{"entries":[{"name":"atomic-file.ts","mode":"0100644","size":3603,"lastCommit":{"hash":"844e85545af6858dcb3d6cfe42bbfcf2ca0be4e5","oid":"844e85545af6858dcb3d6cfe42bbfcf2ca0be4e5","parents":["915c78f42c248b08238dd27fcd4bcab32c60beab"],"author":{"name":"Sebastian Müller","email":"sebastian@primeintellect.ai","when":"2026-09-07T03:56:32+02:00"},"committer":{"name":"GitHub","email":"noreply@github.com","when":"2026-09-06T21:56:32-04:00"},"message":"Harden session persistence, worker recovery, and daemon refreshes (#2028)\n\n* refactor(coding-agent): move the semantic-edge ledger onto the event-log substrate\n\nThe recorder's private append/replay/repair IO is deleted; EventLog owns it, the same move #1987 made for the RLM spawn ledger. One durability rule is unified in the substrate rather than dropped: an unterminated final line is an uncommitted append, skipped on read and truncated before the next append — never newline-completed and never surfaced to a consumer whose next append destroys it.\n\n* fix(coding-agent): make the explicit ledger reader's ENOENT contract atomic\n\nreadSemanticEdgeLedger probed with statSync before reading through EventLog, which swallows ENOENT; a ledger deleted between the two returned [] instead of throwing. The missing-file decision now lives at the single open (replaySync missingFileThrows), so no check-then-read window exists.\n\n* docs(coding-agent): state the event-log tail rule once\n\nThe unterminated-tail contract was restated four times (module doc, replaySync doc, two test comments). It now lives once in the module doc; the method doc keeps only its own parse/missing-file semantics and the test comments reference the contract.\n\n* fix(coding-agent): write event-log appends fully and gate appends on tail repair\n\nwriteSync may write short (ENOSPC after a prefix); appendSync now loops until the payload is fully on disk so write-before-action callers never act on a torn record reported as success. A tail-repair failure (e.g. append-only ACL permitting O_APPEND but not r+) now propagates instead of being swallowed: writing through an unrepaired torn tail would weld it to the new record as permanent interior corruption. ENOENT and the concurrent-writer instability path keep their existing semantics.\n\n* fix(coding-agent): reclaim short event-log writes instead of completing them\n\nThe rlm spawn ledger is multi-writer by documented design (supervisor plus each worker over one file), so completing a short O_APPEND write with a second write could interleave with a rival append and weld two records. A short write now truncates its own torn prefix back off (only while this writer still owns the tail) and fails the append; a torn tail is read-tolerated, a weld is permanent corruption. The append fd opens a+ so the ownership check can read the tail.\n\n* fix(coding-agent): leave the torn tail on a short write instead of reclaiming it\n\nThe tail-match reclaim could truncate a rival's committed record whose final bytes coincide with our torn prefix - committed-data loss, strictly worse than the torn tail it prevented. A short write now just fails the append: the torn tail is the one tolerated shape, skipped on read and truncated by any writer's next repair (verified for both topologies: a resumed single-writer recorder repairs on its first append; every rlm-ledger writer repairs before each append).\n\n* refactor(coding-agent): compress event-log comments\n\n* fix(ai): omit the default service tier, reprice cache writes from message_delta, repoint the zai default\n\nIncorporates #2032 at f82c7fa3688b7e25cef80e2663fe77ed153c5cd9.\n\n* fix(tui,coding-agent): survive lone surrogates in table cells and terminate the WebP EXIF scan\n\nIncorporates #2033 at a3d1139ee6e1f77337ab134b0f0c0cede8c942af.\n\n* fix(coding-agent): restart dead kernels on ensure() and read mcp>=2 tool schemas\n\nIncorporates #2034 at 749e216e901304b310ead9f46c3813a032608d7b.\n\n* fix: one crash-safe owner for durable state writes\n\nIncorporates #2035 at f0f02d2fb090ec427307a65b9e9578ae3c8fc783.\n\n* fix(coding-agent): one zombie-aware process-liveness probe\n\nIncorporates #2041 at 92a0eacf47efc831444b0b4e412f35bd17ac3f28.\n\n* fix(coding-agent): snapshot transfer ids from the materialized cursor; mismatches settle the transfer, not the worker channel\n\nIncorporates #2044 at 5af3bbe8090240507d6b0297d0da007159e15305.\n\n* fix(coding-agent): failed workers recover on touch; roster gaps answer a structured recovering error\n\nIncorporates #2047 at 77b747afab402a9e2f5eada227ffe6fed626a634.\n\n* fix(coding-agent): seven session and IO correctness defects\n\nIncorporates #2037 at 41b5d72d7758723f22ba07f8738d217868ed7baf.\n\n* fix(coding-agent): coalesce child-usage attribution and gate agent-status persistence on real changes\n\nIncorporates #2050 at 6b0af5d2679ddff987ef3b4d43235a872fe2b315.\n\n* fix(coding-agent): incremental single-flight session metadata scans\n\nIncorporates #2043 at df032c1192dd2e38d35fcbaca589db7194f26b6c.\n\n* fix(coding-agent): memoize the passive RLM topology derivation\n\nIncorporates #2051 at 0ee114ce77942d9298136ca193ddc2c0b5d27d58.