{"entries":[{"name":".gitignore","mode":"0100644","size":19,"lastCommit":{"hash":"d773015ba9b1f3e9d17a5eb801601f7688792fcf","oid":"d773015ba9b1f3e9d17a5eb801601f7688792fcf","parents":["c17c926dcb42574252eff833fcddc6233aaac1cd"],"author":{"name":"rasdani","email":"73563550+rasdani@users.noreply.github.com","when":"2026-06-24T20:37:36-07:00"},"committer":{"name":"GitHub","email":"noreply@github.com","when":"2026-06-24T20:37:36-07:00"},"message":"feat(coding-agent): bundle default websearch skill (#86)\n\n* feat(ai): add Claude Opus 4.8 to Prime Inference\n\n* feat(coding-agent): bundle default websearch skill\n\nShip a Serper-backed websearch Python skill with Prime Agent so web\nsearch works without manually installing a skill package. Bundled\nskills load by default and are overridden by user/project/package/CLI\nskills with the same name; --no-skills excludes them.\n\n* fix(coding-agent): resolve bundled skills dir by src checkout\n\nMatch the established srcOrDist asset convention: pick the package-root\nskills dir on source checkouts and dist/skills otherwise, so a stale\ndist/ from a prior build does not shadow live source edits.\n\n* fix(coding-agent): configure bundled websearch skill\n\n* fix(coding-agent): clarify websearch startup warning\n\n* store serper websearch key via /login instead of env var\n\nAdd the Serper key as an api-key credential in the /login screen so it is\nstored in auth.json and injected into the kernel as SERPER_API_KEY; an env\nvar still takes precedence. Drop the startup warning and make the skill's\nmissing-key error instruct the agent to guide the user through /login.\n\nAlso fix two websearch.py bugs: bad numeric env vars no longer crash run(),\nand truncation stays within max_output.\n\n* put serper under a services tab in /login and read its key from auth.json\n\nAdd a Providers/Services tab split to the /login selector (left/right to\nswitch) so the Serper web-search credential lives under Services instead of\nbeing buried in the provider list. Skip the post-login model picker for\nservice credentials.\n\nThe websearch skill now resolves its key from SERPER_API_KEY or auth.json on\neach call, so a key added via /login works even when the kernel started\nfirst.\n\n* harden websearch key resolution and login tab cursor handling\n\nAddress review feedback: resolve the Serper key from a programmatic (SDK)\nagentDir by exporting it to the kernel, ignore non-mapping auth.json and\n\"!command\" key references instead of crashing or sending them verbatim, and\nonly steal left/right for tab switching when the /login search field is empty\nso cursor editing still works.\n\n* resolve serper key via auth storage and fix login tab layout\n\nInject the Serper key resolved through AuthStorage (handles literal, env-var,\nand !command credential forms) into the kernel when websearch is active,\nusing the session's own storage so it is correct for SDK-injected managers.\nThe skill's mid-session auth.json fallback now resolves env-var-reference\nkeys too. Reserve the extra rows the /login tab bar consumes so the selector\nno longer overflows small terminals.\n\n* always export agent dir for websearch and clamp truncation\n\nExport PRIME_AGENT_CODING_AGENT_DIR regardless of the bundled-skill setting so\na --skill or project websearch copy can still locate auth.json; only the key\ninjection stays gated on the bundled skill. Hard-clamp truncated output so it\nnever exceeds max_output when the budget is smaller than the marker.\n\n* scope agent dir to explicit config and use callable skill form in docs\n\nPass agentDir to the session only when the caller set it explicitly, so an\ninjected custom auth storage backed by another directory is not overridden by\nthe default path. Update the websearch docs to call the skill directly. Trim\ncomments.\n\n* gate serper key injection on a loaded websearch skill, not settings\n\nInject the key whenever any websearch skill is loaded (bundled, --skill, or\nproject), so a custom skill relying on the agent to resolve command-backed\ncredentials still works when bundledSkills.websearch is off.\n\n---------\n\nCo-authored-by: Kevin Thomas ","tree":"7df97544d9bfe77d061e14fcd5ca5f53d7082ca1"}},{"name":"agent-message","mode":"0040000","size":0,"lastCommit":{"hash":"4f4d51c5b5e1d29a95ac0391556898910e1e01c7","oid":"4f4d51c5b5e1d29a95ac0391556898910e1e01c7","parents":["5a843023781b461b8cd7c7b45718f133b61e16b0"],"author":{"name":"Sebastian Müller","email":"sebastian@primeintellect.ai","when":"2026-09-10T19:15:36+02:00"},"committer":{"name":"GitHub","email":"noreply@github.com","when":"2026-09-10T19:15:36+02:00"},"message":"fold the twin agent rosters into one (#2153)\n\n* fold the twin agent rosters into one\n\nFamily discovery had two entry points: agent_message.list_agents listed the\nnuclear family including members that were only on disk, while\nagent_observe.list_agents listed live sessions plus passive subagents. Neither\nwas a superset, so an agent had to call both to know who it could reach.\n\nagent_observe.list_agents is now the single roster. It is built from the family\ncatalog that send() already uses to resolve receiver_role and receiver_name, so\nmembership has one definition. Entries carry the distinction as data: a member\nwith no live session here has no activeSessionId, keeps status \"inactive\", and\nreports only persisted facts, while live members keep their runtime detail.\nEvery entry carries its relationship, so a roster row maps directly onto a send.\n\nagent_message.list_agents is gone from the skill module and the docs; its host\nrequest now fails with a message naming agent_observe.list_agents, so an old\nkernel or a copied old transcript self-corrects.\n\nFixes RES-1335\n\n* correct the observe read scope and order the roster snapshot\n\nThe observe skill doc claimed transcript reads never work on inactive members;\nthe daemon hydrates a passive child on demand, so only root siblings in another\nworker are unreadable.\n\nBuild the resident-session map after the family catalog resolves, so a session\nthat becomes resident during the catalog's disk and supervisor IO is still\nreported with its live fields.\n\n* bound roster previews and keep peer rows honest\n\nA saved root's first user message could be any size, so copying it onto every\nsibling row made one roster reply carry the opening prompts of every saved\nsession. Saved roots no longer carry a first message at all, and the previews a\nrow can carry share one cap with the live latest-message preview.\n\nA peer working in another worker is live, so its row now keeps the active\nsession id the peer summary reports instead of claiming an active session with\nno id.\n\n* say which rows carry a first-message preview","tree":"b78cd853bce9f629812b58ee0297f19595e7cf26"}},{"name":"agent-observe","mode":"0040000","size":0,"lastCommit":{"hash":"4f4d51c5b5e1d29a95ac0391556898910e1e01c7","oid":"4f4d51c5b5e1d29a95ac0391556898910e1e01c7","parents":["5a843023781b461b8cd7c7b45718f133b61e16b0"],"author":{"name":"Sebastian Müller","email":"sebastian@primeintellect.ai","when":"2026-09-10T19:15:36+02:00"},"committer":{"name":"GitHub","email":"noreply@github.com","when":"2026-09-10T19:15:36+02:00"},"message":"fold the twin agent rosters into one (#2153)\n\n* fold the twin agent rosters into one\n\nFamily discovery had two entry points: agent_message.list_agents listed the\nnuclear family including members that were only on disk, while\nagent_observe.list_agents listed live sessions plus passive subagents. Neither\nwas a superset, so an agent had to call both to know who it could reach.\n\nagent_observe.list_agents is now the single roster. It is built from the family\ncatalog that send() already uses to resolve receiver_role and receiver_name, so\nmembership has one definition. Entries carry the distinction as data: a member\nwith no live session here has no activeSessionId, keeps status \"inactive\", and\nreports only persisted facts, while live members keep their runtime detail.\nEvery entry carries its relationship, so a roster row maps directly onto a send.\n\nagent_message.list_agents is gone from the skill module and the docs; its host\nrequest now fails with a message naming agent_observe.list_agents, so an old\nkernel or a copied old transcript self-corrects.\n\nFixes RES-1335\n\n* correct the observe read scope and order the roster snapshot\n\nThe observe skill doc claimed transcript reads never work on inactive members;\nthe daemon hydrates a passive child on demand, so only root siblings in another\nworker are unreadable.\n\nBuild the resident-session map after the family catalog resolves, so a session\nthat becomes resident during the catalog's disk and supervisor IO is still\nreported with its live fields.\n\n* bound roster previews and keep peer rows honest\n\nA saved root's first user message could be any size, so copying it onto every\nsibling row made one roster reply carry the opening prompts of every saved\nsession. Saved roots no longer carry a first message at all, and the previews a\nrow can carry share one cap with the live latest-message preview.\n\nA peer working in another worker is live, so its row now keeps the active\nsession id the peer summary reports instead of claiming an active session with\nno id.\n\n* say which rows carry a first-message preview","tree":"b78cd853bce9f629812b58ee0297f19595e7cf26"}},{"name":"atproto","mode":"0040000","size":0,"lastCommit":{"hash":"03c3ca484fbaa7f610a185df65fd73b05599651a","oid":"03c3ca484fbaa7f610a185df65fd73b05599651a","parents":["b6ac5d014d99401b55820835a4966584271e9a3c"],"author":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-08T04:11:13+09:00"},"committer":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-17T05:52:15+03:00"},"message":"feat(coding-agent,runtime): rebase minimal runtime extensions on upstream 0.9.3\n","tree":"69604d237dfc0e9897d18f423d849caa7b88a2bd"}},{"name":"attach-image","mode":"0040000","size":0,"lastCommit":{"hash":"61eb64748eb077e2a084432db92d101a2a83e146","oid":"61eb64748eb077e2a084432db92d101a2a83e146","parents":["0940833b771fbaf5144451988604b310a96722fd"],"author":{"name":"Sebastian Müller","email":"32787133+sethkarten@users.noreply.github.com","when":"2026-08-27T00:24:10+02:00"},"committer":{"name":"GitHub","email":"noreply@github.com","when":"2026-08-26T15:24:10-07:00"},"message":"Minimal CPython REPL runtime (rlm.repl) (#1685)\n\n* feat(coding-agent): add async-by-default bash() to the kernel runtime\n\n* chore(coding-agent): tighten bash() comments and changelog fragment\n\n* feat(coding-agent): add a standalone CPython REPL runtime speaking JSON lines over stdio\n\n* chore(coding-agent): tighten REPL runtime comments\n\n* feat(coding-agent): run the kernel on the REPL runtime over stdio\n\n* fix(coding-agent): reject pending host requests on kernel teardown\n\nThe runtime now fails pending host_request futures when stdin hits EOF or\na shutdown request arrives, so a cell awaiting a host reply can no longer\nblock _serve from consuming the shutdown and wedge the process. Startup\nand busy-kernel messages plus the ipython tool description now say Python\nkernel, matching the default REPL runtime client.\n\n* chore(coding-agent): describe the kernel-heavy test tag client-neutrally\n\n* feat(coding-agent): make the REPL runtime the only kernel\n\nRemoves the Jupyter/ipykernel/ZMQ kernel client, the fork server, the\nPRIME_AGENT_KERNEL escape hatch, and the %%bash/%cd/%env cell rewriting.\nMagic-style cells (%/%%/!) return a one-line error naming the Python or\nbash() replacement. The kernel venv no longer installs ipykernel;\nexisting venvs are rebuilt once via the bootstrap schema bump. Old\nsnapshot artifacts still restore through the runtime's pickle compat.\n\n* fix(coding-agent): close MCP transports in REPL shutdown\n\n* fix(coding-agent): address bash() review findings — exact tail retention, foreground-status lifecycle with group anchoring, post-kill forkserver reap, Windows start-id parity, executor-free await\n\n* fix(coding-agent): tree-kill bash() process trees on Windows and make running reflect group liveness\n\n* fix(runtime): address repl runtime review findings\n\n- revalidate targeted interrupts through SIGINT delivery so a stale signal\n cannot cancel a later request\n- preserve a parked untargeted interrupt while another request is inflight\n- reject non-string interrupt ids and validate snapshot options\n (prune_oversized bool, max_bytes/max_variable_bytes present => int)\n- guard str(exc) in error/skip/fail reasons so a broken __str__ cannot\n kill the runtime\n- fail the snapshot when the manifest write fails (before any pruning)\n- report 'snapshot not found' reason on restore of a missing path\n- wait unbounded for the output-pump drain marker so done never precedes\n captured output and marker bytes never leak\n- document that aggregate-cap skips are not pruned\n\n* fix(coding-agent): carry bash() status pipe as stdin so strict-POSIX shells accept single-digit fd redirections\n\n* fix(coding-agent): address host-swap review findings — runtime-neutral kernel wording, %cd/%env rewrite fidelity, linear-time magic regexes, restart supersession guard\n\n* fix(coding-agent): reject stale column-0 line magics on any cell line, not just the first\n\n* fix(coding-agent): close status fds when wake-pipe creation fails and gate bash() commands on orphan-journal registration\n\n* fix(coding-agent): strip quoted %cd targets, use UTF-16-safe %env parsing, and expand $var/${var} values PEP-215-style\n\n* fix(coding-agent): fail rlm.run fast outside a live kernel so vitest workers cannot hang on a comm that never replies\n\n* fix(coding-agent): clear the active cell id before terminal events so late background output is never tagged with a finished cell\n\n* fix(coding-agent): update legacy IPython-era tests to assert cutover behavior\n\n* fix(coding-agent): describe the column-0 magic scan without referencing the removed rewrite backend\n\n* fix(coding-agent): consume parked interrupts on compile failures and survive user-closed stdio in the drain path\n\n* fix(coding-agent): redact bare %env listings, prefer '=' in %env parsing, echo %cd targets, and keep graceful shutdowns owning their cleanup\n\n* fix(coding-agent): reject kernel startup promptly on spawn errors and commit %cd previous-dir tracking only after chdir succeeds\n\n* fix(coding-agent): trim ParsedIpythonBashCell to the body field its callers use\n\n* fix(coding-agent): kill full process trees in the Windows orphan reaper via taskkill /T\n\n* fix(coding-agent): survive compile-phase crashes and fd-reuse drain hangs in the REPL runtime\n\n* fix(coding-agent): shield snapshot prune deletions from interrupts and pin the host comm probe to its real seam\n\n* fix(coding-agent): route list_names through the per-request backstop and skip non-string namespace keys\n\n* fix(coding-agent): reject snapshot requests whose manifest path aliases the payload path\n\n* fix(coding-agent): reject negative snapshot size caps that would prune every user variable\n\n* fix(coding-agent): kill one-shot await bash() on cancel, resolve Windows helpers via System32, retry taskkill after reap, and fail closed on orphan-journal enrollment\n\n* fix(coding-agent): attribute REPL stream output at write time so raw fd and user-thread bytes never carry another cell's id\n\n* fix(coding-agent): surface unattributed REPL stream output as separate background output instead of dropping or merging it\n\n* fix(coding-agent): confirm group exit before a cancelled one-shot bash() await propagates and complete-write orphan-journal records\n\n* fix(coding-agent): expose a working sys.stdout.buffer on the tagged REPL writer routing bytes through the null-attributed raw channel\n\n* fix(coding-agent): mark between-cell background output truncated when the pending buffer cap is hit\n\n* fix(coding-agent): shield the cancelled-await bash() confirm-exit from re-cancellation, fail clearly without bash on Windows, and fence slow pumps out of result assembly\n\n* fix(coding-agent): survive hostile protocol lines in the REPL reader thread and interrupt without pthread_kill on Windows\n\n* fix(coding-agent): send the protocol shutdown from dispose() so the runtime closes MCP servers and kills live bash groups before the hard kill\n\n* fix(coding-agent): flag the pump's read-to-commit window so the bash() drain fence cannot miss an in-flight chunk\n\n* fix(coding-agent): guard the whole REPL request line against hostile input, reject duplicate in-flight ids, complete short buffer-pipe writes, and clean the snapshot temp file on KeyboardInterrupt\n\n* fix(coding-agent): drop stale between-cell background output on kernel teardown so it cannot surface after a restart\n\n* fix(coding-agent): assert the tagged channel only in the large buffer-write REPL test since cross-channel ordering is not guaranteed\n\n* fix(coding-agent): resolve taskkill via absolute System32 path in the host orphan reaper\n\n* fix(coding-agent): write the inactive orphan-journal record only after a delivered kill so undelivered signals leave the host reaper in charge\n\n* fix(coding-agent): keep a REPL request interrupt-targetable through its trailing-expression repr and output drain until done is emitted\n\n* fix(coding-agent): count an already-exited leader as delivered in the Windows bash() reap so clean exits still journal inactive\n\n* fix(coding-agent): reject NaN and Infinity in emit() payloads before they corrupt REPL protocol framing\n\n* chore(coding-agent): correct the stale ipykernel requirement on the python override doc\n\n* chore(coding-agent): drop migration-era wording from kernel comments\n\n* fix(coding-agent): resolve trusted absolute shell host-side and close Windows journal/reap gaps\n\n* fix(coding-agent): best-effort-kill pid-only orphan records in daemon force-stop and recovery reaps\n\n* refactor(coding-agent): drop the magic-cell rejection gate\n\n%-prefixed and !