS, the blocked probe records the\ninstall lock itself, and the spawn deadlines are gone.\n\n* fix daemon shutdown admission loss during slow scans\n\nshutdown --force holds a 5s admission lease refreshed by a 1s timer, but it\nblocks its own event loop in synchronous ps/lsof/ss scans. On a loaded runner a\nscan outlasts the lease, the elapsed record is treated as abandoned, and the\nholder's next assertOrRenew throws \"Daemon shutdown admission was lost\".\n\n- A late renew re-arms a record that is still ours; only a missing or foreign\n  record ends the admission.\n- A renew that could not read the registry no longer retires the lease.\n- isDaemonShutdownAdmissionActive is read-only, so a bystander probe cannot\n  delete a live holder's record.\n- stopHiddenSupervisors renews before the blocking scan.\n\nThe 4603 regression drops its 11s sleep for a post-shutdown listener assertion\nand uses mkdtemp for the child TMPDIR.\n\n* delete 148 dead test files\n\nRemoves test files judged CUT by a full 480-file audit: duplicates of a named survivor, mock-asserting tests, rendered-copy assertions, private-internals casts, and live-API matrices behind skipIf(!API_KEY) that never ran in CI.\n\n* merge interactive-mode and agents-view test suites\n\n* merge tui render, overlay and helper test suites\n\n* test: slim daemon-mode and agent-connection-daemon suites\n\ndaemon-mode: keep passive hydration/passivation, delete_subagent durability, agent-message concurrency and rate limits, attach-snapshot backpressure; drop per-race internal regressions already covered process-level by daemon-supervisor-process.\nagent-connection-daemon: keep reconnect, update-restart, chunked-snapshot assembly and disposal races; drop tautological daemon-protocol pass-through cases.\n\n* merge tui editor, markdown and autocomplete test suites\n\n* test: merge audited session-core test bloat\n\nExecute MERGE verdicts from the 480-file test audit for the agent-session\ncore suites: collapse near-identical blocks into it.each tables, drop\nmock-return/rendered-copy assertions and private-cast white-box cases,\nand fold one-off files into the owning suite.\n\nDeleted (folded into their owning suite):\n- agent-session-concurrent.test.ts, suite/agent-session-action-races.test.ts,\n  suite/agent-session-action-contracts.test.ts -> suite/agent-session-queue.test.ts\n- suite/agent-session-compaction-continuation.test.ts,\n  suite/agent-session-compact-skill.test.ts -> suite/agent-session-compaction.test.ts\n- agent-session-runtime-events.test.ts -> suite/agent-session-runtime.test.ts\n\nPreserved: process boundaries (daemon RPC, ACP), on-disk formats,\nconcurrency/ordering, crash/restart/resume and load coverage.\n\n* address review: octal probe timeout, truncated deadline, dead schedule field\n\n* test: merge redundant coding-agent test cases into case tables\n\nExecutes the MERGE verdicts from the 480-file test-bloat audit for the\nmisc lanes. Repeated near-identical blocks collapse into single it.each\ncase tables, and ticket-numbered one-off files fold into the owning\nmodule suite.\n\nRemoved throughout the touched files: assertions on mock return values,\nassertions on rendered text/copy, `as unknown as` casts into privates,\nand suites gated behind skipIf(!API_KEY) (which never ran in CI).\n\nPreserved: process boundaries (daemon RPC, ACP), on-disk formats,\nconcurrency and ordering, crash/restart/resume, and load.\n\nDeleted files, folded into their module suite:\n- compaction-extensions -> deleted outright (whole file behind skipIf(!API_KEY))\n- compaction-serialization -> compaction\n- heartbeat-catalog -> daemon-client\n- child-process -> exec\n- edit-tool-legacy-input -> tools\n- kernel-goal-skill, kernel-rlm-heartbeat-skill -> kernel-agent-message-skill\n- kernel-agent-observe-skill -> kernel-attach-image-skill\n- kernel-windows-process -> kernel-bootstrap-windows\n- extensions-input-event -> extensions-runner\n- sdk-skills -> sdk-session-manager\n- session-manager/{agent-status,has-user-content} -> session-manager/session-state\n- session-manager/migration -> session-manager/file-operations\n- session-manager/custom-session-id -> session-manager/tree-traversal\n\n* slim ai + regression tests (lanes A/B/D/E)\n\nExecute MERGE verdicts from the test audit for packages/ai and the\nupdate-restart / snapshot / session-view regression files.