\n\n* fix(coding-agent): preserve accounting and metadata across deferred updates\n\nKeep durable child-usage aggregates separate from pending sibling usage. Retry optional topology metadata after transient reads. Completes #2050 and #2051 integration.\n\n* fix: preserve session accounting and read-only persistence boundaries\n\n---------\n\nCo-authored-by: Seth ","tree":"fde2f307a92f71b52dffbe1ec5232617702f5b62"}},{"name":"changelog.ts","mode":"0100644","size":2669,"lastCommit":{"hash":"14d99b5f86cc0ba603d49ddd48969eb20b055c47","oid":"14d99b5f86cc0ba603d49ddd48969eb20b055c47","parents":["0c1a9c30913960c1912e61fef474c1a544d9a057"],"author":{"name":"Mario Zechner","email":"badlogicgames@gmail.com","when":"2025-12-09T01:28:06+01:00"},"committer":{"name":"Mario Zechner","email":"badlogicgames@gmail.com","when":"2025-12-09T01:28:06+01:00"},"message":"Move config.ts from utils/ to src/\n","tree":"0f7aa371866650d90bcad5f02e35ea02042e1bf6"}},{"name":"child-process.ts","mode":"0100644","size":8944,"lastCommit":{"hash":"2ce443175b55a32075aa23ae41676a16b771d662","oid":"2ce443175b55a32075aa23ae41676a16b771d662","parents":["8a1e958008894705326de541b48e7d158b49ac4f"],"author":{"name":"Sebastian Müller","email":"sebastian@primeintellect.ai","when":"2026-09-07T05:14:48+02:00"},"committer":{"name":"GitHub","email":"noreply@github.com","when":"2026-09-06T23:14:48-04:00"},"message":"fix: improve Windows session and Python reliability (#2036)\n\n* fix(coding-agent): resolve the kernel venv python under Scripts on win32\n\nuv creates /Scripts/python.exe on Windows, but both bootstrap sites\njoined /bin/python unconditionally, so first-run kernel bootstrap\nalways failed on native Windows. Mirror the existing win32 uv.exe branch\nwith one kernelVenvPython helper used at both sites.\n\n* fix(coding-agent): expand ~/ with the platform path separator\n\nTilde expansion concatenated homedir() with the posix remainder at three\nsites (expandPath, expandTildePath, and an inline PI_PACKAGE_DIR copy),\nproducing mixed-separator paths like C:\\Users\\u/rest on Windows. Join\nthrough the platform path module instead and route PI_PACKAGE_DIR through\nexpandTildePath.\n\n* fix(coding-agent): prefer non-System32 bash over the WSL trampoline on PATH\n\nfindBashOnPath took the first where-match, and System32\\bash.exe (the WSL\nlauncher, which executes Linux-side) precedes per-user Git Bash installs on\ndefault PATHs. Order matches so %SystemRoot% entries are only a last\nresort.\n\n* fix(coding-agent): dial the Herdr socket inside the named-pipe namespace on win32\n\nThe built-in Herdr reporter connected to the exported unix-style socket\npath verbatim; on Windows a local-domain connection must target\n\\\\.\\pipe\\, and the reporter swallows connect errors by design, so the\nmismatch was invisible. Map unmapped paths into the pipe namespace before\ndialing.\n\n* fix(coding-agent): cache the win32 process start id per pid for a short TTL\n\ngetWindowsProcessStartId spawns a synchronous powershell query that blocks\nthe event loop, and supervisor liveness checks plus daemon-ps poll loops\ncall it repeatedly for the same pid. Memoize successful ids for 5s so hot\npaths reuse one query.\n\n* fix(coding-agent): derive handshake budgets from the outer connect deadline\n\nconnectWorker granted every hello/worker_auth attempt a fixed 1s clock, so\na handshake that consistently needs longer (slow win32 boxes) failed every\nretry regardless of the 30s outer budget, and the adopt/recover paths\nshrank even the outer budget to 1.5-2s. Per-attempt waits now consume the\nremaining outer deadline, all connectWorker callers use the one 30s\nconstant, and the downward 1s hello/auth overrides in daemon-mode and the\nrouted client fall back to the client defaults.\n\n* fix(coding-agent): route background spawns through hidden-window wrappers\n\nwindowsHide defaults to false, so console-subsystem children of a\nwindowless daemon or detached worker allocate a fresh console and flash or\nsteal focus on every spawn; only one call site in the repo set the flag.\nAdd spawnHidden/spawnSyncHidden/execSyncHidden/execFileHidden/\nexecFileSyncHidden to utils/child-process.ts and migrate all 49\nnon-interactive coding-agent spawn/exec sites; the tui package's two\nbackground spawns set windowsHide inline. Interactive spawns (editors,\ninherit-stdio installers and relaunches) intentionally keep their console.\n\n* chore(coding-agent): add windows-seams changelog fragments; tighten new comments\n\n* test(coding-agent): align clipboard and login-dialog spawn assertions with hidden-window wrappers\n\n* revert(coding-agent): drop the win32 start-id TTL cache\n\nThe per-pid cache could hand a recycled pid the dead process's start id\nfor up to 5s. The start id exists solely to detect pid recycling, and its\nconsumers act on that identity: the orphan-process journal decides\ntaskkill /T from it and daemon-ps shutdown waits poll it for change, so a\nstale match can kill a replacement process tree or mask an exited owner.\nNo caller is both hot and staleness-tolerant; the handshake latency issue\nis already addressed by deriving budgets from the outer deadline.