-prefixed cells now reach CPython and fail with its own\nSyntaxError, which names the offending line. The rejection layer guarded\nagainst model-produced IPython syntax, but with the shipped prompt fresh\nsessions do not produce it, and the plain SyntaxError is protection enough.\nparseIpythonBashCell stays: transcripts from ipykernel-era sessions render\n%%bash cells with shell highlighting forever.\n\n* fix(coding-agent): report a committed destructive snapshot as success even when an interrupt was parked\n\n* chore(ai): drop stray live-regen drift in models.generated.ts\n\nad657d7ec accidentally committed generate-models output produced by a local\nbuild; the catalog belongs to its own regen PRs.\n\n* test(coding-agent): expect a plain SyntaxError for legacy %%bash cells after the magic-rejection gate removal\n\n* fix(coding-agent): consume a finishing-targeted interrupt after a completed state request instead of failing the done\n\n* fix(coding-agent): exit the REPL runtime when its owner dies even during a busy cell\n\n* fix(coding-agent): resolve the kernel bash shell only from trusted absolute paths on Windows\n\n* fix(coding-agent): contain Windows bash children with kill-on-close job objects\n\n* test(coding-agent): cover owner death during a non-yielding REPL cell\n\n* fix(coding-agent): skip concurrently deleted names during snapshot instead of aborting\n\n* fix(coding-agent): fall back to taskkill when job termination fails\n\n* fix(coding-agent): stop telling REPL-default users they need ipykernel\n\n* fix(coding-agent): clear the SIGINT target when its request finishes\n\n* test(coding-agent): drop migration-era wording from the %%bash rejection comment\n\n* fix(coding-agent): start Windows bash children suspended and fail closed when job containment cannot be established\n\n* fix(coding-agent): re-assert the kernel SIGINT handler between cells so a cell rebinding SIGINT cannot break interrupts\n\n* fix(coding-agent): kill the whole tree for enriched orphan records on Windows force-stop\n\nstopTrackedProcess signals only the shell pid on Windows; use killOrphanProcess (taskkill /T) after the identity check, matching the owned-session-worker and daemon-supervisor reapers.\n\n* docs(coding-agent): describe current magic-cell behavior in release notes\n\nMagic-style cells fail with a plain SyntaxError; the migration error and %cd/%env rewrites were removed, so the notes stop claiming them.\n\n* fix(coding-agent): skip the liveness check when the orphan identity is stale\n\nA reused pid looked like a failed kill after the identity re-check skipped taskkill, blocking worker cleanup with a spurious failure.\n\n* fix(coding-agent): journal Windows bash() children before job assignment so a kernel kill mid-spawn cannot leak an unjournaled suspended process\n\n* fix(coding-agent): pre-create the Windows bash() job before spawn and contain the child before the journal start-id query\n\n* fix(coding-agent): create Windows bash() children atomically inside the kill-on-close job via PROC_THREAD_ATTRIBUTE_JOB_LIST, closing the Popen-to-assignment leak window\n\n* chore(coding-agent): compress the atomic-job-association comments to one-line rationale\n\n* fix(coding-agent): send duplicate-id protocol errors outside the interrupt lock and reject int payloads in the captured stdout buffer\n\n* docs(coding-agent): update the kernel provisioner docstring for the REPL/IPython split\n\n* fix(coding-agent): retain the Windows bash() process handle through job cleanup and taskkill fallbacks so a recycled pid can never be killed\n\n* fix(coding-agent): serialize Windows bash() abort cleanup under the kill lock so shutdown taskkill can never race the process-handle close\n\n* fix(coding-agent): commit REPL snapshot payload and manifest atomically via unique temp files with guaranteed cleanup and parked-SIGINT restore\n\n* fix(coding-agent): stage REPL restore before an interrupt-parked apply and recover committed snapshot/restore results from protocol interrupts so a committed operation is never misreported as failed\n\n* chore(coding-agent): compress restore-shield rationale comments to one line each\n\n* fix(coding-agent): surface unattributed background output in IPython cell details and render it after the traceback in the expanded cell view\n\n* docs(coding-agent): replace stale Jupyter comm vocabulary in rlm-runtime failure modes and focused validation with stdio-transport equivalents\n\n* docs(coding-agent): describe the REPL trust boundary and runtime-bootstrap failure in stdio terms and drop the removed TokenUsage export\n\n* fix(runtime): address REPL review findings\n\n* fix(runtime): preserve near-cap snapshots\n\n---------\n\nCo-authored-by: Seth ","tree":"a251ca47e114be10eb5c23cfb1de655c8aeeb954"}},{"name":"compact","mode":"0040000","size":0,"lastCommit":{"hash":"065d4423ccd3c986fdf72a50d86321fbc363adb0","oid":"065d4423ccd3c986fdf72a50d86321fbc363adb0","parents":["988e4f41dd25a6f3df9cfc66f45496d630be1969"],"author":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-17T08:52:00+03:00"},"committer":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-17T08:52:00+03:00"},"message":"Remove model-facing context metadata\n","tree":"c41e0ebb7ad81aac2f0c94710d30bc948e10bfb7"}},{"name":"display","mode":"0040000","size":0,"lastCommit":{"hash":"08a2aee8ce2314a4de32b83fbca22eeba9a979db","oid":"08a2aee8ce2314a4de32b83fbca22eeba9a979db","parents":["f712dd1d4be7767f5951957312f00568afa7961b"],"author":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-11T04:52:19+03:00"},"committer":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-17T06:25:54+03:00"},"message":"coding-agent/{kernel,skills,ui}: add display skill and ui primitive for rich user content\n","tree":"8f0f7b90f32a4a692d3bbbab96f071b14c947939"}},{"name":"edit","mode":"0040000","size":0,"lastCommit":{"hash":"e88e3a28a2336ad92bfe06c3725c290fb0e9d54e","oid":"e88e3a28a2336ad92bfe06c3725c290fb0e9d54e","parents":["f781e33779d4d57203f21db2d19746fa5b23a3c6"],"author":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-15T17:32:59+03:00"},"committer":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-17T07:04:26+03:00"},"message":"feat(runtime,skills): one calling convention, quiet attenuation, disambiguated edit, network perimeter\n\nR7 S1 (the calling convention) - the cell boundary awaited only coroutines, so a\nskill that returned a plain value made `await skill()` raise \"object X can't be\nused in 'await' expression\" (156 of those in the audit corpus). The evaluator now\nsettles whatever a call returns, `f(x)` and `await f(x)` both work, and every\neager result is settled once; `BashHandle` and a started `asyncio.Task` stay plain\nvalues on purpose, because awaiting them would silently turn `bash(cmd)` into a\nblocking one-shot.\nR7 S4/S5/S6 (runtime half) - one generated surface per skill: a line per published\ncall plus a generated shape line per result type, a byte-capped signature digest,\nand an error boundary that appends the resolved signature, the nearest legal name,\nand the correction for a wrong keyword, a missing positional, awaiting a settled\nvalue, and a wrong attribute. A call that fails the same way twice gets one\nin-band repeat notice (second occurrence, then every fifth) and is never refused.\nThe `signatures` kernel request is additive: an older host never sends it and the\nruntime falls back to indexing the wrapped modules in the cell namespace.\n\nR6 (capability attenuation) - a subagent pushed unreviewed work to origin and ran\ndestructive repository commands (Sev 5, 01a08d13, 01a09632). `git`/`jj` skills now\nrefuse a publish or a force reset/restore from a child unless the parent authorized\nit, and the refusal names the correction (`allow_push=True` at spawn, or\n`RLM_ALLOW_PUSH=1`). Depth-0 sessions are unaffected.\n\nR7 S3/S7 (skills half) - `git`/`jj` take `cwd` for the repository directory and\n`paths=` for target files (`n` -> `limit` on the log/graph calls), the fact/action\nsplit is consistent (collections iterable, shapes generated, no hand-written\nsignature text), and `RemoteHandle.output` is a property.\n\nI1 - a non-unique `old_str` in the `edit` skill now changes nothing and reports the\nbounded line ranges of every occurrence with numbered candidate snippets, and\n`line_hint=` resolves it in one retry. Exact-match\nsafety is unchanged.\n\nI6 - a command that would bind a server to a public interface is refused with the\nloopback form to use instead (`RLM_ALLOW_PUBLIC_LISTEN=1` for a deliberate public\nbind), and a hardcoded dev port warns with the ephemeral-port correction. Read-only\npipelines and ssh stay permissive; the R5/R8 guards are untouched.\n\nI5 is closed as superseded by R7 S6.\n\nTests: prime-agent-runtime suite 425; git 15, jj 23, search 11, edit 13 python\ntests; new test_skill_surface.py (20) and test_subagent_workspace.py (16).\n","tree":"c04ef6f8835fdbe2d2f28adb7edf4394d9310907"}},{"name":"git","mode":"0040000","size":0,"lastCommit":{"hash":"7446965d9b14bff5fda33eb27259015d5b9c4dff","oid":"7446965d9b14bff5fda33eb27259015d5b9c4dff","parents":["ae6ee379908f52365f7731a4812233694fd800c5"],"author":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-15T18:44:47+03:00"},"committer":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-17T07:04:42+03:00"},"message":"feat(skills): settled skill results, so `await` on a finished call works (R7 S2)\n\nThe runtime settled the trailing cell value and the `rlm.*` handles, but a skill\ncall still returned a plain str/list/dict, so `await git.root()` raised \"object\nstr can't be used in 'await' expression\" - 156 of those in the audit corpus.\n\n- `rlm.skill` gains `settled_call`/`settle_module`/`_settle_result`; each skill\n module settles its published callables at import through a soft `rlm.skill`\n import, so a skill still works as a plain CLI without a kernel\n- `None` stays `None` deliberately: awaiting it still raises loudly rather than\n turning an absence into a value (the design's `Missing` type is not introduced)\n- the five local `Awaitable*` classes and thirteen `__await__` definitions are\n gone; result subclasses inherit `SettledList` (with a `list` fallback) and keep\n their own type and repr, so `type(await git.log()) is git.CommitList`\n\nI2 (the remaining half): `path=` is kept in the signatures only to fail loudly\nwith both corrections (\"cwd= is where git runs and paths=[...] are the target\npaths\") on git.log/graph/diff/changed/add/commit/checkout/reset/restore and the\njj equivalents. It used to mean the run directory, so aliasing it to `paths=`\nwould have silently filtered the wrong thing; `cwd=` raises a GitError\nthat names `cwd=` and points at `paths=[...]`.\n\nTests: prime-agent-runtime 430 OK (test_skill_surface 25); git 17, jj 25,\nsearch 24, nix 9, repo 3 (new module). Negative control: dropping git's settle\nline makes the await test fail with the original TypeError.\n","tree":"bd0da88a654eda6317808c7346d5d0eb7efba9bc"}},{"name":"goal","mode":"0040000","size":0,"lastCommit":{"hash":"6e1c74a85086204e714665a3a51adee0c23b8fc0","oid":"6e1c74a85086204e714665a3a51adee0c23b8fc0","parents":["a4bc34d8fbffde6e90b1966563980f19b679b835"],"author":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-17T09:21:12+03:00"},"committer":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-17T09:21:12+03:00"},"message":"fix(coding-agent): hide model-facing goal accounting metadata\n","tree":"decbd3d7b4987c2231a63ca5521699d66388d0c0"}},{"name":"jj","mode":"0040000","size":0,"lastCommit":{"hash":"7446965d9b14bff5fda33eb27259015d5b9c4dff","oid":"7446965d9b14bff5fda33eb27259015d5b9c4dff","parents":["ae6ee379908f52365f7731a4812233694fd800c5"],"author":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-15T18:44:47+03:00"},"committer":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-17T07:04:42+03:00"},"message":"feat(skills): settled skill results, so `await` on a finished call works (R7 S2)\n\nThe runtime settled the trailing cell value and the `rlm.*` handles, but a skill\ncall still returned a plain str/list/dict, so `await git.root()` raised \"object\nstr can't be used in 'await' expression\" - 156 of those in the audit corpus.\n\n- `rlm.skill` gains `settled_call`/`settle_module`/`_settle_result`; each skill\n module settles its published callables at import through a soft `rlm.skill`\n import, so a skill still works as a plain CLI without a kernel\n- `None` stays `None` deliberately: awaiting it still raises loudly rather than\n turning an absence into a value (the design's `Missing` type is not introduced)\n- the five local `Awaitable*` classes and thirteen `__await__` definitions are\n gone; result subclasses inherit `SettledList` (with a `list` fallback) and keep\n their own type and repr, so `type(await git.log()) is git.CommitList`\n\nI2 (the remaining half): `path=` is kept in the signatures only to fail loudly\nwith both corrections (\"cwd= is where git runs and paths=[...] are the target\npaths\") on git.log/graph/diff/changed/add/commit/checkout/reset/restore and the\njj equivalents. It used to mean the run directory, so aliasing it to `paths=`\nwould have silently filtered the wrong thing; `cwd=` raises a GitError\nthat names `cwd=` and points at `paths=[...]`.\n\nTests: prime-agent-runtime 430 OK (test_skill_surface 25); git 17, jj 25,\nsearch 24, nix 9, repo 3 (new module). Negative control: dropping git's settle\nline makes the await test fail with the original TypeError.\n","tree":"bd0da88a654eda6317808c7346d5d0eb7efba9bc"}},{"name":"mcp","mode":"0040000","size":0,"lastCommit":{"hash":"b6ac5d014d99401b55820835a4966584271e9a3c","oid":"b6ac5d014d99401b55820835a4966584271e9a3c","parents":["cf07c5a3f5eca98e7744f2df83050044c920252a"],"author":{"name":"kt","email":"kevin.jt2007@gmail.com","when":"2026-09-16T16:20:18-07:00"},"committer":{"name":"GitHub","email":"noreply@github.com","when":"2026-09-16T16:20:18-07:00"},"message":"mcp service catalog and oauth engine (#2330)\n\n* add a shared service catalog and generic mcp connections (#2256)\n\n* style(coding-agent): apply biome formatting to daemon-mode.ts\n\n* feat(coding-agent): add /plugins service catalog with verified MCP connections (ENG-6108)\n\n- Add /plugins and bare /mcp as the same searchable external-service picker with\n honest states (Connect, Connected with verified tool counts, Reconnect,\n Verifying, Requires setup, Disabled) and connect/disconnect actions\n- Add mcp.list_plugins, mcp.search_plugins, and mcp.list_connections host\n requests with strict status filters, bounded limits, and honest nextCursor\n- Add local connection records (connectionId distinct from catalog serviceId);\n verify every login with a real MCP handshake so token presence alone is\n pending, never Connected; rejected credentials recover via Reconnect\n- Serve connected catalog services (Linear, Notion) through the generic mcp\n runtime route: system-prompt inventory and mcp.config, no per-service wrappers\n- Drop the McpIntegration import from the kernel ready check ahead of the\n Linear/Notion wrapper-package removal\n- mcp.connect is registered only behind an explicit UI-approved callback and\n stays unregistered in daemon-hosted sessions (honest \"no handler\")\n\nTests: mcp-service-catalog, mcp-manager handlers, service-catalog-picker, and\nthe eng-6108 activation regression covering login -> verify -> session reload ->\nprompt inventory in the real services path without a restart.