\n\n- fold ticket-numbered regression cases into the owning suites\n- collapse near-identical blocks into it.each tables\n- drop mock-return, rendered-copy and live-API-gated assertions\n\n* test: collapse package-manager tables and fold small daemon selector suites\n\npackage-manager: git-URL parsing, top-level/manifest/package glob filters and npm install-argv cases are now table-driven.\ndaemon-session-id: absorbs daemon-catalog-process selector case, drops display-id formatting trivia.\ndaemon-worker-windows-timeouts: absorbs the connection-deadline budget cases from daemon-worker-connect.\ndaemon-catalog-startup: drops the src-directory one-off.\n\n* test: collapse refinement, settings and config suites into case tables\n\nFinal misc lane of the test-bloat audit.\n\n- refinement: per-kind create/update/delete becomes one it.each lifecycle;\n  8 rejection suites become one 18-row invalid-edit table that also asserts\n  state and the refinement log stay untouched; truncation/parse errors,\n  scope permutations, ranking and the tokenizer each become one table.\n  System-prompt and user-prompt copy assertions removed.\n- settings-manager: per-setting default getters removed; unknown-key\n  preservation, invalid-file guards and project-vs-global precedence kept.\n- config: install-method detection becomes one table; session-dir env\n  permutations collapse into one precedence test.\n- builtin-skills, repl-kernel-abort, session-cwd, truncate: repeated blocks\n  collapsed; one ReplInternals reach-in dropped.\n- child-process folds into exec as one process lifecycle suite.\n\n* slim regression tests (lane C)\n\nFold the remaining ticket-numbered regression files into the owning\nmodule suites and collapse duplicate cases into it.each tables.\n\n- 19 regression files deleted after their kept cases moved into\n  agent-session-queue, auth-storage, acp-features, resource-loader,\n  agent-session-runtime/compaction/retry-events/recursion,\n  model-registry, slash-commands, daemon-supervisor-process\n- 3 files slimmed in place where the named target no longer exists\n- drop rendered-copy, mock-return and private-cast assertions\n\n* test: collapse daemon protocol, command, list, ps and package-command suites\n\ndaemon-protocol: two gating tables replace 16 near-identical capability/schema cases.\ndaemon-command: table-driven argv parsing plus the --goal leak guards; drops help/usage copy assertions.\ndaemon-session-list: activity, recap and model-fallback projections are table-driven.\ndaemon-ps: keeps planReap/planShutdownAll safety rules, drops ss/lsof parsers, sorting and uptime trivia.\ndaemon-stop-confirm: one busy-guard table, no prompt copy.\npackage-command-paths: one shared self-update fixture for the install-spec cases; drops help and removed-flag copy.\nacp-events: keeps only the cases the ACP suite does not cover end to end.\ndaemon-session-summarizer: one recap/status parse table.\ndaemon-extension-binding: keeps the duplicated-partial-message strip.\n\n* test: tighten the daemon stop-confirm busy-guard table\n\n* fix ci: biome forEach body, vacuous autocomplete case, missing prompt before second compaction\n\n* fix ci: restore escaped template literals in prompt-template cases\n\n* fix codeql: single-pass path escaping in test helpers\n\n* address review: flush debounced trace uploads, restore probe timeout guards, drop dead test scaffolding\n\n* respect retry-after and throttle window when flushing trace uploads\n\n* await in-flight trace uploads before a drain returns\n\n* extend deterministic test policy to python\n\n* harden deterministic test policy checks\n\n* close test policy edge cases\n\n* finish deterministic policy edge coverage\n\n* fix policy lexer and macos signature setup\n\n* mask regex literals in test policy checks\n\n* distinguish postfix division in policy lexer\n\n* close native migration signal race\n\n* keep native migration force timer owned\n\n---------\n\nCo-authored-by: prime-agent <agent@local>"},{"name":"check-zig.mjs","kind":"file","size":3502,"lastCommitHash":"8ad5124d59a3c4443792459193fc3fe9953cd2be","lastCommitWhen":"2026-09-17T07:09:26+03:00","lastCommitMessage":"build(native): take the usage core from its own repository\n\nThe Zig core grew its own contract (an ABI, a CLI, a Swift wrapper, eight providers) and its\nown lifecycle, so it moved to ~/proj/usage-core and is consumed here as a submodule at the\nsame path. Nothing else moved: every doc, script and test still says native/usage.