\n\n* fix(coding-agent): match Herdr pipe-namespace prefixes case-insensitively\n\nWindows pipe names are case-insensitive, but the pass-through check was\ncase-sensitive, so a valid \\\\.\\PIPE\\... target was re-joined into a\ndifferent pipe name and the error-swallowing reporter failed silently.\nLowercase only the prefix check; the returned path keeps its casing.\n\n* refactor(coding-agent): tighten windows-seam comments and consolidate pins\n\nCollapse the wrapper doc block to one line, drop test comments that restate\nassertions, share one recording wrapper in the child-process mock, unwrap\nsingle-test describes, and remove one posix assertion already covered by\nits sibling. No behavior coverage removed; all pins keep their failing\nassertions.\n\n* fix(coding-agent,tui): harden current-runtime Windows sessions\n\nImport selective Bun-independent fixes from #1994 at\nce2d04f872ae7df567e68695aa258a1a5cdf254c, relative to declared\n#1982 base 9680ac3dfa8bdafae0f9e53286e2274d8b9c9090.\n\nPreserve #2036 Windows seams and current Node runtime. Keep Bun,\ninstaller, shell-policy rollout, scratch directories, and CPython\nbatch overrides outside this consolidation. #1994 remains partial.\nAtomic writer and bootstrap-lock overlap awaits canonical #2035\nreconciliation after parent stacks land.\n\n* fix(coding-agent): normalize Windows bash candidate paths\n\n---------\n\nCo-authored-by: Seth ","tree":"d8a9dec4332c83f71b05ba702c027932cab8ac19"}},{"name":"clipboard-binary-binding.ts","mode":"0100644","size":233,"lastCommit":{"hash":"8d64d3e1cd1b16dc77a736126f8757673138d0b7","oid":"8d64d3e1cd1b16dc77a736126f8757673138d0b7","parents":["ca82b869b5a20fd385bb9c8585b0bd07d47da186"],"author":{"name":"kt","email":"kevin.jt2007@gmail.com","when":"2026-09-15T14:17:42-07:00"},"committer":{"name":"GitHub","email":"noreply@github.com","when":"2026-09-15T14:17:42-07:00"},"message":"embed clipboard addon in native binaries (#2369)\n\n* fix(coding-agent): embed clipboard addon in native binaries\n\n* ci: install musl clipboard bindings for native builds\n\n* refactor(coding-agent): remove unused clipboard type export\n\n* ci: select target platform for musl dependencies\n\n* fix(coding-agent): skip unavailable musl clipboard bindings","tree":"3bc17aeb79c8987f5dadd366e0bf733df379f753"}},{"name":"clipboard-image.ts","mode":"0100644","size":7596,"lastCommit":{"hash":"2ce443175b55a32075aa23ae41676a16b771d662","oid":"2ce443175b55a32075aa23ae41676a16b771d662","parents":["8a1e958008894705326de541b48e7d158b49ac4f"],"author":{"name":"Sebastian Müller","email":"sebastian@primeintellect.ai","when":"2026-09-07T05:14:48+02:00"},"committer":{"name":"GitHub","email":"noreply@github.com","when":"2026-09-06T23:14:48-04:00"},"message":"fix: improve Windows session and Python reliability (#2036)\n\n* fix(coding-agent): resolve the kernel venv python under Scripts on win32\n\nuv creates /Scripts/python.exe on Windows, but both bootstrap sites\njoined /bin/python unconditionally, so first-run kernel bootstrap\nalways failed on native Windows. Mirror the existing win32 uv.exe branch\nwith one kernelVenvPython helper used at both sites.\n\n* fix(coding-agent): expand ~/ with the platform path separator\n\nTilde expansion concatenated homedir() with the posix remainder at three\nsites (expandPath, expandTildePath, and an inline PI_PACKAGE_DIR copy),\nproducing mixed-separator paths like C:\\Users\\u/rest on Windows. Join\nthrough the platform path module instead and route PI_PACKAGE_DIR through\nexpandTildePath.\n\n* fix(coding-agent): prefer non-System32 bash over the WSL trampoline on PATH\n\nfindBashOnPath took the first where-match, and System32\\bash.exe (the WSL\nlauncher, which executes Linux-side) precedes per-user Git Bash installs on\ndefault PATHs. Order matches so %SystemRoot% entries are only a last\nresort.\n\n* fix(coding-agent): dial the Herdr socket inside the named-pipe namespace on win32\n\nThe built-in Herdr reporter connected to the exported unix-style socket\npath verbatim; on Windows a local-domain connection must target\n\\\\.\\pipe\\, and the reporter swallows connect errors by design, so the\nmismatch was invisible. Map unmapped paths into the pipe namespace before\ndialing.\n\n* fix(coding-agent): cache the win32 process start id per pid for a short TTL\n\ngetWindowsProcessStartId spawns a synchronous powershell query that blocks\nthe event loop, and supervisor liveness checks plus daemon-ps poll loops\ncall it repeatedly for the same pid. Memoize successful ids for 5s so hot\npaths reuse one query.\n\n* fix(coding-agent): derive handshake budgets from the outer connect deadline\n\nconnectWorker granted every hello/worker_auth attempt a fixed 1s clock, so\na handshake that consistently needs longer (slow win32 boxes) failed every\nretry regardless of the 30s outer budget, and the adopt/recover paths\nshrank even the outer budget to 1.5-2s. Per-attempt waits now consume the\nremaining outer deadline, all connectWorker callers use the one 30s\nconstant, and the downward 1s hello/auth overrides in daemon-mode and the\nrouted client fall back to the client defaults.