\n\n* fix(coding-agent): harden MCP verification, activation, and connection records (ENG-6108)\n\nReview follow-ups on the /plugins service catalog slice:\n\n- Verification now runs through the official @modelcontextprotocol/sdk\n client (negotiated protocol version header, CRLF SSE support, explicit\n session termination via HTTP DELETE) instead of a handwritten transport\n- Failures persist as fixed safe categories only; endpoint URLs,\n server-controlled text, and tokens never reach records or messages\n- Connection records use the auth.json file-lock read-modify-write pattern\n with unique temp files; concurrent UI/daemon writers no longer lose\n records, and pending operations queue while a flush is in flight\n- Every verification result is bound to the exact grant it verified\n (credential hash); stale probes after logout or token rotation are\n discarded, never marking a newer or removed account Connected\n- An OAuth connection without a usable token is never probed anonymously\n- A login made while streaming or compacting queues automatic activation\n at the next safe boundary (agent end / compaction end); the UI never\n instructs the user to run /reload for MCP changes\n- /plugins and config-menu connect paths share the queue; failure categories\n render as fixed user-readable wording\n- metadata-reviewed / legacyBuiltin rename absorbed from the catalog lane\n\nTests: probe (SDK fake server incl. CRLF/401/timeout/secret-leak), store\n(two-writer races, guard discard, mid-flight queueing), service catalog\n(stale verify after logout/rotation, non-connectable transports), manager,\nactivation queue (streaming/compaction/tool boundaries), regression suite.\n\n* fix(coding-agent): bind MCP credentials to endpoints, reconcile providers, honest connect (ENG-6108)\n\n- Endpoint binding everywhere a stored grant is consulted: catalog services and\n user-declared servers require cred.endpoint === current URL before any token\n fetch or probe (views, verify, dispatch inventory, demand-driven listing);\n unbound legacy grants surface as Reconnect with the fixed credential-unbound\n category and are recorded once on demand-driven verification\n- Provider ownership is one atomic reconciliation: legacy built-ins, eligible\n catalog services, and user-declared OAuth servers are re-registered first and\n only previously-owned ids unregister; the ModelRegistry reset hook calls the\n full reconciliation, so catalog providers survive refresh and a removed user\n override restores the catalog provider after a single manager.refresh()\n- Flush-time verification guards re-read fresh credential-source state\n (authStorage.reload() under the backend lock), so probes that finish after\n another client logged out or rotated the grant are discarded — no stale\n Connected record survives across clients\n- mcp.connect (explicit-approver seam) verifies the real handshake before\n reporting connected (tool count included) and reports fixed failure\n categories on rejected handshakes\n- /plugins stdio user servers get a real management action: Enter disables the\n server in global settings, refreshes providers, and reloads; already-disabled\n and vanished entries report honest status\n- Catalog views keep the Reconnect action on error rows and add unverified/\n unbound view tests; all oauth test fixtures now carry bound endpoints\n\nMinimal type-only addition in connection-probe.ts (lifecycle lane owns the file):\nMCP_PROBE_ERRORS.UNBOUND_CREDENTIAL.\n\nTests: manager 29, service-catalog 23, activation-queue 8 (incl. stdio\nmanagement), probe 7, store 6, picker 4, regression 2, slash-commands 18 —\n97/97; reviewer's mcp-service-safety suite verified 12/12 green against this\ntree (their file, their branch).\n\n* feat(ai): merged MCP service catalog with deterministic importer (ENG-6108)\n\n* feat(ai): metadata-reviewed catalog status, legacy builtins, local JSON sources, literal endpoint checks (ENG-6108)\n\n* fix(ai): harden local catalog loader and endpoint checks (ENG-6108)\n\n* feat(coding-agent): shared catalog resolver, local sources, per-account connections (ENG-6108)\n\n- resolveMcpServiceCatalog merges the built-in SERVICE_CATALOG with\n settings-declared local sources (Settings.mcpCatalogSources): ~-expanded\n before loadLocalServiceCatalog (which does no expansion), declared-but-missing\n files and cross-source duplicate ids surface as visible diagnostics, first\n source wins, total capped at 500 entries\n- The SAME resolution feeds the /plugins UI and the mcp host handlers; the UI\n re-reads connection records from disk before rendering (no stale cache) and\n shows resolver diagnostics on open\n- One-click Connect is metadata-reviewed-only (plus user-placed local files,\n which still go through the login dialog's explicit approval); unreviewed\n imported entries stay candidates with an honest setup hint\n- Per-account connections: \"Add another account\" allocates a distinct\n connectionId (mcp:-N) with its own credential key, record, and\n OAuth provider; the account picker lists accounts with per-account\n Reconnect/Disconnect; alias ids join integrations, dispatch inventory,\n mcp.config, and demand-driven verification through the same machinery; the\n record's serviceId keeps the parent catalog id\n- test/mcp-service-catalog.test.ts settles the theme's cli-highlight preload\n in beforeAll (deterministic fix for the pre-existing initTheme fire-and-forget\n teardown race, evidence in ENG-6108 notes); ServiceCatalogPickerComponent\n gains title/subtitle/hideSearch options for the account listing\n\nCatalog commits f8a4cf61a -> 50b79c3af -> be7445c3c integrated via authorized\nlocal cherry-picks; no catalog-source files modified.\n\nTests: manager 31 (alias integrations/provider lifecycle, demand-driven unbound\nrecord, reconciliation), service-catalog 29 (resolver, candidates, allocator),\nactivation-queue 9 (stdio management, add-account), probe 7, store 6, picker 4,\nregression 2, slash-commands 18 — 105/105; npm run check EXIT=0; 10/10\nconsecutive scoped runs with zero unhandled rejections, exit 0 each.\n\n* mcp: generic discovery surface, drop linear/notion wrappers (ENG-6108)\n\nAdd a bounded discovery surface to the kernel MCP module:\nlist_plugins, search_plugins, list_connections, search_tools and\ndescribe_tool, backed by host-owned catalog/connection handlers,\nwith cursor-safe tools/list pagination, explicit search scopes and\ndefensive secret scrubbing of inventory metadata only.\n\nReplace the bespoke Linear/Notion Python wrapper packages with one\ngeneric bundled mcp skill; remove the McpIntegration base class after\nauditing consumers, moving its shared helpers into rlm.mcp. Connecting\na service is a user action (/plugins or /mcp login), never an install\nor a per-service Python module.\n\n* mcp: fail-closed tool discovery, isolated schemas, redacted inventory errors (ENG-6108)\n\nFollow-up to 6514cbe6f per review:\n\n- discover() now publishes a tool map only when tools/list pagination\n completes; a repeated or malformed continuation cursor, or exceeding\n the page cap, raises McpDiscoveryError instead of a silent partial\n inventory. Malformed cursors are rejected rather than read as done.\n- list_tools/describe_tool return deep copies, so caller mutations can\n never reach the cached canonical schemas.\n- Per-connection search failures report a fixed exception type + hint\n (McpCredentialsUnavailable and friends) instead of raw exception text;\n host_request error text echoed by inventory calls is scrubbed of\n credential-bearing URLs, query strings and auth headers and bounded.\n\n* mcp: never chain raw host errors in inventory wrappers (ENG-6108)\n\nFollow-up to ff738187e per review. _host_inventory raises a fixed\n\"MCP request failed/timed out\" wrapper outside the\nexception handler, so arbitrary host/bridge error text (which can\nembed credential-bearing URLs, query strings, headers and HTTP\nbodies) is never echoed and cannot be reached through __cause__ or\n__context__ either; format_exception prints stay secret-free. The\nnow-unused redaction regex helper and bound constant are removed.\n\nRegression uses traceback.format_exception, not only str(exc), to\nassert the original exception is fully absent. Skill updated for the\nhost status vocabulary (pending, verified handshake) and PluginView\nfields (setupHint, unverified, verifiedAt/toolCount, connectionIds).\n\n* fix(coding-agent): bound MCP probe lifetime and connection-store races (ENG-6108)\n\nRoot review fixes on the lifecycle lane:\n\n- probeMcpEndpoint: the SDK passes its own controller's signal to every\n fetch (including the cleanup DELETE and its body cancel), and the SDK\n request timeouts only race the JSON-RPC promise, so an unresponsive\n DELETE could hang the probe forever. One lifecycle AbortController now\n bounds the probe: a fetch wrapper merges its signal into every\n transport fetch, terminateSession/close are each raced against a\n cleanup grace deadline whose expiry aborts the signal, an absolute\n deadline timer plus a final abort end lingering body reads, and every\n timer is cleared. Failure categories stay fixed and safe.\n- McpConnectionStore: the pre-lock exists-then-write-empty create could\n rename an empty file over records another process just wrote; the file\n is now created exclusively (wx, never truncating) before the canonical\n realpath lock, with mode 0600. A failed atomic write no longer drops\n queued mutations: the batch is unshifted back to the front of the\n queue and retried by the next flush (ops are idempotent; verify\n guards re-evaluate under the lock).\n- MCP_PROBE_ERRORS gains UNBOUND_CREDENTIAL (\"credential-unbound\") for\n grants not bound to the endpoint, consumed by the service catalog.\n\nOffline regressions: never-returning cleanup DELETE, hanging response\nbody, exclusive first-create race with mode 0600, injected atomic-write\nfailure with in-order retry and stale-guard discard, plus the existing\nsuites. All fetch stubs; no live credentials or provider calls.\n\n* test(coding-agent): multi-PID first-create regression for MCP connection store (ENG-6108)\n\nRoot review follow-up: in-process instances cannot reproduce the\nfirst-create exists/write race because their pre-await work is\nserialized on one event loop. The store test file now also spawns four\nreal first-writer processes (temporary .mts worker imported through the\nproject tsx loader, no production entry point), aligned by ready\nmarkers + a file barrier, racing the first create and the locked flush\non the shared store path. Asserts distinct PIDs, all children exit\ncleanly, every record survives, and the file keeps mode 0600; children\nare terminated in a finally on every path.\n\nTest-only: no production files touched.\n\n* test(coding-agent): Windows-portable multi-PID store regression (ENG-6108)\n\nTest-only portability follow-up: the generated first-create worker\nimported the store module by resolved absolute OS path, which is not a\nvalid ESM specifier on Windows; it now imports by file URL, and the\nexact 0600 mode assertions are POSIX-only (Windows mode bits do not\nmap meaningfully). No production changes.\n\n* test(coding-agent): add service-safety adversarial regressions for MCP credentials and providers (ENG-6108)\n\nAdversarial regression suite for the ENG-6108 service-catalog safety\ncontract, red on the 4bd8abc12 baseline and green on the wave-2 fixes:\n\n- Credential binding before probe/token access: a stored credential bound\n to a different endpoint, or unbound, is rejected before any probe call\n and before authStorage.getApiKey - for user-declared servers and\n catalog services, through direct verifyConnection and the demand-driven\n mcp.list_plugins background verification; never a connected record.\n- Cross-client stale probes: two AuthStorage instances share one\n auth.json; a probe finishing after a second client logs the grant out\n or replaces it mid-flight must not persist a connected record or\n verifiedAt for the current grant.\n- OAuth provider lifecycle: a full OAuth registry reset (through the\n real createAgentSessionServices + modelRegistry.refresh seam)\n preserves non-bundled catalog providers, and removing a user override\n restores the catalog provider after one refresh.\n\nOffline-only: injected probes, denied fetch, per-test temp credential\nand connection stores, no live endpoints or real credentials.\n\n* fix(coding-agent): durable account reservations, per-account views, honest actions (ENG-6108)\n\nFinal-review wave 4:\n\n- Account allocation is a durable reservation under the connection-store file\n lock: reserveConnectionId applies atomically on disk (exactly one winner in\n a cross-process race; the loser allocates the next id), pending markers are\n visible to every client, and removeReservation is ownership-validated (id +\n still-pending + same createdAt) so a late callback never removes or resurrects\n another client's account. Allocation consults store records, credentials,\n configured user servers, and catalog ids; configured names are never taken.\n- Views aggregate every account of a service: connectionIds lists all accounts,\n each account's status reflects its own bound credential, the service card\n survives on a remaining account after the default disconnects, and the\n inventory emits one row per account (no phantom primary row). Alias account\n ids are searchable (search_plugins alias contract). Connections whose local\n catalog source vanished keep a pinned descriptor at the recorded endpoint —\n credentials are never retargeted.\n- Explicit state actions: pending accounts retry verification without a\n relogin (the \"retry from /plugins\" path works), error accounts keep\n Reconnect (catalog and user rows), each account gets an explicit Remove\n row, and a verification result that could not be saved reports pending —\n never a false Connected.\n- resolveMcpServiceCatalog isolates local-source failures per source: one\n unreadable or invalid file becomes a bounded visible diagnostic while the\n built-in catalog and every other source keep resolving.\n\nTests: two-client simultaneous reservation race with barrier, ownership\nvalidation, full add-second -> reload -> inventory -> disconnect-default ->\nsecond-still-manageable regression, per-account view aggregation, vanished-\nsource pinning, per-source failure isolation, state-based action tests, and\nallocation that skips configured ids.\n\nOwnership: bootstrap.ts untouched (delegated lane).\n\n* fix(coding-agent): require MCP discovery methods in the kernel ready check (ENG-6108)\n\nThe runtime ready check only asserted mcp.list_tools/mcp.call_tool; the\nfive new discovery methods were validated once by the bootstrap import\nscan, so a cached kernel venv with an old prime-agent-runtime could\npass readiness. The check now requires callables for list_plugins,\nsearch_plugins, list_connections, search_tools and describe_tool, and\nfails with an actionable message so the venv is rebuilt instead of\nsilently reused.\n\nRUNTIME_READY_CHECK is exported so the new regression executes the\nexact shipped check against a real project runtime: it accepts the\ncurrent runtime, and rejects a runtime simulated as old by deleting\neach discovery method in-process (not a text-grep test). No provider\ncalls, credentials, or real daemon involved.\n\n* fix(coding-agent): guarded account credential commits and computed account status (ENG-6108)\n\nFinal-review wave 5:\n\n- Reservations resolve only after the durable record write COMMITS: the\n store defers reserve/remove/finalize callbacks past writeFileAtomicSync,\n resolves them false on write failure, and drops the one-shot ops instead\n of requeueing them — a failed write can never produce a ghost reservation\n a login could start on (injected-write-failure regression: no marker, no\n requeue surprise, retry works)\n- Ownership is an opaque random attempt nonce (not createdAt): cancel and\n the NEW successful-commit guard both validate it under the same store\n lock. Add-account logins stage the OAuth credential under\n mcp:-- and move it to the real account key only inside a\n guarded finalizeAttempt commit — a late login success after remove or\n replacement discards the staged credential and never touches the\n account (regressions: late-success-after-remove and same-id-new-owner,\n both assert the final credentials)\n- Per-account status is one computed helper (accountStateFor): credential\n binding, expiry, and the record combine through httpConnectionStatus, and\n the plugin aggregate, connection inventory, and account picker all use\n it — previously-connected records with unbound, retargeted, or\n expired-no-refresh credentials report Reconnect everywhere (6\n regressions across default and alias accounts)\n- Catalog metadata aliases ride the view DTO and are searchable again\n (regression: an alias absent from label/id/description matches)\n- Vanished-source pins are their own trust path (never localSource trust;\n never one-click connectable)\n\nTests: 147/147 across 10 files; npm run check EXIT=0; 10/10 consecutive\nscoped runs with zero unhandled rejections, exit 0 each.