\n\nIts history came along — `git subtree split --prefix=native/usage` — so the extraction did not\nflatten twenty commits of reasoning into a snapshot.\n\nThree things this pass fixed on the way in:\n\n- scripts/check-zig.mjs ran `zig build test` and then built the Swift wrapper, which links the\n  *installed* static library. That only worked while an earlier `zig build` had left a zig-out\n  behind; on a clean checkout it failed with \"no such file or directory: zig-out/lib/\n  libusage.a\". The install step now runs explicitly.\n- the missing-core message described a missing file. Now that the core arrives as a submodule,\n  \"not checked out\" is the likelier state, so it names the command that fixes it.\n- the pre-commit restage loop called `git add` on every staged path. A path inside a submodule\n  makes git refuse (\"is in submodule 'native/usage'\"), which failed the hook on this very\n  commit, so it now restages only paths this repository tracks.\n\nDocs caught up with the code they describe: usage-query.md still documented the abi-1 surface\n(usage_build_request/usage_parse, one provider), and usage-feeds.md and the README described a\nrequest without the `kind` both implementations now emit.\n\n.gitmodules points at the local path for now, because the core has no remote yet; one\n`git submodule set-url native/usage <url>` repoints it once it does.\n"},{"name":"cost.ts","kind":"file","size":5451,"lastCommitHash":"c84f2f25dee23a5b9bbc5ff8d200f8634afa08eb","lastCommitWhen":"2026-01-09T23:54:50+01:00","lastCommitMessage":"Fix lint warnings: use literal keys instead of bracket notation\n"},{"name":"edit-tool-stats.mjs","kind":"file","size":32649,"lastCommitHash":"235b247f1f09dd177062e2f9ce0d6983e1876c6d","lastCommitWhen":"2026-03-22T04:20:38+01:00","lastCommitMessage":"fix(coding-agent): built-in tools work like extension tools\n\nExport readToolDefinition / createReadToolDefinition and the equivalent built-in ToolDefinition APIs from @mariozechner/pi-coding-agent.\n"},{"name":"kernel-venv-race-probe.mjs","kind":"file","size":4795,"lastCommitHash":"92214706071e3745ccd043e0ace814ba7452024e","lastCommitWhen":"2026-09-17T14:10:42+03:00","lastCommitMessage":"fix(coding-agent): make the kernel venv rebuild atomic and the kernel runtime self-healing\n"},{"name":"pack-prime-agent-release.mjs","kind":"file","size":12728,"lastCommitHash":"e9d68d92c58492fe554c843ba90f894bcff3fe66","lastCommitWhen":"2026-09-15T15:28:12-07:00","lastCommitMessage":"make release manifest parsing forward-compatible (#2370)\n\n* fix: make release manifest parsing forward-compatible\n\nUnknown future platform entries in the release manifest no longer cause\nvalid known binary entries to be discarded. The parser now skips unknown\nplatforms while keeping strict validation for known ones (duplicates, bad\nfilenames, bad sha256 still reject).\n\nClient-facing manifests (beta.json / latest.json) now advertise only the\nfour legacy platforms (darwin-arm64, darwin-x64, linux-arm64, linux-x64)\nso pre-fix clients are not bricked by the new musl and baseline archive\nentries. All eight archives remain built, checksummed, and present in\nSHA256SUMS for the installer.