\n\n* fix(coding-agent): route background spawns through hidden-window wrappers\n\nwindowsHide defaults to false, so console-subsystem children of a\nwindowless daemon or detached worker allocate a fresh console and flash or\nsteal focus on every spawn; only one call site in the repo set the flag.\nAdd spawnHidden/spawnSyncHidden/execSyncHidden/execFileHidden/\nexecFileSyncHidden to utils/child-process.ts and migrate all 49\nnon-interactive coding-agent spawn/exec sites; the tui package's two\nbackground spawns set windowsHide inline. Interactive spawns (editors,\ninherit-stdio installers and relaunches) intentionally keep their console.\n\n* chore(coding-agent): add windows-seams changelog fragments; tighten new comments\n\n* test(coding-agent): align clipboard and login-dialog spawn assertions with hidden-window wrappers\n\n* revert(coding-agent): drop the win32 start-id TTL cache\n\nThe per-pid cache could hand a recycled pid the dead process's start id\nfor up to 5s. The start id exists solely to detect pid recycling, and its\nconsumers act on that identity: the orphan-process journal decides\ntaskkill /T from it and daemon-ps shutdown waits poll it for change, so a\nstale match can kill a replacement process tree or mask an exited owner.\nNo caller is both hot and staleness-tolerant; the handshake latency issue\nis already addressed by deriving budgets from the outer deadline.\n\n* fix(coding-agent): match Herdr pipe-namespace prefixes case-insensitively\n\nWindows pipe names are case-insensitive, but the pass-through check was\ncase-sensitive, so a valid \\\\.\\PIPE\\... target was re-joined into a\ndifferent pipe name and the error-swallowing reporter failed silently.\nLowercase only the prefix check; the returned path keeps its casing.\n\n* refactor(coding-agent): tighten windows-seam comments and consolidate pins\n\nCollapse the wrapper doc block to one line, drop test comments that restate\nassertions, share one recording wrapper in the child-process mock, unwrap\nsingle-test describes, and remove one posix assertion already covered by\nits sibling. No behavior coverage removed; all pins keep their failing\nassertions.\n\n* fix(coding-agent,tui): harden current-runtime Windows sessions\n\nImport selective Bun-independent fixes from #1994 at\nce2d04f872ae7df567e68695aa258a1a5cdf254c, relative to declared\n#1982 base 9680ac3dfa8bdafae0f9e53286e2274d8b9c9090.\n\nPreserve #2036 Windows seams and current Node runtime. Keep Bun,\ninstaller, shell-policy rollout, scratch directories, and CPython\nbatch overrides outside this consolidation. #1994 remains partial.\nAtomic writer and bootstrap-lock overlap awaits canonical #2035\nreconciliation after parent stacks land.\n\n* fix(coding-agent): normalize Windows bash candidate paths\n\n---------\n\nCo-authored-by: Seth ","tree":"d8a9dec4332c83f71b05ba702c027932cab8ac19"}},{"name":"clipboard-native.ts","mode":"0100644","size":553,"lastCommit":{"hash":"8d64d3e1cd1b16dc77a736126f8757673138d0b7","oid":"8d64d3e1cd1b16dc77a736126f8757673138d0b7","parents":["ca82b869b5a20fd385bb9c8585b0bd07d47da186"],"author":{"name":"kt","email":"kevin.jt2007@gmail.com","when":"2026-09-15T14:17:42-07:00"},"committer":{"name":"GitHub","email":"noreply@github.com","when":"2026-09-15T14:17:42-07:00"},"message":"embed clipboard addon in native binaries (#2369)\n\n* fix(coding-agent): embed clipboard addon in native binaries\n\n* ci: install musl clipboard bindings for native builds\n\n* refactor(coding-agent): remove unused clipboard type export\n\n* ci: select target platform for musl dependencies\n\n* fix(coding-agent): skip unavailable musl clipboard bindings","tree":"3bc17aeb79c8987f5dadd366e0bf733df379f753"}},{"name":"clipboard.ts","mode":"0100644","size":3736,"lastCommit":{"hash":"2ce443175b55a32075aa23ae41676a16b771d662","oid":"2ce443175b55a32075aa23ae41676a16b771d662","parents":["8a1e958008894705326de541b48e7d158b49ac4f"],"author":{"name":"Sebastian Müller","email":"sebastian@primeintellect.ai","when":"2026-09-07T05:14:48+02:00"},"committer":{"name":"GitHub","email":"noreply@github.com","when":"2026-09-06T23:14:48-04:00"},"message":"fix: improve Windows session and Python reliability (#2036)\n\n* fix(coding-agent): resolve the kernel venv python under Scripts on win32\n\nuv creates /Scripts/python.exe on Windows, but both bootstrap sites\njoined /bin/python unconditionally, so first-run kernel bootstrap\nalways failed on native Windows. Mirror the existing win32 uv.exe branch\nwith one kernelVenvPython helper used at both sites.\n\n* fix(coding-agent): expand ~/ with the platform path separator\n\nTilde expansion concatenated homedir() with the posix remainder at three\nsites (expandPath, expandTildePath, and an inline PI_PACKAGE_DIR copy),\nproducing mixed-separator paths like C:\\Users\\u/rest on Windows. Join\nthrough the platform path module instead and route PI_PACKAGE_DIR through\nexpandTildePath.\n\n* fix(coding-agent): prefer non-System32 bash over the WSL trampoline on PATH\n\nfindBashOnPath took the first where-match, and System32\\bash.exe (the WSL\nlauncher, which executes Linux-side) precedes per-user Git Bash installs on\ndefault PATHs. Order matches so %SystemRoot% entries are only a last\nresort.