\n\n* fix(coding-agent): exactly-once account transactions and locked disconnects (ENG-6108)\n\nFinal-review wave 6 (transaction issues):\n\n- Every one-shot store callback (reserve/removeReservation/finalizeAttempt/\n removeAccount) settles EXACTLY once: deferred callbacks resolve with the\n commit outcome (not `didCommit && resolve(true)`), losing and throwing\n branches resolve false inline, one-shot ops are dropped on write failure,\n and trailing ops in a failed batch can never hang — batched-two-reserves\n write-failure regression included\n- Account removal runs credential deletion AND record removal under the SAME\n store lock (new store.removeAccount; disconnect, remove-action, and\n /mcp logout all use it): a concurrent finalize can never re-add an orphan\n credential after a disconnect — interleaving regression on real stores\n covers both orders (remove-then-finalize loses ownership; finalize-then-\n remove clears record AND credential)\n- finalizeAttempt compensates: if the RECORD write fails after the credential\n move, the compensate callback runs under the same lock and restores the\n staged credential (the real key was empty before the attempt), so a failed\n finalize is all-or-nothing; the flow then releases the reservation and\n reports honestly — UI regression asserts the real key untouched, staged\n restored+discarded, reservation released, and the honest message\n\nTests: 151/151 across 10 files; npm run check EXIT=0; 10/10 consecutive\nscoped runs with zero unhandled rejections, exit 0 each.\n\n* fix: honest MCP account recovery edges (ENG-6108)\n\n- removeAccount logs a credential-only integration out even when no\n connection record exists; outcomes are typed (removed, credential-only,\n missing, failed) and every UI route maps them honestly.\n- finalizeAttempt registers its rollback BEFORE any side effect: a\n throwing or partial commit is compensated under the same lock, and a\n FAILED rollback surfaces an explicit recovery-required state with the\n credential retained instead of a silent false.\n- the guarded commit refuses to clobber a credential an ordinary login\n wrote at the account key mid-flight, and the rollback only ever undoes\n its own write; a bystander credential survives byte-for-byte.\n- one-shot store operations settle cleanly when the file lock itself\n cannot be acquired; durable operations requeue (pre-splice).\n\n* fix: atomic MCP credential moves and honest partial logouts (ENG-6108)\n\n- staged logins move their credential to the account key with a new\n disk-authoritative compare-and-set under the auth backend's own file\n lock: moveStagedCredential (set-if-absent, returns the exact moved\n credential), restoreCredentialIfAbsent, and removeIfCredentialMatches\n (exact full-object own check, not access-token equality). A bystander\n credential written by another process can no longer be clobbered by a\n get/set race across AuthStorage instances.\n- the finalize compensation restores ours only into an empty staged slot\n and deletes only its own exact credential from the account key.\n- removeAccount now reports \"logged-out\" when the credential logout\n committed but the record save failed: the logout is preserved, the UI\n wording says so and never claims the account is still connected; plain\n \"failed\" wording is state-neutral.\n- two-real-storage-instance regressions: a bystander login written after\n staging survives byte-for-byte; a generic /logout in another client\n before/after the finalize races atomically (last-writer-wins under the\n backend lock, record shows an honest unbound state); an injected\n record-write failure after the logout reports the honest partial state.\n\n* fix: disk-verified MCP logouts and logout-cancelled login attempts (ENG-6108)\n\n- the three removeAccount authCleanup paths now use removeVerified\n (extended to return whether a credential was actually removed from\n disk): a failed auth-file write can no longer report Removed/\n Disconnected while the credential persists; the honest \"failed\"\n wording is state-neutral.\n- a real generic /logout of an MCP account now cancels that account's\n pending login attempts: runLogout calls the new\n ProviderAuthFlowsHost.onMcpCredentialRemoved hook, and the host\n invalidates the pending reservation under the connection store's lock\n (new invalidatePendingAttempts), so a stale in-flight OAuth attempt\n resolves denied and can never re-activate the logged-out account.\n Non-MCP logouts are unchanged.\n- regressions: auth-file write failure with a fresh disk reader (the\n credential survives, nothing claims success), a route-exact\n cross-client pending-finalize vs real /logout test driven through the\n selector, store-level invalidation semantics, and stale\n interactive-mode-status fixtures repaired to the current seams.\n\n* fix: one shared store-locked MCP logout op for the generic /logout route (ENG-6108)\n\n- the route delegates the ENTIRE MCP logout before touching auth: the new\n exported logoutMcpAccount(providerId, store, authStorage) performs\n verified credential deletion (removeVerified) AND pending-attempt\n cancellation in one store-locked removeAccount with the new\n preserveCompletedRecord semantics (pending attempts cancelled,\n completed records kept for the honest unbound/Reconnect state).\n- removeAccount now runs the verified cleanup BEFORE mutating the\n working records map: a failed auth-file write resolves \"failed\" with\n the record intact in memory AND on disk (no half-applied deletion),\n and a partially-saved logout still reports the honest \"logged-out\"\n state.\n- the id resolution is exported as resolveMcpAccountLogoutTarget:\n exact ids win (service ids may contain \"--\"), and staged keys map\n back only through their actually recorded attempt nonce.\n- regressions: a barrier test fires the REAL generic route inside the\n finalize's locked commit (verified deterministically red against the\n old logout-first ordering); store-level half-applied-deletion and\n preserve-semantics tests; route delegation/wording tests; handler\n tests for double-hyphen ids, staged-key mapping, and preservation.\n\n* fix: fail-closed refusal for stale staged-key MCP logouts (ENG-6108)\n\n- a staged-key logout that races a completing finalize now refuses\n fail-closed instead of orphaning the moved credential: the shared\n handler resolves the account from CURRENT records and CURRENT on-disk\n auth state under the store lock (never a pre-lock cache snapshot), and\n when the staged credential already moved onto the account key it\n returns \"refused\" — the record and the newer credential both survive,\n and the route reports the completed login explicitly instead of\n claiming Logged out.\n- new removeAccountForProvider store op (one critical section: resolve\n under lock -> disk-verified refusal checks -> verified cleanup ->\n cancel pending / preserve completed); resolveMcpAccountLogoutTarget\n now returns a stale variant for nonce-matched non-pending records.\n- new disk-authoritative AuthStorage.hasVerified existence check used\n for the current-state refusal decisions.\n- regressions: the staged-key race queued behind a finalize-first move\n (refused, record + credential survive), resolver stale semantics, and\n the route-level refused wording.\n\n* fix: staged-key MCP logouts cancel the attempt and preserve the account shell (ENG-6108)\n\n- removeAccountForProvider no longer gates record deletion on an auth\n existence snapshot (not atomic with another client's ordinary login):\n a staged-key logout removes only the staged credential, INVALIDATES the\n attempt nonce on the pending record (so the in-flight login's denied\n path can neither finalize nor removeReservation-delete it), and\n PRESERVES the account record — deletion stays the explicit Remove\n action's job; a bystander credential on the real key can never be\n orphaned.\n- the \"refused\" outcome is now state-neutral (\"This login attempt is no\n longer current; manage the account from /plugins\") — no Logged out or\n Connected claim from token presence; failed verified auth deletion\n still changes no record.\n- the interim AuthStorage.hasVerified helper is removed (no auth-state\n snapshot decisions remain); regressions pin the both-exist contract\n (staged removed, bystander byte-for-byte, record + nonce-invalidated\n shell preserved, old-nonce finalize denied, removeReservation no-op)\n and the finalize-first race with the same invariants.\n\n* feat: one guarded connect operation for every MCP OAuth login route (ENG-6108)\n\n- new one-shot store ops claimConnectionId/releaseClaim: a guarded login\n claims an EXISTING account record (any status) under the store lock and\n cancel releases it — the record, its status, and any credential survive\n untouched; finalizeAttempt ownership is now the EXPLICIT nonce on any\n record status.\n- every user-facing MCP OAuth login (initial connect, error-state\n reconnect, add account, /mcp login, generic /login service options,\n config menu) routes through the guarded flow: claim/reserve, staged\n OAuth, guarded finalize. The raw dialog remains internal.\n- the finalize commit is a full-identity compare-and-swap on the auth\n backend lock: set-if-absent for fresh accounts, replace-only-if-matching\n for intentional replacements (reconnects and credential-only legacy\n grants); it consumes the nonce and marks the record pending-verification\n so an old Connected status never carries onto a replaced grant; the\n compensate RESTORES the previous credential (never delete-only, never\n clobbering a newer writer).\n- every preserving logout clears the ACTIVE claim nonce regardless of\n record status, so a logout cancels an in-flight reconnect too; a nonce\n match in the resolver is always a LIVE attempt (finalizes consume\n nonces, so the stale variant is gone).\n- new AuthStorage primitives: getVerified (disk-authoritative identity\n capture) and replaceStagedCredential / replaceCredentialIfMatches\n (full-identity CAS move and restore).\n- regressions: error-state reconnect (CAS, pending-verification, nonce\n consumed, old verification state cleared), cancelled reconnect\n preservation, late-reconnect-after-logout discard, claim/release one-shot\n settlement on failed batch writes, rollback-restores-previous via CAS,\n and the generic /login + config-menu delegation to the guarded hook.\n\n* fix: preserve MCP login intent and cancelled account settings (ENG-6108)\n\n* test: cover MCP account lifecycle commit safety (ENG-6108)\n\n* fix: merge-main regressions and secret-free grant binding (ENG-6108)\n\n* fix: fail closed on unproven MCP catalog entries and expired grants (ENG-6108)\n\n* fix: keep built-ins in the catalog cap and harden grant-type regressions (ENG-6108)\n\n* fix: match MCP connectors to the inline configuration pickers (ENG-6108)\n\n* fix: make MCP picker actions match settings-backed targets (ENG-6108)\n\n* feat(ai): complete the generic MCP OAuth engine (ENG-6108)\n\nThe MCP OAuth engine only handled public-client dynamic registration and\nexact endpoint/protected-resource matches: it discarded all registration\nresponse fields beyond client_id, requested every AS-advertised scope,\nissued unbounded uncancellable requests, and rejected the official\nNotion/Slack metadata shape (pathful endpoint, origin-level PRM resource)\nat discovery, so those servers could not log in or refresh at all.\n\nThe engine now follows the SDK 1.30 auth standards via pure helper/schema\nimports from @modelcontextprotocol/sdk (never the auth() orchestrator,\nwhose redirect model does not fit the staged consent UI):\n\n- Client auth-method negotiation (client_secret_basic > post > none,\n DCR hint honored, RFC 8414 defaults) applied to exchange and refresh,\n with a compatibility gate: a secret-only server never receives a doomed\n no-auth request; it fails early with typed setup guidance.\n- Full RFC 7591 registration responses: persisted DCR client identity,\n issued secret and expiry (respected on refresh), and registration-mode\n binding. Config-supplied secrets are never persisted or embedded.\n- CIMD/SEP-991: a configured Prime-controlled client-metadata URL becomes\n the client id when the server advertises\n client_id_metadata_document_supported; no URL is invented or deployed.\n- SEP-835 scope precedence: configured > protected-resource > omitted;\n authorization-server-wide scope lists are never blindly joined.\n- Narrow audience policy: the PRM resource must equal the canonical\n endpoint or its exact HTTPS origin (URL-component compared); refresh\n pins both values and the audience mode, fail-closed on any change, and\n legacy exact grants never refresh against origin audiences.\n- Every request is bounded (10/15s deadlines, 256KiB bodies) and login\n honors the host abort signal, including callback-server cleanup.\n- Token errors are typed and sanitized: whitelisted RFC error codes only,\n fixed guidance, never raw server-controlled descriptions.\n\nAll flows run against offline fake OAuth/MCP servers in\npackages/ai/test/mcp-oauth.test.ts (39 tests: official Notion/Linear\nfixtures, Slack post-only negotiation, CIMD, refresh binding and\nrotation, abort/cancellation); no live endpoints or credentials.\n\n* feat(ai): read-only catalog metadata audit with readiness evidence (ENG-6108)\n\nAdd a reproducible read-only public metadata audit of all 103 remote catalog endpoints (public unauthenticated GETs only, bounded, DNS-pinned per request through an undici dispatcher lookup) and merge the committed evidence into the catalog offline. New additive, optional interface: setup.readiness (informational, never a Connect gate), setup.requirement, setup.fields[].kind, auth.alternatives[] per-path alternatives, and the observational auth.metadata evidence block. Placeholder-only OAuth blockers are cleared with evidence (Airtable, Shopify stay Connect-attemptable); genuine documented requirements stay hard (API keys, bearer tokens, tenant config, registered clients, transport and local-runtime limits). CIMD alone is never oauth-ready, audience-mismatched PRM documents stay unknown with notes until the approved engine audience policy lands, and local sources cannot self-assert readiness, alternatives or evidence.\n\n* docs(ai): correct stale oauth-marker consumer comment (ENG-6108)\n\nThe host keys OAuth support off authStrategy, not entry.oauth?.kind; the comment now points consumers at auth.strategy. Comment-only change.\n\n* fix(coding-agent): guard mcp account ownership and capability policy (ENG-6108)\n\n* fix(ai): adopt engine component comparison for readiness re-derivation (ENG-6108)\n\nThe importer audience rule now uses the engine component comparison: a protected-resource document must match the exact canonical endpoint or the exact origin (root-slash normalized). notion plus the 9 DCR-capable origin-mismatched entries (airtable, amplitude, appwrite, lovable, miro, rootly, vercel, windsor-ai, zoominfo) re-derive to oauth-ready and their stale not-yet-landed notes are gone; logrocket stays unknown (its resource drops the ?toolsets=all query, failing closed under the component rule); slack and hubspot stay unflipped (no dynamic client registration). Counts re-derive to 72 oauth-ready / 53 user-setup / 5 prime-restricted / 10 unknown. Catalog oauth validation now rejects client secrets explicitly instead of silently dropping them, symmetric with the client-id rejection.\n\n* feat(coding-agent): wire oauth client identity through shared mcp provider factory (ENG-6108)\n\n* fix(ai): mirror engine PRM selection in the metadata audit (ENG-6108)\n\nBugbot PRRT_kwDOSXZbXs6hvVZP + PRRT_kwDOSXZbXs6hvVZS: auditEndpoint now mirrors oauth.ts exactly - a WWW-Authenticate resource_metadata pointer is followed alone and any failure fails closed with no well-known fall-through; absent a pointer the pathful well-known is tried then the origin-level root location (SDK parity, 4xx continues); a candidate is selectable only when its document passes the engine audience component comparison and carries authorization servers. protectedResourceUrl is used at the call site instead of an inline construction. The bounded read-only audit was re-run (public GETs only, DNS-pinned, all bounds unchanged) and readiness re-derived: the reviewer obligation flips stay intact; codspeed and resend flip to oauth-ready via the SDK-parity origin-level fallback (valid documents, DCR, coherent AS); confidence-docs/-flags stay unknown with fail-closed notes (served-but-invalid documents); logrocket stays unknown with the precise fail-closed reason; slack/hubspot stay unflipped (DCR-less); shopify metadata is now available but DCR-less. Counts: 72 oauth-ready / 53 user-setup / 5 prime-restricted / 10 unknown; metadata 97 available / 6 unavailable.