\n\n* fix: publish versioned binary manifests"},{"name":"preview-installer-splash.sh","kind":"file","size":1357,"lastCommitHash":"2278e0f47f18109aeadfaaf75d0b94831b2f911f","lastCommitWhen":"2026-06-08T14:48:07-07:00","lastCommitMessage":"fix installer splash resize stability (#105)"},{"name":"profile-coding-agent-node.mjs","kind":"file","size":19069,"lastCommitHash":"dcc569c09b20929838202901897209d3ec66373e","lastCommitWhen":"2026-03-25T23:05:04+01:00","lastCommitMessage":"chore(coding-agent): emit startup benchmark metrics\n"},{"name":"read-tool-stats.mjs","kind":"file","size":21638,"lastCommitHash":"29dea9a4e6939b96983c2e97997d13fc7b6befb1","lastCommitWhen":"2026-05-07T22:18:19+02:00","lastCommitMessage":"feat(scripts): add session context stats\n"},{"name":"release-artifact-integrity.mjs","kind":"file","size":1990,"lastCommitHash":"598eebe8cd6645983c43d50647af9e36e9b07bc0","lastCommitWhen":"2026-09-14T08:27:39+02:00","lastCommitMessage":"fix invalid macos signatures in compiled releases (#2265)\n\n* fix compiled macos signing and gate final release artifacts\n\n* simplify readme installer command without weakening https\n\n* shorten readme install command\n\n* follow the release channel in the real archive installer test\n\nThe final macOS validation job exercises the beta archive, whose compiled\nexecutable resolves updates from beta.json rather than latest.json. Serve\nthe manifest on the channel the archive's version selects, then move to\nlatest.json once the stable 99.0.0 release is active.\n\n* restore https-only redirect policy in readme install command\n\ncurl follows HTTPS-to-HTTP redirects by default, so dropping\n--proto-redir '=https' let a downgrade redirect pipe unauthenticated\noutput into sh. Keep the flags the readme's HTTPS boundary depends on."},{"name":"release-platforms.mjs","kind":"file","size":1441,"lastCommitHash":"e9d68d92c58492fe554c843ba90f894bcff3fe66","lastCommitWhen":"2026-09-15T15:28:12-07:00","lastCommitMessage":"make release manifest parsing forward-compatible (#2370)\n\n* fix: make release manifest parsing forward-compatible\n\nUnknown future platform entries in the release manifest no longer cause\nvalid known binary entries to be discarded. The parser now skips unknown\nplatforms while keeping strict validation for known ones (duplicates, bad\nfilenames, bad sha256 still reject).\n\nClient-facing manifests (beta.json / latest.json) now advertise only the\nfour legacy platforms (darwin-arm64, darwin-x64, linux-arm64, linux-x64)\nso pre-fix clients are not bricked by the new musl and baseline archive\nentries. All eight archives remain built, checksummed, and present in\nSHA256SUMS for the installer.\n\n* fix: publish versioned binary manifests"},{"name":"release.mjs","kind":"file","size":7094,"lastCommitHash":"b5807b6f932ae3b208bc190176bc04a72126ff23","lastCommitWhen":"2026-08-20T10:01:49-07:00","lastCommitMessage":"Changelog fragments: conflict-free changelog entries (#1589)\n\n* feat(coding-agent): add changelog fragments with CI check and release-time aggregation (ENG-5408)\n\n* refactor: flag-day cutover — remove [Unreleased] sections entirely\n\nPer review: drop the transition machinery. All four changelogs lose their\n[Unreleased] header; coding-agent's pending entries move into a fragment.\nrelease.mjs no longer re-adds the header; the CI check accepts only\nfragments (or the no-changelog label). The stray-[Unreleased] absorption\nstays in buildReleaseSection so an accidentally merged old-style entry is\nfolded into the release instead of stranded. Test file removed.\n\n* fix: address bot findings — escape version in dry-run regex, refuse empty fragments\n\nCodeQL: the dry-run preview regex embedded the CLI version argument\nunescaped. Macroscope: empty fragments were git rm'd without appearing in\nthe changelog; the release now aborts on them and the CI check requires\nthe added fragment to have content. Cursor: normalizeFragment unexported.\n\n* fix(ci): verify fragment content, not just line additions\n\nA whitespace-only fragment passed the additions>0 guard but aborts the\nrelease. The check now reads each candidate fragment's content via its\ncontents_url (head-repo scoped, so fork PRs work) and requires non-blank\ntext.\n\n* refactor: decouple CI from release semantics for empty fragments\n\nThe fail-closed release abort forced CI to predict exactly what release\nwould reject, which pulled content fetching and fork-ref handling into\nthe workflow. Empty fragments have nothing to lose, so the release now\nwarns and leaves them unconsumed instead of aborting; CI goes back to a\nplain added-file presence check. Also trims comments and doc blocks.