\n\n* fix(coding-agent): dial the Herdr socket inside the named-pipe namespace on win32\n\nThe built-in Herdr reporter connected to the exported unix-style socket\npath verbatim; on Windows a local-domain connection must target\n\\\\.\\pipe\\, and the reporter swallows connect errors by design, so the\nmismatch was invisible. Map unmapped paths into the pipe namespace before\ndialing.\n\n* fix(coding-agent): cache the win32 process start id per pid for a short TTL\n\ngetWindowsProcessStartId spawns a synchronous powershell query that blocks\nthe event loop, and supervisor liveness checks plus daemon-ps poll loops\ncall it repeatedly for the same pid. Memoize successful ids for 5s so hot\npaths reuse one query.\n\n* fix(coding-agent): derive handshake budgets from the outer connect deadline\n\nconnectWorker granted every hello/worker_auth attempt a fixed 1s clock, so\na handshake that consistently needs longer (slow win32 boxes) failed every\nretry regardless of the 30s outer budget, and the adopt/recover paths\nshrank even the outer budget to 1.5-2s. Per-attempt waits now consume the\nremaining outer deadline, all connectWorker callers use the one 30s\nconstant, and the downward 1s hello/auth overrides in daemon-mode and the\nrouted client fall back to the client defaults.\n\n* fix(coding-agent): route background spawns through hidden-window wrappers\n\nwindowsHide defaults to false, so console-subsystem children of a\nwindowless daemon or detached worker allocate a fresh console and flash or\nsteal focus on every spawn; only one call site in the repo set the flag.\nAdd spawnHidden/spawnSyncHidden/execSyncHidden/execFileHidden/\nexecFileSyncHidden to utils/child-process.ts and migrate all 49\nnon-interactive coding-agent spawn/exec sites; the tui package's two\nbackground spawns set windowsHide inline. Interactive spawns (editors,\ninherit-stdio installers and relaunches) intentionally keep their console.\n\n* chore(coding-agent): add windows-seams changelog fragments; tighten new comments\n\n* test(coding-agent): align clipboard and login-dialog spawn assertions with hidden-window wrappers\n\n* revert(coding-agent): drop the win32 start-id TTL cache\n\nThe per-pid cache could hand a recycled pid the dead process's start id\nfor up to 5s. The start id exists solely to detect pid recycling, and its\nconsumers act on that identity: the orphan-process journal decides\ntaskkill /T from it and daemon-ps shutdown waits poll it for change, so a\nstale match can kill a replacement process tree or mask an exited owner.\nNo caller is both hot and staleness-tolerant; the handshake latency issue\nis already addressed by deriving budgets from the outer deadline.\n\n* fix(coding-agent): match Herdr pipe-namespace prefixes case-insensitively\n\nWindows pipe names are case-insensitive, but the pass-through check was\ncase-sensitive, so a valid \\\\.\\PIPE\\... target was re-joined into a\ndifferent pipe name and the error-swallowing reporter failed silently.\nLowercase only the prefix check; the returned path keeps its casing.\n\n* refactor(coding-agent): tighten windows-seam comments and consolidate pins\n\nCollapse the wrapper doc block to one line, drop test comments that restate\nassertions, share one recording wrapper in the child-process mock, unwrap\nsingle-test describes, and remove one posix assertion already covered by\nits sibling. No behavior coverage removed; all pins keep their failing\nassertions.\n\n* fix(coding-agent,tui): harden current-runtime Windows sessions\n\nImport selective Bun-independent fixes from #1994 at\nce2d04f872ae7df567e68695aa258a1a5cdf254c, relative to declared\n#1982 base 9680ac3dfa8bdafae0f9e53286e2274d8b9c9090.\n\nPreserve #2036 Windows seams and current Node runtime. Keep Bun,\ninstaller, shell-policy rollout, scratch directories, and CPython\nbatch overrides outside this consolidation. #1994 remains partial.\nAtomic writer and bootstrap-lock overlap awaits canonical #2035\nreconciliation after parent stacks land.\n\n* fix(coding-agent): normalize Windows bash candidate paths\n\n---------\n\nCo-authored-by: Seth ","tree":"d8a9dec4332c83f71b05ba702c027932cab8ac19"}},{"name":"daemon-socket-path.ts","mode":"0100644","size":350,"lastCommit":{"hash":"8189b12d6c2f2912326aa369d5d12533ba9d91b5","oid":"8189b12d6c2f2912326aa369d5d12533ba9d91b5","parents":["824a9ee3b51e839c5daefa7fe5adf9e7333a8428"],"author":{"name":"Sebastian Müller","email":"sebastian@primeintellect.ai","when":"2026-08-18T23:04:58+02:00"},"committer":{"name":"GitHub","email":"noreply@github.com","when":"2026-08-18T14:04:58-07:00"},"message":"Normalize daemon socket paths before deriving identity (#1520)\n\n* fix(coding-agent): normalize daemon socket paths at every entry point, fixes ENG-5303\n\n* fix(coding-agent): address review findings on socket-path normalization\n\n- Defer --daemon-socket normalization until after --cwd applies so relative\n socket paths resolve against the requested working directory\n- Migrate legacy raw-spelling worker-descriptor namespaces to the canonical\n directory on supervisor construction so existing workers stay adoptable\n- Consolidate the remaining private normalizers (package-manager-cli,\n daemon-update-restart) onto the shared normalizeSocketPath\n- Wait for killed test supervisors to exit before