\n\n* fix(ai): require the exact engine fallback condition for oauth-ready (ENG-6108)\n\nBugbot PRRT_kwDOSXZbXs6hva2k: evidenceSupportsStandardOauth granted oauth-ready via origin-AS evidence for ANY no-served-JSON state, but the engine reaches its origin-level AS fallback ONLY when no resource_metadata pointer was followed and every tried well-known candidate returned exactly a 4xx (5xx, fetch errors, 2xx/3xx non-JSON bodies and served-but-invalid documents all throw with no fallback). A precise engineFallsBackToOriginAs predicate is now derived from the recorded attempts (followed or rejected pointer, served document, and per-attempt httpStatus), so fail-closed discovery stays honestly unknown. The audit script selectionNote now fires only for true fail-closed states; the all-4xx state is the engine honest fallback and records no note. The bounded read-only audit was re-run to match the corrected note semantics (aggregates stable: 103 audited, AS 97/6, DCR 78, CIMD 25, PKCE 97). Zero readiness flips - pure hardening; 7 all-4xx entries lose stale generic notes; new regression assertions pin intercom (oauth-ready via the legitimate origin-AS fallback, no note) and adobe-for-creativity (unknown, unavailable AS, no note). Counts unchanged: 72 oauth-ready / 53 user-setup / 5 prime-restricted / 10 unknown.\n\n* fix(ai): classify figma as registered-client after live DCR 403 evidence (ENG-6108)\n\nDogfooding PR #2256 head 8e77f0cc1 surfaced what the read-only audit could\nnot observe: Figma's advertised dynamic-client-registration endpoint returned\nHTTP 403 to the engine's anonymous registration POST during a real\n/mcp login figma attempt (2026-09-13), while its AS metadata still advertises\nthe endpoint with confidential-only client auth. A public metadata-only GET\nof the register endpoint returns 404, and public reports corroborate the 403\nfor anonymous DCR requests; whether self-registered Figma apps can obtain\nmcp:connect is publicly unresolved.\n\n- Audit store: the live attempt is recorded as an authorizationServer\n registrationAttempt block with explicit provenance (the audit script never\n POSTs registration endpoints); the script now preserves these blocks\n verbatim on re-runs, and the $comment sanctions exactly this supplement.\n- Importer: an advertised registration endpoint whose live anonymous\n registration was rejected (401/403) is gated evidence —\n auth.metadata.dynamicClientRegistration flips to an explicit false (gated,\n distinguishable from omitted \"not advertised\"), the gated finding becomes\n the default metadata note, and the entry can never be oauth-ready\n (fail-closed, the same honest class as DCR-less Slack/HubSpot).\n- overrides.json: figma mirrors the Slack precedent — pre-registered client,\n registered-client requirement, prime-restricted readiness, requires-setup\n with the 403-documented reason and FIGMA_MCP_CLIENT_ID / FIGMA_MCP_CLIENT_SECRET\n setup fields.\n- Regenerated catalog.json + catalog.data.generated.ts via the importer;\n counts: ready 82 -> 81, requires-setup 58 -> 59, oauth-ready 72 -> 71,\n prime-restricted 5 -> 6 (user-setup 53, unknown 10 unchanged; sum 140).\n\nOffline verification: catalog suite 25/25, coding-agent catalog eligibility\n12/12, tsgo --noEmit clean, and both catalog scripts typechecked under the\nrepo base config.\n\n* drop the revert changelog fragments\n\nthe reland makes the \"removed\" entries moot before any release cut them;\nthe release notes should only describe the additions.\n\n* feat(ai): cut the service catalog to zero-app self-serve only (ENG-6108)\n\n2026-09-14 product decision: Prime maintains ZERO provider OAuth apps, so\nthe catalog advertises only what works self-serve — dynamic client\nregistration (readiness \"oauth-ready\") or user-supplied tokens/keys\n(\"user-setup\"). Every entry classified prime-restricted (needs a\nprovider-registered client) or unknown (no verified self-serve path) is cut\nfrom the shipped catalog; audit/engine parity, the readiness vocabulary and\nthe fail-closed classification machinery are unchanged.\n\n- overrides.json: the 16 cut providers (figma, gmail, google-calendar,\n google-drive, mongodb-atlas, slack, adobe-for-creativity,\n confidence-docs, confidence-flags, hubspot, logrocket, mapbox-docs,\n shopify, sumup, synthflow, synthflow-docs) are excluded via the documented\n excludedServers list — one entry per upstream record (18 keys: figma and\n slack are merged from both upstreams, so both sides are cut and no ghost\n entry can re-enter), each with a per-entry reason citing the decision and\n the specific audit evidence. The now-dead servers overrides for excluded\n identities were removed; their honesty content lives on in the exclusion\n reasons.\n- Importer: the cut is enforced structurally — buildCatalog refuses to emit\n an entry whose readiness classifies prime-restricted or unknown and fails\n with a curation prompt (exclude with a documented reason, or curate\n readiness with evidence), so an unverified provider can never ship\n silently again. The gated-DCR honesty machinery (advertisedRegistrationGated,\n explicit-false dynamicClientRegistration semantics) is kept and now\n exported for direct unit tests, since the live case (figma) is excluded\n rather than classified; the predicate still guards future entries.\n- Audit store: untouched — the pinned source snapshots and metadata-audit\n results for the excluded endpoints stay committed as evidence (including\n figma's live 403 registrationAttempt). The audit script now also retires,\n never drops, registration-attempt evidence for servers that leave the\n audit target set via the new top-level retiredRegistrationAttempts array,\n so a re-run can never silently delete the figma evidence.\n- Regenerated catalog.json + catalog.data.generated.ts via the importer;\n counts: total 140 -> 124 (http 102 -> 86; stdio 32, templated 5, sse 1\n unchanged), ready 81 -> 71, requires-setup 59 -> 53, oauth-ready 71,\n user-setup 53, prime-restricted 6 -> 0, unknown 10 -> 0 (sum exact).\n- Tests: mcp-catalog.test.ts now asserts the cut (all 16 ids absent, both\n upstream sides of merged providers excluded, all 18 keys documented in the\n import report with zero-app reasons, source snapshots and audit evidence\n kept incl. figma's 403 attempt), pins the gated-DCR machinery directly\n with synthetic evidence, updates the count assertions (124/71/53/0/0) and\n keeps the byte-for-byte regeneration pin; the figma assertions now assert\n exclusion instead of prime-restricted-in-catalog.\n\nOffline verification: catalog suite 27/27, coding-agent catalog eligibility\n12/12 (plus all 13 coding-agent mcp test files: 281 passed, 1 skipped),\ntsgo --noEmit clean at the repo root, both catalog scripts typechecked\nclean under the repo base config, biome clean on the changed files.\n\n* test(coding-agent): adapt activation-queue route host to the inline auth panel host surface\n\n* test(coding-agent): drive logout route assertions through the inline auth panel surface\n\n* fix(ai): demote confidential-only AS providers to the user-setup OAuth path (ENG-6108)\n\nLive gap found in dogfooding: Hugging Face /mcp login failed at connect with\n\"no compatible client authentication method (advertised: client_secret_basic,\nclient_secret_post)\" because the catalog classified the entry oauth-ready\nwithout ever checking token_endpoint_auth_methods_supported; the engine checks\nit at runtime and fails closed.\n\n- Extract the engine's fail-closed client-auth decision from\n negotiateAuthMethod into the exported decideClientAuthMethod and add the\n catalog predicates tokenAuthMethodsSupportPublicClient /\n tokenAuthMethodsSupportConfiguredClient in packages/ai/src/mcp/oauth.ts —\n the importer runs the SAME decision, so classification and the connect-time\n gate share one source of truth.\n- Wire the gate into importer readiness: coherent DCR evidence with\n confidential-only advertised methods now demotes honestly to the user-setup\n OAuth path (requires your own OAuth app reason, registered-client\n requirement, client-id/client-secret setup fields) instead of oauth-ready —\n the user's own registered app, zero-app compliant, never an exclusion.\n Advertised methods that serve not even a configured secret-bearing client\n (mTLS-only) keep failing closed as today; omitted lists stay oauth-ready\n per the engine's public-client spec default.\n- Regenerate catalog.json, catalog.data.generated.ts and import-report.json:\n 14 entries demote (airwallex, airwallex-sandbox, atlan, gitlab,\n hugging-face, legalzoom, lusha, miro, monday-com, planetscale, supabase,\n vercel, windsor-ai, zoominfo) — readiness counts move 71->57 oauth-ready and\n 53->67 user-setup; total 124 and zero prime-restricted/unknown invariants\n hold, each entry carrying its confidential-only evidence and note.\n- Document tokenAuthMethods as required engine-compatibility capture in the\n audit script and catalog README so future audits keep the check.\n- Tests: pin the hugging-face demotion with its confidential-only evidence and\n the full demoted set, add the synthetic classification matrix\n (confidential-only demotes, none/omitted stay one-click, mTLS-only stays\n unknown) and direct predicate tests; update readiness count pins. The\n byte-for-byte regeneration pin and the coding-agent eligibility thresholds\n pass unchanged.\n\n* test(coding-agent): pin the MCP auth routes to the inline auth panel surface\n\nthe guarded-credential race test kept an unobserved showOverlay stub on the\nfake route TUI; it now asserts the generic /logout service selector never\nmounts an overlay popup, so MCP auth can only render through showAuthPanel\nlike #2331 provider logins. adds the changelog fragment documenting that\nevery MCP auth surface (guarded staged OAuth dialog, /login and /logout\nservice selectors, mcp-connections tab, /mcp login) mounts inline under\nthe chat with stacked closers, focus restore, and rows-aware sizing.\n\n* feat(ai): cut the catalog to one-click DCR or user token/key only (ENG-6108)\n\n2026-09-15 product decision (\"remove everything that's not one-click auth\nor api key\"): the shipped catalog advertises only one-click dynamic client\nregistration (readiness \"oauth-ready\") and user token/key entries; the\nclassification machinery and audit/engine parity are unchanged.\n\n- overrides.json: the 49 non-token/key entries — the 14 registered-client\n entries whose authorization servers accept only secret-bearing client auth\n (airwallex, airwallex-sandbox, atlan, gitlab, huggingface-skills,\n legalzoom, lusha, miro, monday-com, planetscale, supabase, vercel,\n windsor-ai, zoominfo), the 32 local-runtime stdio adapters and the 3\n url-only tenant templates (activecampaign, jfrog, pigment) — are excluded\n via the documented excludedServers list: one entry per upstream record\n (64 keys: monday-com/supabase/vercel are merged from both upstreams, so\n both sides are cut; every stdio server of the multi-server adapter plugins\n is excluded), each with a per-entry reason citing the decision and the\n specific evidence. The now-dead servers overrides for excluded identities\n were removed; their honesty content lives on in the exclusion reasons.\n- Importer: the cut is enforced structurally — buildCatalog refuses to emit\n a user-setup entry whose requirement is not token/key-shaped\n (bearer-token/api-key credentials, a tenant config with a genuine non-url\n field, or a legacy-transport entry that still collects a token/key) and\n fails with a curation prompt, so a registered-client demotion, a\n local-runtime adapter or a url-only template can never silently re-derive.\n The auth-methods honesty machinery (decideClientAuthMethod parity,\n confidential-only demotion, tokenAuthMethods capture) is unchanged and\n stays active for the survivors.\n- Audit store and source snapshots: untouched — evidence for the excluded\n endpoints stays committed as history.\n- Regenerated catalog.json + catalog.data.generated.ts + import-report.json\n via the importer; counts: total 124 -> 75 (http 86 -> 72, templated 5 -> 2,\n sse 1 unchanged, stdio 32 -> 0), ready 57 unchanged, requires-setup 67 ->\n 18, oauth-ready 57, user-setup 18, prime-restricted 0, unknown 0 (sum\n exact); api-key strategy 32 -> 16.\n- Tests: mcp-catalog.test.ts pins the cut (all 49 ids absent, both upstream\n sides of merged providers excluded, all 64 keys documented in the import\n report with 2026-09-15 reasons, source snapshots and audit evidence kept,\n the shipped user-setup set is exactly the 18 token/key entries), keeps the\n confidential-only machinery matrix (now pinned on the committed\n huggingface-skills audit evidence plus the synthetic matrix), adds the\n structural invariant regression (lifting the gitlab exclusion fails the\n import with the curation prompt), updates the count assertions (75/57/18/\n 0/0) and keeps the byte-for-byte regeneration pin; coding-agent\n mcp-service-catalog count comment + eligibility sweep thresholds updated\n for the 75-entry catalog (api_key >= 10 still holds at 16; unknown 53).\n\nOffline verification: ai catalog suite 29/29, ai mcp-oauth 40/40, all 13\ncoding-agent mcp test files 276 passed 1 skipped (catalog eligibility 12/12,\nservice catalog 63/63), tsgo --noEmit clean at the repo root, biome clean on\nthe changed files.\n\n* fix(tui): separate the oauth url from the browser-step text with a blank line\n\n* fix(tui): keep the service-catalog picker at one description line with stable frames\n\n* feat(tui): persist MCP connect outcomes as refinement-style chat entries (ENG-6108)\n\nConnect outcomes (\"Connected Linear (12 tools verified)\" and its\nsaved-but-unverified variants) were transient status lines that vanished;\nthey now persist in the chat transcript like harness refinement notices.\n\n- Add the mcp_connection_outcome custom message with structured details\n (label, login/retry source, connected/unverified/unsaved verification\n state, tool count, account id, activation) and the exact legacy wording\n as its content; keep it out of LLM context like refinement outcomes.\n- Render it with a purple refinementHeader \"◆ Connected · N\n tools verified\" header over a refinementSummary body via the\n ExpandableEventMessage base; register live rendering and transcript\n replay (malformed entries included) and gate both on display.\n- Route both emit sites (pending-account retry verification and the\n guarded login completion) and their failure/partial variants through\n completeMcpConnectionOutcome: reload, then append the durable entry via\n the new AgentConnection.appendCustomMessage (in-process sendCustomMessage,\n daemon legacy append_custom_message RPC). Mid-turn connects keep the\n transient \"will activate automatically\" line and record the durable\n entry at the next safe boundary; a failed reload marks the entry\n \"not active in this session\". Pre-outcome login failures (eligibility,\n claim, finalize, incomplete login) remain transient warnings.\n- Focused tests: component rendering/replay, formatter wording parity,\n and both emit sites including queued-boundary, inactive, and\n append-failure fallback paths.\n\n* fix(tui): flatten multi-line catalog copy before it becomes a picker line\n\n* fix(tui): repair /mcp picker chrome nits and search ranking (ENG-6108)\n\nFive chrome nits from Kevin's live testing plus the picker search:\n\n- The scroll counter aligns with the row indent (rows render their label\n at column 2; the counter and the empty-state message now do too).\n- Enter on an accounts-picker row 1 (the account name) re-verifies the\n account instead of disconnecting it; only the explicit Remove row\n removes. connectServiceFromPicker's connected branch now re-verifies\n exactly like the pending branch.\n- One blank line between the last row and the description line in both\n catalog and accounts mode, budgeted in updateLayout so frames stay\n height-stable.\n- Accounts search matches identity only (account label + connection\n id): every account row shares the same description/setup hint, so\n matching that text could never filter anything.\n- Every inline MenuPanel opens with exactly one separator rule between\n the chat view and the picker: a titled panel draws the rule above its\n title; a headerless panel keeps the bordered search's top border as\n that rule, never both. Model/provider/oauth/extension/prime-team\n pickers budget the rule through the shared inlineMenuPanelTopRuleRows\n helper.