\n\n* fix(ci): fail closed when a PR exceeds the listFiles cap\n\nAbove 3000 changed files the API cannot return the full list, so the\ncheck could miss a src change. The no-changelog label remains the\nexplicit escape hatch."},{"name":"render-logo.py","kind":"file","size":7058,"lastCommitHash":"5c14169759736add628d7fce28eb97b3baa85ce9","lastCommitWhen":"2026-09-11T18:33:43-07:00","lastCommitMessage":"simplify agents view and compact chat headers (#2180)\n\n* feat: simplify agents view and session details\n\n* feat(tui): compact chat and agents headers\n\n* fix(tui): replace compact mark with a text heading\n\nfixes #2181\n\n* fix: clarify agents list spacing and empty categories\n\nfixes #2180\n\n* fix: hide empty agents view categories\n\nfixes #2180\n\n* feat(tui): add compact PRIME wordmark\n\nfixes #2181\n\n* feat(tui): restore compact butterfly splash\n\nfixes #2181\n\n* fix: preserve agents view filtering during search\n\nfixes #2180\n\n* feat(tui): render compact butterfly with braille\n\n* feat(tui): render compact butterfly with solid quadrants\n\n* fix(tui): center compact header metadata\n\n* fix(tui): clarify agents list hierarchy\n\n* docs(tui): describe centered header metadata\n\n* fix(tui): place header working directory below contextual metadata\n\n* fix(tui): share a small status circle for idle and inactive rows\n\n* fix(tui): bold the status circle and tighten row icon spacing\n\n* fix(tui): drop the question mark details view\n\n* fix(tui): label the header working directory line\n\n* fix(tui): drop the subagent expand caret from agent rows\n\n* fix(tui): restore the model line in the chat splash\n\n* fix(agents): keep empty-state feedback tied to the active search\n\nFixes #2180"},{"name":"session-context-stats.mjs","kind":"file","size":19143,"lastCommitHash":"29dea9a4e6939b96983c2e97997d13fc7b6befb1","lastCommitWhen":"2026-05-07T22:18:19+02:00","lastCommitMessage":"feat(scripts): add session context stats\n"},{"name":"session-transcripts.ts","kind":"file","size":13844,"lastCommitHash":"377eca968436766bb00fcee573918d475eeec6aa","lastCommitWhen":"2026-04-08T01:59:34+02:00","lastCommitMessage":"fix(ai,coding-agent): use node:readline import prefix for Deno compatibility\n\ncloses #2885\n"},{"name":"setup-kernel-venv.sh","kind":"file","size":125,"lastCommitHash":"a48108bd1d99d403f190bfb9749bbba2a3ca6d09","lastCommitWhen":"2026-05-08T18:53:51-07:00","lastCommitMessage":"auto bootstrap the kernel runtime (#19)\n\n* add auto bootstrap for kernel runtime\n\n* guard kernel bootstrap concurrency"},{"name":"stats.ts","kind":"file","size":6549,"lastCommitHash":"9600a0c0301d0d95c9863c03c392243924fbd611","lastCommitWhen":"2026-04-30T21:47:51+02:00","lastCommitMessage":"chore: add session usage stats script\n"},{"name":"sync-versions.js","kind":"file","size":2699,"lastCommitHash":"032e3ee74574ca16efaf8745a1394b821256a5d0","lastCommitWhen":"2026-08-18T12:17:35+02:00","lastCommitMessage":"chore: remove redundant comments and unused internals (#1505)\n\n* chore: remove redundant comments\n\n* chore(tui): remove redundant export comments\n\n* chore(coding-agent): remove redundant example comments\n\n* chore(ai): remove redundant comments\n\n* chore(coding-agent): remove obsolete core comments\n\n* chore(coding-agent): remove redundant test comments\n\n* chore(coding-agent): remove redundant test comments\n\n* chore(coding-agent): remove redundant rpc test comments\n\n* chore(coding-agent): remove redundant CLI comments\n\n* chore(agent): remove redundant comments\n\n* chore(tui): remove redundant source comments\n\n* chore(coding-agent): remove redundant mode comments\n\n* chore(coding-agent): remove redundant mode comments\n\n* chore(coding-agent): remove redundant test comments\n\n* chore(ai): remove redundant source comments\n\n* chore(coding-agent): remove redundant session comments\n\n* chore(coding-agent): remove redundant core comments\n\n* chore(coding-agent): remove redundant test comments\n\n* chore(tests): remove redundant test comments\n\n* chore: remove unused internal helpers\n\n* docs: restore public API contracts\n\n* chore(coding-agent): restore invariant documentation\n\n* chore(coding-agent): clarify agent family contracts\n\n* style(coding-agent): format restored contracts\n\n* fix: restore intentional catch explanations"},{"name":"tool-stats.ts","kind":"file","size":12691,"lastCommitHash":"6d4d2e928807d90539c608fd72d6bf5604ee01fa","lastCommitWhen":"2026-05-07T11:13:45+02:00","lastCommitMessage":"add tool stats script\n"},{"name":"update-prime-local.mjs","kind":"file","size":4899,"lastCommitHash":"03c3ca484fbaa7f610a185df65fd73b05599651a","lastCommitWhen":"2026-09-17T05:52:15+03:00","lastCommitMessage":"feat(coding-agent,runtime): rebase minimal runtime extensions on upstream 0.9.3\n"},{"name":"validate-macos-release.mjs","kind":"file","size":3610,"lastCommitHash":"598eebe8cd6645983c43d50647af9e36e9b07bc0","lastCommitWhen":"2026-09-14T08:27:39+02:00","lastCommitMessage":"fix invalid macos signatures in compiled releases (#2265)\n\n* fix compiled macos signing and gate final release artifacts\n\n* simplify readme installer command without weakening https\n\n* shorten readme install command\n\n* follow the release channel in the real archive installer test\n\nThe final macOS validation job exercises the beta archive, whose compiled\nexecutable resolves updates from beta.json rather than latest.json. Serve\nthe manifest on the channel the archive's version selects, then move to\nlatest.json once the stable 99.0.0 release is active.\n\n* restore https-only redirect policy in readme install command\n\ncurl follows HTTPS-to-HTTP redirects by default, so dropping\n--proto-redir '=https' let a downgrade redirect pipe unauthenticated\noutput into sh. Keep the flags the readme's HTTPS boundary depends on."},{"name":"verify-macos-validation-receipts.mjs","kind":"file","size":1565,"lastCommitHash":"ebe299ee599d2e7444c034d1b38af38808036e74","lastCommitWhen":"2026-09-15T14:43:17-04:00","lastCommitMessage":"publish musl and baseline linux archives so linux stops falling back to node (#2344)\n\n* publish musl and baseline linux archives so linux stops falling back to node\n\nAdds linux-arm64-musl, linux-x64-baseline, linux-x64-musl, and\nlinux-x64-musl-baseline to the compiled release set, and teaches the\ninstaller to select them from the host's libc and CPU flags.\n\n* name the missing libstdc++ package instead of routing musl hosts to node\n\nCompiled musl archives link libstdc++, which Alpine does not preinstall. On a\nbare Alpine host the probe failed, the installer printed sixty raw relocation\nerrors and then `the compiled executable cannot run on this machine`, which is\nfalse: one `apk add --no-cache libstdc++` makes the same binary run. With the\ndefault auto method it was worse - the installer announced the Node fallback and\nthen died on `Node.js 20.6.0 or newer is required`, telling a bare-Alpine user to\ninstall Node when the real fix is a 2 MB package.\n\nThe installer now recognises that loader failure (the named library, or musl's\nC++ relocation signature), hides the relocation wall, and prints three lines\nnaming the package and the Alpine command.\n\nAuto mode deliberately stops there instead of falling back to Node: the host can\nrun the compiled build, so downloading a 377 MB Node installation is the wrong\ndefault, and on the most common musl host that fallback cannot even succeed.\n`PRIME_AGENT_INSTALL_METHOD=node` remains the explicit escape hatch and is named\nin the message. Every other probe failure keeps the previous behaviour, including\nthe auto fallback to Node.\n\nSecond fix, same path: a failed first install left `.managed` plus empty `bin/`\nand `releases/` behind, so a later run saw a managed native root with no\nexecutable. The root is now given back when this run adopted it and never\nactivated a release; a root an earlier successful install owns, or one holding\nanything else, is left alone.\n\nVerified on a real bare arm64 alpine:3.21 container against a local release feed\nbefore and after the change, including that the install still succeeds after\n`apk add --no-cache libstdc++`."}]