removing their directories\n to fix ENOTEMPTY flakes in CI\n\n* fix(coding-agent): harden descriptor-namespace adoption and test cleanup\n\n- Adopt a raw-spelling descriptor namespace only after the socket-path lease\n and registry ownership are held, so a rejected startup can never move a live\n supervisor's directory\n- Skip unreadable JSON entries per file when identifying a namespace instead\n of aborting the whole scan\n- Drop migration-era vocabulary from the helper names and test titles\n- Disable the Node compile cache for spawned test supervisors and tolerate\n cleanup races so worker processes exiting late cannot fail the suite\n\n* refactor(coding-agent): drop the descriptor-namespace adoption machinery\n\nNormalization at the entry points prevents namespace forks going forward;\ndescriptors written under an old raw-spelling key are healed per-field on\nload only when they share the directory. Cross-directory adoption kept\naccreting ordering hazards (live-daemon rename races, persisted-config\nstaleness) disproportionate to its value, so a daemon that previously ran\non a non-canonical spelling simply starts fresh namespaces; saved sessions\nare unaffected (they live in the session catalog, not the descriptor dir).\n\n* docs(coding-agent): align the changelog with the simplified scope\n\n* chore(coding-agent): trim excessive comments\n\n* fix(coding-agent): normalize the early-launch socket key and drop an incidental test\n\nmaybeStartDaemonEarly memoized ensure attempts under the raw --daemon-socket\nspelling while main uses the normalized one, so equivalent spellings could\nrun two concurrent spawn attempts for one daemon. The early kick now derives\nthe same canonical spelling (resolving relative paths against --cwd).\n\n* chore(coding-agent): simplify socket normalization coverage\n\n* Address final review feedback\n\n---------\n\nCo-authored-by: Seth ","tree":"aa150d23cddc0693506a579ff01093b262a50aab"}},{"name":"dir-lock.ts","mode":"0100644","size":6834,"lastCommit":{"hash":"6b8fbd8b0831e14a085634ea8a395b60d8041c3b","oid":"6b8fbd8b0831e14a085634ea8a395b60d8041c3b","parents":["bebad881b47634cff2ea4322af7c151b19fd8536"],"author":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-17T20:40:32+03:00"},"committer":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-17T20:40:32+03:00"},"message":"fix(coding-agent): harden kernel bootstrap lock, staging checks, import isolation and postinstall\n","tree":"767a07c6a52e923488e9f09d266afbb76094c9ac"}},{"name":"exif-orientation.ts","mode":"0100644","size":5262,"lastCommit":{"hash":"844e85545af6858dcb3d6cfe42bbfcf2ca0be4e5","oid":"844e85545af6858dcb3d6cfe42bbfcf2ca0be4e5","parents":["915c78f42c248b08238dd27fcd4bcab32c60beab"],"author":{"name":"Sebastian Müller","email":"sebastian@primeintellect.ai","when":"2026-09-07T03:56:32+02:00"},"committer":{"name":"GitHub","email":"noreply@github.com","when":"2026-09-06T21:56:32-04:00"},"message":"Harden session persistence, worker recovery, and daemon refreshes (#2028)\n\n* refactor(coding-agent): move the semantic-edge ledger onto the event-log substrate\n\nThe recorder's private append/replay/repair IO is deleted; EventLog owns it, the same move #1987 made for the RLM spawn ledger. One durability rule is unified in the substrate rather than dropped: an unterminated final line is an uncommitted append, skipped on read and truncated before the next append — never newline-completed and never surfaced to a consumer whose next append destroys it.\n\n* fix(coding-agent): make the explicit ledger reader's ENOENT contract atomic\n\nreadSemanticEdgeLedger probed with statSync before reading through EventLog, which swallows ENOENT; a ledger deleted between the two returned [] instead of throwing. The missing-file decision now lives at the single open (replaySync missingFileThrows), so no check-then-read window exists.\n\n* docs(coding-agent): state the event-log tail rule once\n\nThe unterminated-tail contract was restated four times (module doc, replaySync doc, two test comments). It now lives once in the module doc; the method doc keeps only its own parse/missing-file semantics and the test comments reference the contract.\n\n* fix(coding-agent): write event-log appends fully and gate appends on tail repair\n\nwriteSync may write short (ENOSPC after a prefix); appendSync now loops until the payload is fully on disk so write-before-action callers never act on a torn record reported as success. A tail-repair failure (e.g. append-only ACL permitting O_APPEND but not r+) now propagates instead of being swallowed: writing through an unrepaired torn tail would weld it to the new record as permanent interior corruption. ENOENT and the concurrent-writer instability path keep their existing semantics.\n\n* fix(coding-agent): reclaim short event-log writes instead of completing them\n\nThe rlm spawn ledger is multi-writer by documented design (supervisor plus each worker over one file), so completing a short O_APPEND write with a second write could interleave with a rival append and weld two records. A short write now truncates its own torn prefix back off (only while this writer still owns the tail) and fails the append; a torn tail is read-tolerated, a weld is permanent corruption. The append fd opens a+ so the ownership check can read the tail.