\n- Search ranking rewritten: exact/prefix/word-start/substring matches on\n label, service id, and aliases rank far above description/setup-hint\n text; the identity-only subsequence fallback requires a consecutive\n run of half the query (minimum two); descriptions match only as\n word-start/substring. Searching vercel against a catalog without\n Vercel now yields the No-matching-services empty state instead of\n eight unrelated rows matched through setup-hint boilerplate.\n\n* fix(mcp): cut non-token catalog survivors and say what to paste\n\n2026-09-16 product decision, from live picker testing: the catalog ships\none-click DCR connectors and simple paste-an-API-key/token services only.\n\nCut 5 survivors with documented per-entry reasons in overrides.json:\n- cockroachdb (cockroach-labs): tenant config, only input is the\n per-cluster `mcp-cluster-id` header, no key/token field\n- dynatrace, sourcegraph: tenant instance URL next to the token\n- paypal-sandbox: legacy SSE, the runtime cannot connect to it at all\n- render: api-key requirement with zero setup fields, nothing to paste\n\nThe importer now enforces the narrower rule structurally: a user-setup\nentry ships only when its requirement is bearer-token or api-key AND it\ncollects at least one bearer-token/api-key field. An entry the readiness\npass never classified also fails closed instead of slipping past every\nshipping guard.\n\nAll 13 surviving setup reasons are now picker copy for a human: one line,\nstarting with \"paste\", naming the entry's real field. \"requires provider\ncredentials supplied as headers\" and \"requires an auth token supplied via\nenvironment variable\" are gone; github no longer stutters the same clause\ntwice; zoom-meetings drops the upstream placeholder note that never\nchanged what the user does. A test pins the shape.\n\nCatalog: 75 -> 70 entries (57 oauth-ready, 13 user-setup), all plain\nstreamable-http. Evidence, source snapshots and audit store unchanged.\n\nENG-6108\n\n* fix(tui): drop the restated MCP connect body and add disconnect feedback\n\nKevin saw the durable connect entry print the same sentence twice: the\nheader and the body both said \"Connected Granola (6 tools verified)\".\nThe header is the outcome line, so the body now carries ONLY what the\nheader omits - added account, verification issue plus next step, deferred\nactivation - and a plain success renders as the header alone. The\npersisted `content` keeps the full legacy sentence, because the transient\nfallback and status lines still need a whole sentence.\n\nDisconnects had no durable feedback at all. A successful disconnect from\n/plugins, `/mcp logout `, or the generic `/logout` route now leaves\nthe same kind of entry, in the muted theme key: not the connect purple (a\ndisconnect is no refinement) and not the error red (it succeeded) - the\ngrey /plugins already uses for \"Not connected\". Only outcomes that really\nremoved the credential (removed, credential-only, preserved) get an\nentry; \"logged-out\" (partial save failure), \"failed\", \"missing\", and the\nstate-neutral \"refused\" keep their honest warnings and record nothing, so\nno entry can claim a disconnect that did not finish.\n\nThe generic /logout route still runs ONE store op and ONE reload: the\nhost records the outcome under its existing delegation and the selector\nappends it after the reload it already did.\n\nENG-6108\n\n* fix(tui): record the picker disconnect entry on the remove row\n\n* fix(tui): rebuild the /mcp accounts menu as a choice list (ENG-6108)\n\nKevin's live-testing redesign: the accounts menu drops its no-op search box\nand account-name row, renders ' MCP' with the muted description\n(wrapped, capped at three lines) above the options, and lists Reconnect /\nDisconnect / Add another account in the PR #2340 selection language\n(mirrored locally until #2340 lands). Reconnect keeps the existing re-verify\npath and never disconnects; Disconnect keeps the store-locked removal and\nits durable disconnected entry.\n\nCatalog picker nits: the Connect trailing status reads in the text colour\ninstead of the accent purple, and the empty state gains one blank row above\nthe shortcuts line, aligned with the row labels (pinned at width 120).\n\n* fix(tui): stop inline pickers doubling the separator rule\n\n* feat(mcp): connect paste-a-key catalog services through an inline masked paste panel (ENG-6108)\n\n* fix(mcp): collapse the paste flow to ONE credential per service, cut named-header pairs (ENG-6108)\n\nTwo Bugbot findings, one root cause: the generic MCP runtime sends exactly\none Authorization: Bearer per connection, but the paste flow treated every\nrequired credential field as a separate mandatory prompt, and GitHub's two\nsetup fields (GITHUB_PAT_TOKEN / GITHUB_PERSONAL_ACCESS_TOKEN) were presented\nas two required tokens when they are alternative names for one PAT.\n\n- Curate GitHub's fields as alternatives via a shared field-level\n credentialSet (\"github-pat\") in mcp-catalog/overrides.json; the paste flow\n now prompts ONCE, labels honestly (\"GitHub personal access token\") and\n stores the value under the first alternative's id.\n- Cut datadog and cloudinary-mediaflows from the catalog (documented\n excludedServers reasons citing the named-header evidence: DD_API_KEY +\n DD_APPLICATION_KEY, cld-api-key + cld-secret - one bearer can never\n authenticate them). Catalog: 68 entries = 57 one-click DCR + 11 paste.\n- The importer now throws when a shipped requires-setup entry collects more\n than one distinct required credential, so an unmarked multi-credential\n entry can never silently re-derive; tests pin the guard by lifting the\n datadog and cloudinary exclusions.\n- Simplify the host flow to one prompt/one value (no multi-field loop, no\n per-field checkmark rows); masking, Esc-cancels-nothing-stored, the\n empty-value guard, verification and the durable Connected outcome are\n kept; services with genuinely distinct credentials stay honest\n setup_required and are not pasteable.\n\n* fix(mcp): drop the dead paste-credential branch and trim the importer comment\n\n* fix(tui): render paste outcomes honestly and polish the accounts menu\n\n* fix(tui): budget the accounts frame for the trailing blank row\n\n* fix(tui): keep the /mcp picker chain open after connect, disconnect, and paste actions\n\nSelecting a row no longer drops the user back to the prompt after the action: the picker chain re-enters the right surface, rebuilt from the live catalog and connection store. Disconnecting one account reopens that service accounts menu without the removed row; disconnecting the last account, or a cancel that stored nothing, reopens the catalog; reconnect/re-verify, add-account, and paste re-enter the accounts menu with refreshed state. Esc closes the whole chain, and actions blocked before they start (login in progress, guidance, target drift) end the chain with their status line instead of re-opening, so there is no re-entry loop.\n\n* fix(tui): drop the accounts description instead of overflowing tight viewports\n\n* fix(tui): one reconnect/disconnect row per service with an account sub-picker, and left-arrow back to the catalog\n\nA service's accounts menu is now exactly three rows — Reconnect, Disconnect, Add another account — instead of a reconnect/disconnect pair per connection id. With one account, Enter acts on it directly with the existing re-verify and remove semantics. With several accounts, Enter on Reconnect or Disconnect opens a second inline picker in the same choice-list shape that lists the account ids; picking one runs the action on that connection id only, and Esc or left there returns to the accounts menu without acting. The sub-picker never nests deeper, and after an action the existing re-entry table decides the next surface (the accounts menu while an account survives, the catalog otherwise).\n\nLeft arrow from the accounts page now navigates back to the /mcp catalog — the picker chain's parent surface — remounted fresh, using the same app.modal.back binding the dialogs share; Esc still closes the whole chain, and left in the catalog stays inert. The accounts frame budget is unchanged (the option count is the only thing that grows), the budget test now pins the three-row count, and the multi-account re-entry tests drive the sub-picker end to end.\n\n* fix(tui): colour mcp outcome entries by outcome, warning for non-success\n\n* fix(mcp): keep alias OAuth providers behind the parent service catalog classification (ENG-6108)\n\n* fix(mcp): probe the origin-level oauth-protected-resource document without the endpoint query\n\n* test: bring ENG-6108 suites into the main-branch testing policy (#2336)\n\nShrink the branch's test additions from a net 16,514 to 16,610? -> net 11,610\ntest lines (the same as the branch's source additions), clear all 46 new\ntest-policy pattern violations, and consolidate per the policy's \"one file\nper module, regressions live in the owning suite\" rules. No test survives\non a timer, poll, sleep, skip, or env gate; every wait resolves on a\nconcrete deferred signal (mount hooks, probe gates, store flushes).\n\nFolded per-issue regression files into the owning module suites:\n- suite/regressions/eng-6108-inline-picker.test.ts -> the picker-chain\n describe in test/service-catalog-picker.test.ts (mount/stale/replacement\n settling, action routing, re-entry, settings-actions freeze, paste flow,\n blocked actions) with vi.waitFor replaced by ui.setFocus-mount and\n action-start deferred signals; the pure row-shape/menu layout pins\n already covered by the component tests were deleted.\n- suite/regressions/eng-6108-service-catalog-activation.test.ts -> the\n connect-then-activate end-to-end test in test/agent-session-services\n .test.ts; the stored-token-pending duplicate died (already pinned in\n mcp-service-catalog).\n\nDissolved test/mcp-account-commit-safety.test.ts; its unique invariants\nmoved to the owning suites and the rest were duplicates:\n- store->auth gap interleave + finalize nonce ownership + no-resurrection\n -> test/mcp-connection-store.test.ts\n- CAS-absence replaceStagedCredential -> test/auth-storage.test.ts\n- /mcp login on a PENDING account, vanished-source repair (record+grant\n evidence; bare shell refuses), and the paste-flow seam (single-credential\n static token, cancelled/empty value, login-in-progress and target-changed\n refusals) -> test/mcp-activation-queue.test.ts.\n\nConsolidated near-identical seams (surviving test -> invariant it owns):\n- grant-state matrix pinned ONCE in mcp-catalog-eligibility (predicate +\n prompt + dispatch + view parity); manager's copy deleted.\n- reserved-name ownership pinned at dispatch level in mcp-manager; the\n view-level copy and mcp-service-safety's provider-lifecycle duplicate\n deleted.\n- cap protection pinned in mcp-service-catalog (resolver's own module);\n mcp-catalog-eligibility's copy deleted.\n- remove/logout-vs-finalize races pinned once at the REAL route seam in\n mcp-activation-queue; the store-level interleave duplicate deleted.\n- exact rendered copy kept only where it is a durable protocol contract\n (outcome notice wording); component render pins made structural.\n- oauth client-auth negotiation + PRM-mismatch refusals + python discover\n cursor/table families -> it.each/subTest tables.\n\nViolation conversions (all 46 cleared):\n- wall-clock-timer/poll/sleep: setFocus-mount signals, action-start\n deferreds, queueVerifyResult+flush chains, an asyncio.Event hang, and\n fs.watch for the multi-process ready barrier.\n- environment-gated-path: the 11 false positives in mcp-oauth (mock route\n conditions carrying token/credential substrings) renamed via aliases;\n the rest made unconditional.\n- explicit-test-timeout: allowed with policy comments only where the\n probe's own timeout bound IS the behavior under test (probe hang tests,\n real multi-process spawn).\n- conditional-or-disabled-test: kernel-bootstrap made unconditional\n (file-scoped venv resolution, no cwd dependence; merge of main's #2336\n had dropped the branch's theme bootstrap in menu-panel too - restored).\n\nVerified: every modified suite passes standalone and under 6 shuffle\nseeds; npm run check (biome + check:test-policy + tsgo + installer +\nbrowser-smoke) is green; spot-reverts of the chain re-entry rule and the\nstore finalize-ownership guard both fail the consolidated tests.\n\n* fix(mcp): mirror the engine audience rule and first-issuer selection in the audit\n\n* fix(mcp): fail closed on a malformed advertised issuer and fix the notion URL substring check","tree":"0f886690dfb0577dceddfb8e0f57117f5a4e5ef9"}},{"name":"nix","mode":"0040000","size":0,"lastCommit":{"hash":"80a10fa965bb26cb47c3fe660e695ce809c9ec4e","oid":"80a10fa965bb26cb47c3fe660e695ce809c9ec4e","parents":["54dc3af4a67b806faa6125694c25a1c3717f4d15"],"author":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-17T04:53:48+03:00"},"committer":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-17T07:10:10+03:00"},"message":"nix improve\n","tree":"891f5433bd21b5403407441a4fc05e47837d1fc9"}},{"name":"prime-intellect","mode":"0040000","size":0,"lastCommit":{"hash":"ab9d6d4151709813af85e044abbee2d2ed73a481","oid":"ab9d6d4151709813af85e044abbee2d2ed73a481","parents":["425e58b1987d7d5eb217d60aa9845e8ed4d7bdbe"],"author":{"name":"kt","email":"kevin.jt2007@gmail.com","when":"2026-06-09T13:55:25-07:00"},"committer":{"name":"GitHub","email":"noreply@github.com","when":"2026-06-09T13:55:25-07:00"},"message":"add built-in prime-intellect skill shipped with the package (ENG-4004) (#113)\n\nBuilt-in skills load from a skills/ directory shipped with the\nprime-agent package, registered as a new lowest-precedence 'builtin'\nsource so user, project, and package skills with the same name win.\nDisable via the enableBuiltinSkills setting, /settings toggle,\n--no-skills, or per-skill override patterns.\n\nShips one comprehensive prime-intellect skill: ecosystem overview and\nprime CLI workflows, with on-demand references for environments/evals/\ntraining, sandboxes/tunnels, inference, and compute/storage, plus the\nlive-docs pattern (docs.primeintellect.ai/.md, llms.txt).\n\nCo-authored-by: Claude Fable 5 ","tree":"e1bce51d8ddecb055bddc00823eea1e33bbde33f"}},{"name":"refine","mode":"0040000","size":0,"lastCommit":{"hash":"61eb64748eb077e2a084432db92d101a2a83e146","oid":"61eb64748eb077e2a084432db92d101a2a83e146","parents":["0940833b771fbaf5144451988604b310a96722fd"],"author":{"name":"Sebastian Müller","email":"32787133+sethkarten@users.noreply.github.com","when":"2026-08-27T00:24:10+02:00"},"committer":{"name":"GitHub","email":"noreply@github.com","when":"2026-08-26T15:24:10-07:00"},"message":"Minimal CPython REPL runtime (rlm.repl) (#1685)\n\n* feat(coding-agent): add async-by-default bash() to the kernel runtime\n\n* chore(coding-agent): tighten bash() comments and changelog fragment\n\n* feat(coding-agent): add a standalone CPython REPL runtime speaking JSON lines over stdio\n\n* chore(coding-agent): tighten REPL runtime comments\n\n* feat(coding-agent): run the kernel on the REPL runtime over stdio\n\n* fix(coding-agent): reject pending host requests on kernel teardown\n\nThe runtime now fails pending host_request futures when stdin hits EOF or\na shutdown request arrives, so a cell awaiting a host reply can no longer\nblock _serve from consuming the shutdown and wedge the process. Startup\nand busy-kernel messages plus the ipython tool description now say Python\nkernel, matching the default REPL runtime client.\n\n* chore(coding-agent): describe the kernel-heavy test tag client-neutrally\n\n* feat(coding-agent): make the REPL runtime the only kernel\n\nRemoves the Jupyter/ipykernel/ZMQ kernel client, the fork server, the\nPRIME_AGENT_KERNEL escape hatch, and the %%bash/%cd/%env cell rewriting.\nMagic-style cells (%/%%/!) return a one-line error naming the Python or\nbash() replacement. The kernel venv no longer installs ipykernel;\nexisting venvs are rebuilt once via the bootstrap schema bump. Old\nsnapshot artifacts still restore through the runtime's pickle compat.