\n\n* fix(coding-agent): leave the torn tail on a short write instead of reclaiming it\n\nThe tail-match reclaim could truncate a rival's committed record whose final bytes coincide with our torn prefix - committed-data loss, strictly worse than the torn tail it prevented. A short write now just fails the append: the torn tail is the one tolerated shape, skipped on read and truncated by any writer's next repair (verified for both topologies: a resumed single-writer recorder repairs on its first append; every rlm-ledger writer repairs before each append).\n\n* refactor(coding-agent): compress event-log comments\n\n* fix(ai): omit the default service tier, reprice cache writes from message_delta, repoint the zai default\n\nIncorporates #2032 at f82c7fa3688b7e25cef80e2663fe77ed153c5cd9.\n\n* fix(tui,coding-agent): survive lone surrogates in table cells and terminate the WebP EXIF scan\n\nIncorporates #2033 at a3d1139ee6e1f77337ab134b0f0c0cede8c942af.\n\n* fix(coding-agent): restart dead kernels on ensure() and read mcp>=2 tool schemas\n\nIncorporates #2034 at 749e216e901304b310ead9f46c3813a032608d7b.\n\n* fix: one crash-safe owner for durable state writes\n\nIncorporates #2035 at f0f02d2fb090ec427307a65b9e9578ae3c8fc783.\n\n* fix(coding-agent): one zombie-aware process-liveness probe\n\nIncorporates #2041 at 92a0eacf47efc831444b0b4e412f35bd17ac3f28.\n\n* fix(coding-agent): snapshot transfer ids from the materialized cursor; mismatches settle the transfer, not the worker channel\n\nIncorporates #2044 at 5af3bbe8090240507d6b0297d0da007159e15305.\n\n* fix(coding-agent): failed workers recover on touch; roster gaps answer a structured recovering error\n\nIncorporates #2047 at 77b747afab402a9e2f5eada227ffe6fed626a634.\n\n* fix(coding-agent): seven session and IO correctness defects\n\nIncorporates #2037 at 41b5d72d7758723f22ba07f8738d217868ed7baf.\n\n* fix(coding-agent): coalesce child-usage attribution and gate agent-status persistence on real changes\n\nIncorporates #2050 at 6b0af5d2679ddff987ef3b4d43235a872fe2b315.\n\n* fix(coding-agent): incremental single-flight session metadata scans\n\nIncorporates #2043 at df032c1192dd2e38d35fcbaca589db7194f26b6c.\n\n* fix(coding-agent): memoize the passive RLM topology derivation\n\nIncorporates #2051 at 0ee114ce77942d9298136ca193ddc2c0b5d27d58.\n\n* fix(coding-agent): preserve accounting and metadata across deferred updates\n\nKeep durable child-usage aggregates separate from pending sibling usage. Retry optional topology metadata after transient reads. Completes #2050 and #2051 integration.\n\n* fix: preserve session accounting and read-only persistence boundaries\n\n---------\n\nCo-authored-by: Seth ","tree":"fde2f307a92f71b52dffbe1ec5232617702f5b62"}},{"name":"file-lines.ts","mode":"0100644","size":2778,"lastCommit":{"hash":"844e85545af6858dcb3d6cfe42bbfcf2ca0be4e5","oid":"844e85545af6858dcb3d6cfe42bbfcf2ca0be4e5","parents":["915c78f42c248b08238dd27fcd4bcab32c60beab"],"author":{"name":"Sebastian Müller","email":"sebastian@primeintellect.ai","when":"2026-09-07T03:56:32+02:00"},"committer":{"name":"GitHub","email":"noreply@github.com","when":"2026-09-06T21:56:32-04:00"},"message":"Harden session persistence, worker recovery, and daemon refreshes (#2028)\n\n* refactor(coding-agent): move the semantic-edge ledger onto the event-log substrate\n\nThe recorder's private append/replay/repair IO is deleted; EventLog owns it, the same move #1987 made for the RLM spawn ledger. One durability rule is unified in the substrate rather than dropped: an unterminated final line is an uncommitted append, skipped on read and truncated before the next append — never newline-completed and never surfaced to a consumer whose next append destroys it.\n\n* fix(coding-agent): make the explicit ledger reader's ENOENT contract atomic\n\nreadSemanticEdgeLedger probed with statSync before reading through EventLog, which swallows ENOENT; a ledger deleted between the two returned [] instead of throwing. The missing-file decision now lives at the single open (replaySync missingFileThrows), so no check-then-read window exists.\n\n* docs(coding-agent): state the event-log tail rule once\n\nThe unterminated-tail contract was restated four times (module doc, replaySync doc, two test comments). It now lives once in the module doc; the method doc keeps only its own parse/missing-file semantics and the test comments reference the contract.\n\n* fix(coding-agent): write event-log appends fully and gate appends on tail repair\n\nwriteSync may write short (ENOSPC after a prefix); appendSync now loops until the payload is fully on disk so write-before-action callers never act on a torn record reported as success. A tail-repair failure (e.g. append-only ACL permitting O_APPEND but not r+) now propagates instead of being swallowed: writing through an unrepaired torn tail would weld it to the new record as permanent interior corruption. ENOENT and the concurrent-writer instability path keep their existing semantics.