\n\n* fix(coding-agent): close MCP transports in REPL shutdown\n\n* fix(coding-agent): address bash() review findings — exact tail retention, foreground-status lifecycle with group anchoring, post-kill forkserver reap, Windows start-id parity, executor-free await\n\n* fix(coding-agent): tree-kill bash() process trees on Windows and make running reflect group liveness\n\n* fix(runtime): address repl runtime review findings\n\n- revalidate targeted interrupts through SIGINT delivery so a stale signal\n cannot cancel a later request\n- preserve a parked untargeted interrupt while another request is inflight\n- reject non-string interrupt ids and validate snapshot options\n (prune_oversized bool, max_bytes/max_variable_bytes present => int)\n- guard str(exc) in error/skip/fail reasons so a broken __str__ cannot\n kill the runtime\n- fail the snapshot when the manifest write fails (before any pruning)\n- report 'snapshot not found' reason on restore of a missing path\n- wait unbounded for the output-pump drain marker so done never precedes\n captured output and marker bytes never leak\n- document that aggregate-cap skips are not pruned\n\n* fix(coding-agent): carry bash() status pipe as stdin so strict-POSIX shells accept single-digit fd redirections\n\n* fix(coding-agent): address host-swap review findings — runtime-neutral kernel wording, %cd/%env rewrite fidelity, linear-time magic regexes, restart supersession guard\n\n* fix(coding-agent): reject stale column-0 line magics on any cell line, not just the first\n\n* fix(coding-agent): close status fds when wake-pipe creation fails and gate bash() commands on orphan-journal registration\n\n* fix(coding-agent): strip quoted %cd targets, use UTF-16-safe %env parsing, and expand $var/${var} values PEP-215-style\n\n* fix(coding-agent): fail rlm.run fast outside a live kernel so vitest workers cannot hang on a comm that never replies\n\n* fix(coding-agent): clear the active cell id before terminal events so late background output is never tagged with a finished cell\n\n* fix(coding-agent): update legacy IPython-era tests to assert cutover behavior\n\n* fix(coding-agent): describe the column-0 magic scan without referencing the removed rewrite backend\n\n* fix(coding-agent): consume parked interrupts on compile failures and survive user-closed stdio in the drain path\n\n* fix(coding-agent): redact bare %env listings, prefer '=' in %env parsing, echo %cd targets, and keep graceful shutdowns owning their cleanup\n\n* fix(coding-agent): reject kernel startup promptly on spawn errors and commit %cd previous-dir tracking only after chdir succeeds\n\n* fix(coding-agent): trim ParsedIpythonBashCell to the body field its callers use\n\n* fix(coding-agent): kill full process trees in the Windows orphan reaper via taskkill /T\n\n* fix(coding-agent): survive compile-phase crashes and fd-reuse drain hangs in the REPL runtime\n\n* fix(coding-agent): shield snapshot prune deletions from interrupts and pin the host comm probe to its real seam\n\n* fix(coding-agent): route list_names through the per-request backstop and skip non-string namespace keys\n\n* fix(coding-agent): reject snapshot requests whose manifest path aliases the payload path\n\n* fix(coding-agent): reject negative snapshot size caps that would prune every user variable\n\n* fix(coding-agent): kill one-shot await bash() on cancel, resolve Windows helpers via System32, retry taskkill after reap, and fail closed on orphan-journal enrollment\n\n* fix(coding-agent): attribute REPL stream output at write time so raw fd and user-thread bytes never carry another cell's id\n\n* fix(coding-agent): surface unattributed REPL stream output as separate background output instead of dropping or merging it\n\n* fix(coding-agent): confirm group exit before a cancelled one-shot bash() await propagates and complete-write orphan-journal records\n\n* fix(coding-agent): expose a working sys.stdout.buffer on the tagged REPL writer routing bytes through the null-attributed raw channel\n\n* fix(coding-agent): mark between-cell background output truncated when the pending buffer cap is hit\n\n* fix(coding-agent): shield the cancelled-await bash() confirm-exit from re-cancellation, fail clearly without bash on Windows, and fence slow pumps out of result assembly\n\n* fix(coding-agent): survive hostile protocol lines in the REPL reader thread and interrupt without pthread_kill on Windows\n\n* fix(coding-agent): send the protocol shutdown from dispose() so the runtime closes MCP servers and kills live bash groups before the hard kill\n\n* fix(coding-agent): flag the pump's read-to-commit window so the bash() drain fence cannot miss an in-flight chunk\n\n* fix(coding-agent): guard the whole REPL request line against hostile input, reject duplicate in-flight ids, complete short buffer-pipe writes, and clean the snapshot temp file on KeyboardInterrupt\n\n* fix(coding-agent): drop stale between-cell background output on kernel teardown so it cannot surface after a restart\n\n* fix(coding-agent): assert the tagged channel only in the large buffer-write REPL test since cross-channel ordering is not guaranteed\n\n* fix(coding-agent): resolve taskkill via absolute System32 path in the host orphan reaper\n\n* fix(coding-agent): write the inactive orphan-journal record only after a delivered kill so undelivered signals leave the host reaper in charge\n\n* fix(coding-agent): keep a REPL request interrupt-targetable through its trailing-expression repr and output drain until done is emitted\n\n* fix(coding-agent): count an already-exited leader as delivered in the Windows bash() reap so clean exits still journal inactive\n\n* fix(coding-agent): reject NaN and Infinity in emit() payloads before they corrupt REPL protocol framing\n\n* chore(coding-agent): correct the stale ipykernel requirement on the python override doc\n\n* chore(coding-agent): drop migration-era wording from kernel comments\n\n* fix(coding-agent): resolve trusted absolute shell host-side and close Windows journal/reap gaps\n\n* fix(coding-agent): best-effort-kill pid-only orphan records in daemon force-stop and recovery reaps\n\n* refactor(coding-agent): drop the magic-cell rejection gate\n\n%-prefixed and !-prefixed cells now reach CPython and fail with its own\nSyntaxError, which names the offending line. The rejection layer guarded\nagainst model-produced IPython syntax, but with the shipped prompt fresh\nsessions do not produce it, and the plain SyntaxError is protection enough.\nparseIpythonBashCell stays: transcripts from ipykernel-era sessions render\n%%bash cells with shell highlighting forever.\n\n* fix(coding-agent): report a committed destructive snapshot as success even when an interrupt was parked\n\n* chore(ai): drop stray live-regen drift in models.generated.ts\n\nad657d7ec accidentally committed generate-models output produced by a local\nbuild; the catalog belongs to its own regen PRs.\n\n* test(coding-agent): expect a plain SyntaxError for legacy %%bash cells after the magic-rejection gate removal\n\n* fix(coding-agent): consume a finishing-targeted interrupt after a completed state request instead of failing the done\n\n* fix(coding-agent): exit the REPL runtime when its owner dies even during a busy cell\n\n* fix(coding-agent): resolve the kernel bash shell only from trusted absolute paths on Windows\n\n* fix(coding-agent): contain Windows bash children with kill-on-close job objects\n\n* test(coding-agent): cover owner death during a non-yielding REPL cell\n\n* fix(coding-agent): skip concurrently deleted names during snapshot instead of aborting\n\n* fix(coding-agent): fall back to taskkill when job termination fails\n\n* fix(coding-agent): stop telling REPL-default users they need ipykernel\n\n* fix(coding-agent): clear the SIGINT target when its request finishes\n\n* test(coding-agent): drop migration-era wording from the %%bash rejection comment\n\n* fix(coding-agent): start Windows bash children suspended and fail closed when job containment cannot be established\n\n* fix(coding-agent): re-assert the kernel SIGINT handler between cells so a cell rebinding SIGINT cannot break interrupts\n\n* fix(coding-agent): kill the whole tree for enriched orphan records on Windows force-stop\n\nstopTrackedProcess signals only the shell pid on Windows; use killOrphanProcess (taskkill /T) after the identity check, matching the owned-session-worker and daemon-supervisor reapers.\n\n* docs(coding-agent): describe current magic-cell behavior in release notes\n\nMagic-style cells fail with a plain SyntaxError; the migration error and %cd/%env rewrites were removed, so the notes stop claiming them.\n\n* fix(coding-agent): skip the liveness check when the orphan identity is stale\n\nA reused pid looked like a failed kill after the identity re-check skipped taskkill, blocking worker cleanup with a spurious failure.\n\n* fix(coding-agent): journal Windows bash() children before job assignment so a kernel kill mid-spawn cannot leak an unjournaled suspended process\n\n* fix(coding-agent): pre-create the Windows bash() job before spawn and contain the child before the journal start-id query\n\n* fix(coding-agent): create Windows bash() children atomically inside the kill-on-close job via PROC_THREAD_ATTRIBUTE_JOB_LIST, closing the Popen-to-assignment leak window\n\n* chore(coding-agent): compress the atomic-job-association comments to one-line rationale\n\n* fix(coding-agent): send duplicate-id protocol errors outside the interrupt lock and reject int payloads in the captured stdout buffer\n\n* docs(coding-agent): update the kernel provisioner docstring for the REPL/IPython split\n\n* fix(coding-agent): retain the Windows bash() process handle through job cleanup and taskkill fallbacks so a recycled pid can never be killed\n\n* fix(coding-agent): serialize Windows bash() abort cleanup under the kill lock so shutdown taskkill can never race the process-handle close\n\n* fix(coding-agent): commit REPL snapshot payload and manifest atomically via unique temp files with guaranteed cleanup and parked-SIGINT restore\n\n* fix(coding-agent): stage REPL restore before an interrupt-parked apply and recover committed snapshot/restore results from protocol interrupts so a committed operation is never misreported as failed\n\n* chore(coding-agent): compress restore-shield rationale comments to one line each\n\n* fix(coding-agent): surface unattributed background output in IPython cell details and render it after the traceback in the expanded cell view\n\n* docs(coding-agent): replace stale Jupyter comm vocabulary in rlm-runtime failure modes and focused validation with stdio-transport equivalents\n\n* docs(coding-agent): describe the REPL trust boundary and runtime-bootstrap failure in stdio terms and drop the removed TokenUsage export\n\n* fix(runtime): address REPL review findings\n\n* fix(runtime): preserve near-cap snapshots\n\n---------\n\nCo-authored-by: Seth ","tree":"a251ca47e114be10eb5c23cfb1de655c8aeeb954"}},{"name":"remote","mode":"0040000","size":0,"lastCommit":{"hash":"3e658fe345c57401621e918602713d5aa8a01610","oid":"3e658fe345c57401621e918602713d5aa8a01610","parents":["2d9b647bb7f767ab8cd19ff37672c9c59341289b"],"author":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-17T12:11:29+03:00"},"committer":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-17T12:11:29+03:00"},"message":"rlm,ssh: unify handle and result text accessor and add accountable stdin and copy verification\n","tree":"354511c9a2a3a5decf7763fdbda6ca656bc0d2f9"}},{"name":"repo","mode":"0040000","size":0,"lastCommit":{"hash":"7446965d9b14bff5fda33eb27259015d5b9c4dff","oid":"7446965d9b14bff5fda33eb27259015d5b9c4dff","parents":["ae6ee379908f52365f7731a4812233694fd800c5"],"author":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-15T18:44:47+03:00"},"committer":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-17T07:04:42+03:00"},"message":"feat(skills): settled skill results, so `await` on a finished call works (R7 S2)\n\nThe runtime settled the trailing cell value and the `rlm.*` handles, but a skill\ncall still returned a plain str/list/dict, so `await git.root()` raised \"object\nstr can't be used in 'await' expression\" - 156 of those in the audit corpus.\n\n- `rlm.skill` gains `settled_call`/`settle_module`/`_settle_result`; each skill\n module settles its published callables at import through a soft `rlm.skill`\n import, so a skill still works as a plain CLI without a kernel\n- `None` stays `None` deliberately: awaiting it still raises loudly rather than\n turning an absence into a value (the design's `Missing` type is not introduced)\n- the five local `Awaitable*` classes and thirteen `__await__` definitions are\n gone; result subclasses inherit `SettledList` (with a `list` fallback) and keep\n their own type and repr, so `type(await git.log()) is git.CommitList`\n\nI2 (the remaining half): `path=` is kept in the signatures only to fail loudly\nwith both corrections (\"cwd= is where git runs and paths=[...] are the target\npaths\") on git.log/graph/diff/changed/add/commit/checkout/reset/restore and the\njj equivalents. It used to mean the run directory, so aliasing it to `paths=`\nwould have silently filtered the wrong thing; `cwd=` raises a GitError\nthat names `cwd=` and points at `paths=[...]`.\n\nTests: prime-agent-runtime 430 OK (test_skill_surface 25); git 17, jj 25,\nsearch 24, nix 9, repo 3 (new module). Negative control: dropping git's settle\nline makes the await test fail with the original TypeError.\n","tree":"bd0da88a654eda6317808c7346d5d0eb7efba9bc"}},{"name":"rlm-heartbeat","mode":"0040000","size":0,"lastCommit":{"hash":"61eb64748eb077e2a084432db92d101a2a83e146","oid":"61eb64748eb077e2a084432db92d101a2a83e146","parents":["0940833b771fbaf5144451988604b310a96722fd"],"author":{"name":"Sebastian Müller","email":"32787133+sethkarten@users.noreply.github.com","when":"2026-08-27T00:24:10+02:00"},"committer":{"name":"GitHub","email":"noreply@github.com","when":"2026-08-26T15:24:10-07:00"},"message":"Minimal CPython REPL runtime (rlm.repl) (#1685)\n\n* feat(coding-agent): add async-by-default bash() to the kernel runtime\n\n* chore(coding-agent): tighten bash() comments and changelog fragment\n\n* feat(coding-agent): add a standalone CPython REPL runtime speaking JSON lines over stdio\n\n* chore(coding-agent): tighten REPL runtime comments\n\n* feat(coding-agent): run the kernel on the REPL runtime over stdio\n\n* fix(coding-agent): reject pending host requests on kernel teardown\n\nThe runtime now fails pending host_request futures when stdin hits EOF or\na shutdown request arrives, so a cell awaiting a host reply can no longer\nblock _serve from consuming the shutdown and wedge the process. Startup\nand busy-kernel messages plus the ipython tool description now say Python\nkernel, matching the default REPL runtime client.\n\n* chore(coding-agent): describe the kernel-heavy test tag client-neutrally\n\n* feat(coding-agent): make the REPL runtime the only kernel\n\nRemoves the Jupyter/ipykernel/ZMQ kernel client, the fork server, the\nPRIME_AGENT_KERNEL escape hatch, and the %%bash/%cd/%env cell rewriting.\nMagic-style cells (%/%%/!) return a one-line error naming the Python or\nbash() replacement. The kernel venv no longer installs ipykernel;\nexisting venvs are rebuilt once via the bootstrap schema bump. Old\nsnapshot artifacts still restore through the runtime's pickle compat.\n\n* fix(coding-agent): close MCP transports in REPL shutdown\n\n* fix(coding-agent): address bash() review findings — exact tail retention, foreground-status lifecycle with group anchoring, post-kill forkserver reap, Windows start-id parity, executor-free await\n\n* fix(coding-agent): tree-kill bash() process trees on Windows and make running reflect group liveness\n\n* fix(runtime): address repl runtime review findings\n\n- revalidate targeted interrupts through SIGINT delivery so a stale signal\n cannot cancel a later request\n- preserve a parked untargeted interrupt while another request is inflight\n- reject non-string interrupt ids and validate snapshot options\n (prune_oversized bool, max_bytes/max_variable_bytes present => int)\n- guard str(exc) in error/skip/fail reasons so a broken __str__ cannot\n kill the runtime\n- fail the snapshot when the manifest write fails (before any pruning)\n- report 'snapshot not found' reason on restore of a missing path\n- wait unbounded for the output-pump drain marker so done never precedes\n captured output and marker bytes never leak\n- document that aggregate-cap skips are not pruned\n\n* fix(coding-agent): carry bash() status pipe as stdin so strict-POSIX shells accept single-digit fd redirections\n\n* fix(coding-agent): address host-swap review findings — runtime-neutral kernel wording, %cd/%env rewrite fidelity, linear-time magic regexes, restart supersession guard\n\n* fix(coding-agent): reject stale column-0 line magics on any cell line, not just the first\n\n* fix(coding-agent): close status fds when wake-pipe creation fails and gate bash() commands on orphan-journal registration\n\n* fix(coding-agent): strip quoted %cd targets, use UTF-16-safe %env parsing, and expand $var/${var} values PEP-215-style\n\n* fix(coding-agent): fail rlm.run fast outside a live kernel so vitest workers cannot hang on a comm that never replies\n\n* fix(coding-agent): clear the active cell id before terminal events so late background output is never tagged with a finished cell\n\n* fix(coding-agent): update legacy IPython-era tests to assert cutover behavior\n\n* fix(coding-agent): describe the column-0 magic scan without referencing the removed rewrite backend\n\n* fix(coding-agent): consume parked interrupts on compile failures and survive user-closed stdio in the drain path\n\n* fix(coding-agent): redact bare %env listings, prefer '=' in %env parsing, echo %cd targets, and keep graceful shutdowns owning their cleanup\n\n* fix(coding-agent): reject kernel startup promptly on spawn errors and commit %cd previous-dir tracking only after chdir succeeds\n\n* fix(coding-agent): trim ParsedIpythonBashCell to the body field its callers use\n\n* fix(coding-agent): kill full process trees in the Windows orphan reaper via taskkill /T\n\n* fix(coding-agent): survive compile-phase crashes and fd-reuse drain hangs in the REPL runtime\n\n* fix(coding-agent): shield snapshot prune deletions from interrupts and pin the host comm probe to its real seam\n\n* fix(coding-agent): route list_names through the per-request backstop and skip non-string namespace keys\n\n* fix(coding-agent): reject snapshot requests whose manifest path aliases the payload path\n\n* fix(coding-agent): reject negative snapshot size caps that would prune every user variable\n\n* fix(coding-agent): kill one-shot await bash() on cancel, resolve Windows helpers via System32, retry taskkill after reap, and fail closed on orphan-journal enrollment\n\n* fix(coding-agent): attribute REPL stream output at write time so raw fd and user-thread bytes never carry another cell's id\n\n* fix(coding-agent): surface unattributed REPL stream output as separate background output instead of dropping or merging it\n\n* fix(coding-agent): confirm group exit before a cancelled one-shot bash() await propagates and complete-write orphan-journal records\n\n* fix(coding-agent): expose a working sys.stdout.buffer on the tagged REPL writer routing bytes through the null-attributed raw channel\n\n* fix(coding-agent): mark between-cell background output truncated when the pending buffer cap is hit\n\n* fix(coding-agent): shield the cancelled-await bash() confirm-exit from re-cancellation, fail clearly without bash on Windows, and fence slow pumps out of result assembly\n\n* fix(coding-agent): survive hostile protocol lines in the REPL reader thread and interrupt without pthread_kill on Windows\n\n* fix(coding-agent): send the protocol shutdown from dispose() so the runtime closes MCP servers and kills live bash groups before the hard kill\n\n* fix(coding-agent): flag the pump's read-to-commit window so the bash() drain fence cannot miss an in-flight chunk\n\n* fix(coding-agent): guard the whole REPL request line against hostile input, reject duplicate in-flight ids, complete short buffer-pipe writes, and clean the snapshot temp file on KeyboardInterrupt\n\n* fix(coding-agent): drop stale between-cell background output on kernel teardown so it cannot surface after a restart\n\n* fix(coding-agent): assert the tagged channel only in the large buffer-write REPL test since cross-channel ordering is not guaranteed\n\n* fix(coding-agent): resolve taskkill via absolute System32 path in the host orphan reaper\n\n* fix(coding-agent): write the inactive orphan-journal record only after a delivered kill so undelivered signals leave the host reaper in charge\n\n* fix(coding-agent): keep a REPL request interrupt-targetable through its trailing-expression repr and output drain until done is emitted\n\n* fix(coding-agent): count an already-exited leader as delivered in the Windows bash() reap so clean exits still journal inactive\n\n* fix(coding-agent): reject NaN and Infinity in emit() payloads before they corrupt REPL protocol framing\n\n* chore(coding-agent): correct the stale ipykernel requirement on the python override doc\n\n* chore(coding-agent): drop migration-era wording from kernel comments\n\n* fix(coding-agent): resolve trusted absolute shell host-side and close Windows journal/reap gaps\n\n* fix(coding-agent): best-effort-kill pid-only orphan records in daemon force-stop and recovery reaps\n\n* refactor(coding-agent): drop the magic-cell rejection gate\n\n%-prefixed and !-prefixed cells now reach CPython and fail with its own\nSyntaxError, which names the offending line. The rejection layer guarded\nagainst model-produced IPython syntax, but with the shipped prompt fresh\nsessions do not produce it, and the plain SyntaxError is protection enough.\nparseIpythonBashCell stays: transcripts from ipykernel-era sessions render\n%%bash cells with shell highlighting forever.\n\n* fix(coding-agent): report a committed destructive snapshot as success even when an interrupt was parked\n\n* chore(ai): drop stray live-regen drift in models.generated.ts\n\nad657d7ec accidentally committed generate-models output produced by a local\nbuild; the catalog belongs to its own regen PRs.\n\n* test(coding-agent): expect a plain SyntaxError for legacy %%bash cells after the magic-rejection gate removal\n\n* fix(coding-agent): consume a finishing-targeted interrupt after a completed state request instead of failing the done\n\n* fix(coding-agent): exit the REPL runtime when its owner dies even during a busy cell\n\n* fix(coding-agent): resolve the kernel bash shell only from trusted absolute paths on Windows\n\n* fix(coding-agent): contain Windows bash children with kill-on-close job objects\n\n* test(coding-agent): cover owner death during a non-yielding REPL cell\n\n* fix(coding-agent): skip concurrently deleted names during snapshot instead of aborting\n\n* fix(coding-agent): fall back to taskkill when job termination fails\n\n* fix(coding-agent): stop telling REPL-default users they need ipykernel\n\n* fix(coding-agent): clear the SIGINT target when its request finishes\n\n* test(coding-agent): drop migration-era wording from the %%bash rejection comment\n\n* fix(coding-agent): start Windows bash children suspended and fail closed when job containment cannot be established\n\n* fix(coding-agent): re-assert the kernel SIGINT handler between cells so a cell rebinding SIGINT cannot break interrupts\n\n* fix(coding-agent): kill the whole tree for enriched orphan records on Windows force-stop\n\nstopTrackedProcess signals only the shell pid on Windows; use killOrphanProcess (taskkill /T) after the identity check, matching the owned-session-worker and daemon-supervisor reapers.\n\n* docs(coding-agent): describe current magic-cell behavior in release notes\n\nMagic-style cells fail with a plain SyntaxError; the migration error and %cd/%env rewrites were removed, so the notes stop claiming them.\n\n* fix(coding-agent): skip the liveness check when the orphan identity is stale\n\nA reused pid looked like a failed kill after the identity re-check skipped taskkill, blocking worker cleanup with a spurious failure.\n\n* fix(coding-agent): journal Windows bash() children before job assignment so a kernel kill mid-spawn cannot leak an unjournaled suspended process\n\n* fix(coding-agent): pre-create the Windows bash() job before spawn and contain the child before the journal start-id query\n\n* fix(coding-agent): create Windows bash() children atomically inside the kill-on-close job via PROC_THREAD_ATTRIBUTE_JOB_LIST, closing the Popen-to-assignment leak window\n\n* chore(coding-agent): compress the atomic-job-association comments to one-line rationale\n\n* fix(coding-agent): send duplicate-id protocol errors outside the interrupt lock and reject int payloads in the captured stdout buffer\n\n* docs(coding-agent): update the kernel provisioner docstring for the REPL/IPython split\n\n* fix(coding-agent): retain the Windows bash() process handle through job cleanup and taskkill fallbacks so a recycled pid can never be killed\n\n* fix(coding-agent): serialize Windows bash() abort cleanup under the kill lock so shutdown taskkill can never race the process-handle close\n\n* fix(coding-agent): commit REPL snapshot payload and manifest atomically via unique temp files with guaranteed cleanup and parked-SIGINT restore\n\n* fix(coding-agent): stage REPL restore before an interrupt-parked apply and recover committed snapshot/restore results from protocol interrupts so a committed operation is never misreported as failed\n\n* chore(coding-agent): compress restore-shield rationale comments to one line each\n\n* fix(coding-agent): surface unattributed background output in IPython cell details and render it after the traceback in the expanded cell view\n\n* docs(coding-agent): replace stale Jupyter comm vocabulary in rlm-runtime failure modes and focused validation with stdio-transport equivalents\n\n* docs(coding-agent): describe the REPL trust boundary and runtime-bootstrap failure in stdio terms and drop the removed TokenUsage export\n\n* fix(runtime): address REPL review findings\n\n* fix(runtime): preserve near-cap snapshots\n\n---------\n\nCo-authored-by: Seth ","tree":"a251ca47e114be10eb5c23cfb1de655c8aeeb954"}},{"name":"search","mode":"0040000","size":0,"lastCommit":{"hash":"7446965d9b14bff5fda33eb27259015d5b9c4dff","oid":"7446965d9b14bff5fda33eb27259015d5b9c4dff","parents":["ae6ee379908f52365f7731a4812233694fd800c5"],"author":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-15T18:44:47+03:00"},"committer":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-17T07:04:42+03:00"},"message":"feat(skills): settled skill results, so `await` on a finished call works (R7 S2)\n\nThe runtime settled the trailing cell value and the `rlm.*` handles, but a skill\ncall still returned a plain str/list/dict, so `await git.root()` raised \"object\nstr can't be used in 'await' expression\" - 156 of those in the audit corpus.\n\n- `rlm.skill` gains `settled_call`/`settle_module`/`_settle_result`; each skill\n module settles its published callables at import through a soft `rlm.skill`\n import, so a skill still works as a plain CLI without a kernel\n- `None` stays `None` deliberately: awaiting it still raises loudly rather than\n turning an absence into a value (the design's `Missing` type is not introduced)\n- the five local `Awaitable*` classes and thirteen `__await__` definitions are\n gone; result subclasses inherit `SettledList` (with a `list` fallback) and keep\n their own type and repr, so `type(await git.log()) is git.CommitList`\n\nI2 (the remaining half): `path=` is kept in the signatures only to fail loudly\nwith both corrections (\"cwd= is where git runs and paths=[...] are the target\npaths\") on git.log/graph/diff/changed/add/commit/checkout/reset/restore and the\njj equivalents. It used to mean the run directory, so aliasing it to `paths=`\nwould have silently filtered the wrong thing; `cwd=` raises a GitError\nthat names `cwd=` and points at `paths=[...]`.\n\nTests: prime-agent-runtime 430 OK (test_skill_surface 25); git 17, jj 25,\nsearch 24, nix 9, repo 3 (new module). Negative control: dropping git's settle\nline makes the await test fail with the original TypeError.\n","tree":"bd0da88a654eda6317808c7346d5d0eb7efba9bc"}},{"name":"skill-creator","mode":"0040000","size":0,"lastCommit":{"hash":"ea7dbd1f103ffc9457e3f4a06ed1845ca5aa0a21","oid":"ea7dbd1f103ffc9457e3f4a06ed1845ca5aa0a21","parents":["81cd5390dbc871afb87be0d2012d205dd633bae3"],"author":{"name":"Sebastian Müller","email":"sebastian@primeintellect.ai","when":"2026-09-10T19:14:32+02:00"},"committer":{"name":"GitHub","email":"noreply@github.com","when":"2026-09-10T19:14:32+02:00"},"message":"make recursive subagent spawning an explicit rlm.spawn call (#2152)\n\n* rename rlm.run to rlm.spawn and drop the callable shim\n\nThe kernel API for spawning a child is now the single explicit call\nawait rlm.spawn(prompt, ...). Calling rlm(...) raises a TypeError that\nnames the replacement, so a model imitating an older transcript can\ncorrect itself in one turn. The host request type stays \"rlm.run\" so\nkernels and hosts of different versions keep working.\n\n* teach rlm.spawn in the system prompt and host errors\n\nThe system prompt, subagent guidance, refinement guidance, and spawn\nerror messages now name rlm.spawn instead of the removed callable form.\nThe kernel readiness check requires rlm.spawn and rejects a runtime that\nstill exposes rlm.run, so a stale kernel venv is rebuilt instead of\nserving the old surface.\n\n* update docs to the rlm.spawn call form\n\nDocs, README, the subagent example, and the Python skill reference now\nshow await rlm.spawn(...). The runtime doc keeps the \"rlm.run\" host\nrequest type where it describes the wire protocol.\n\n* keep one comment for the unchanged rlm.run wire type\n\nThe runtime comment at the host_request call is the only place the\nspawn/wire name difference needs explaining.\n\n* require an explicit child name and finish the rename cleanup\n\nrlm.spawn(prompt, *, name, model=None, thinking=None) now rejects a\nnameless spawn at the Python signature, so every child gets a stable\nname the parent chose. The host keeps its generated-name fallback for\nwire payloads without a name, because older kernels still send those.\n\nReading the removed rlm.run attribute now raises an AttributeError that\nnames rlm.spawn, matching the not-callable error, so both stale habits\nrecover in one turn. Docs no longer describe rlm as callable, and the\nbootstrap failure text says an interrupted upgrade rebuild needs network\nonce more.\n\n* name the child in the runtime sequence diagram\n\nThe diagram showed a spawn call that now fails at the signature.","tree":"8cfaf7b77427c319f28671d811d438f2fc566bcc"}},{"name":"ssh","mode":"0040000","size":0,"lastCommit":{"hash":"3e658fe345c57401621e918602713d5aa8a01610","oid":"3e658fe345c57401621e918602713d5aa8a01610","parents":["2d9b647bb7f767ab8cd19ff37672c9c59341289b"],"author":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-17T12:11:29+03:00"},"committer":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-17T12:11:29+03:00"},"message":"rlm,ssh: unify handle and result text accessor and add accountable stdin and copy verification\n","tree":"354511c9a2a3a5decf7763fdbda6ca656bc0d2f9"}},{"name":"tangled","mode":"0040000","size":0,"lastCommit":{"hash":"03c3ca484fbaa7f610a185df65fd73b05599651a","oid":"03c3ca484fbaa7f610a185df65fd73b05599651a","parents":["b6ac5d014d99401b55820835a4966584271e9a3c"],"author":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-08T04:11:13+09:00"},"committer":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-17T05:52:15+03:00"},"message":"feat(coding-agent,runtime): rebase minimal runtime extensions on upstream 0.9.3\n","tree":"69604d237dfc0e9897d18f423d849caa7b88a2bd"}},{"name":"websearch","mode":"0040000","size":0,"lastCommit":{"hash":"cae335999a0bf48e24acc98bc7aeb97099c7dbf4","oid":"cae335999a0bf48e24acc98bc7aeb97099c7dbf4","parents":["7446965d9b14bff5fda33eb27259015d5b9c4dff"],"author":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-15T18:57:13+03:00"},"committer":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-17T07:05:21+03:00"},"message":"feat(coding-agent): the skill metadata lint that keeps signatures out of descriptions (R7 S8)\n\nThe generated surface is now the only place a signature is published, so the\nloader warns when a skill restates one:\n\n- skill identity is the directory name; a frontmatter `name` that disagrees is\n reported and never used as the identity\n- a body whose first non-empty line is not a heading naming the skill warns\n (case and separators are folded, and a qualifier after the name is allowed,\n because the bundled convention is `# Title Case`)\n- a description containing a call signature (`name(...)` with arguments, or\n `await name(`) warns with the correction: signatures belong in the generated\n surface\n\nWarnings only: the missing-description drop, every existing diagnostic, and the\nresolved skill set are unchanged.\n\n`websearch/SKILL.md` was the one bundled skill whose description carried four\n`await websearch.*(...)` call forms; it now describes the call without the syntax.\n\nTests: test/skills.test.ts (36, four new plus \"every bundled skill directory\nloads\"), builtin-skills.test.ts (22), system-prompt (29). Negative controls:\nstubbing the signature check fails only its test; stubbing the title check fails\nonly the two title tests.\n\nNot done, deliberately: prime-agent-runtime/src/rlm/harness.py duplicates the\nharness-state call-contract paragraph, but the python copy is an abridgement\n(different clauses, different quoting), so aligning them cannot keep both\nrenderings identical - that is a consolidation, not a lint fix.\n","tree":"813952c61bbd4f45b34aaf4c3f4206d4330c7769"}}],"lastCommit":{"hash":"3e658fe345c57401621e918602713d5aa8a01610","oid":"3e658fe345c57401621e918602713d5aa8a01610","parents":["2d9b647bb7f767ab8cd19ff37672c9c59341289b"],"author":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-17T12:11:29+03:00"},"committer":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-17T12:11:29+03:00"},"message":"rlm,ssh: unify handle and result text accessor and add accountable stdin and copy verification\n","tree":"354511c9a2a3a5decf7763fdbda6ca656bc0d2f9"}}