\n\n* fix(coding-agent): reclaim short event-log writes instead of completing them\n\nThe rlm spawn ledger is multi-writer by documented design (supervisor plus each worker over one file), so completing a short O_APPEND write with a second write could interleave with a rival append and weld two records. A short write now truncates its own torn prefix back off (only while this writer still owns the tail) and fails the append; a torn tail is read-tolerated, a weld is permanent corruption. The append fd opens a+ so the ownership check can read the tail.\n\n* fix(coding-agent): leave the torn tail on a short write instead of reclaiming it\n\nThe tail-match reclaim could truncate a rival's committed record whose final bytes coincide with our torn prefix - committed-data loss, strictly worse than the torn tail it prevented. A short write now just fails the append: the torn tail is the one tolerated shape, skipped on read and truncated by any writer's next repair (verified for both topologies: a resumed single-writer recorder repairs on its first append; every rlm-ledger writer repairs before each append).\n\n* refactor(coding-agent): compress event-log comments\n\n* fix(ai): omit the default service tier, reprice cache writes from message_delta, repoint the zai default\n\nIncorporates #2032 at f82c7fa3688b7e25cef80e2663fe77ed153c5cd9.\n\n* fix(tui,coding-agent): survive lone surrogates in table cells and terminate the WebP EXIF scan\n\nIncorporates #2033 at a3d1139ee6e1f77337ab134b0f0c0cede8c942af.\n\n* fix(coding-agent): restart dead kernels on ensure() and read mcp>=2 tool schemas\n\nIncorporates #2034 at 749e216e901304b310ead9f46c3813a032608d7b.\n\n* fix: one crash-safe owner for durable state writes\n\nIncorporates #2035 at f0f02d2fb090ec427307a65b9e9578ae3c8fc783.\n\n* fix(coding-agent): one zombie-aware process-liveness probe\n\nIncorporates #2041 at 92a0eacf47efc831444b0b4e412f35bd17ac3f28.\n\n* fix(coding-agent): snapshot transfer ids from the materialized cursor; mismatches settle the transfer, not the worker channel\n\nIncorporates #2044 at 5af3bbe8090240507d6b0297d0da007159e15305.\n\n* fix(coding-agent): failed workers recover on touch; roster gaps answer a structured recovering error\n\nIncorporates #2047 at 77b747afab402a9e2f5eada227ffe6fed626a634.\n\n* fix(coding-agent): seven session and IO correctness defects\n\nIncorporates #2037 at 41b5d72d7758723f22ba07f8738d217868ed7baf.\n\n* fix(coding-agent): coalesce child-usage attribution and gate agent-status persistence on real changes\n\nIncorporates #2050 at 6b0af5d2679ddff987ef3b4d43235a872fe2b315.\n\n* fix(coding-agent): incremental single-flight session metadata scans\n\nIncorporates #2043 at df032c1192dd2e38d35fcbaca589db7194f26b6c.\n\n* fix(coding-agent): memoize the passive RLM topology derivation\n\nIncorporates #2051 at 0ee114ce77942d9298136ca193ddc2c0b5d27d58.\n\n* fix(coding-agent): preserve accounting and metadata across deferred updates\n\nKeep durable child-usage aggregates separate from pending sibling usage. Retry optional topology metadata after transient reads. Completes #2050 and #2051 integration.\n\n* fix: preserve session accounting and read-only persistence boundaries\n\n---------\n\nCo-authored-by: Seth ","tree":"fde2f307a92f71b52dffbe1ec5232617702f5b62"}},{"name":"frontmatter.ts","mode":"0100644","size":1188,"lastCommit":{"hash":"844e85545af6858dcb3d6cfe42bbfcf2ca0be4e5","oid":"844e85545af6858dcb3d6cfe42bbfcf2ca0be4e5","parents":["915c78f42c248b08238dd27fcd4bcab32c60beab"],"author":{"name":"Sebastian Müller","email":"sebastian@primeintellect.ai","when":"2026-09-07T03:56:32+02:00"},"committer":{"name":"GitHub","email":"noreply@github.com","when":"2026-09-06T21:56:32-04:00"},"message":"Harden session persistence, worker recovery, and daemon refreshes (#2028)\n\n* refactor(coding-agent): move the semantic-edge ledger onto the event-log substrate\n\nThe recorder's private append/replay/repair IO is deleted; EventLog owns it, the same move #1987 made for the RLM spawn ledger. One durability rule is unified in the substrate rather than dropped: an unterminated final line is an uncommitted append, skipped on read and truncated before the next append — never newline-completed and never surfaced to a consumer whose next append destroys it.\n\n* fix(coding-agent): make the explicit ledger reader's ENOENT contract atomic\n\nreadSemanticEdgeLedger probed with statSync before reading through EventLog, which swallows ENOENT; a ledger deleted between the two returned [] instead of throwing. The missing-file decision now lives at the single open (replaySync missingFileThrows), so no check-then-read window exists.\n\n* docs(coding-agent): state the event-log tail rule once\n\nThe unterminated-tail contract was restated four times (module doc, replaySync doc, two test comments). It now lives once in the module doc; the method doc keeps only its own parse/missing-file semantics and the test comments reference the contract.\n\n* fix(coding-agent): write event-log appends fully and gate appends on tail repair\n\nwriteSync may write short (ENOSPC after a prefix); appendSync now loops until the payload is fully on disk so write-before-action callers never act on a torn record reported as success. A tail-repair failure (e.g. append-only ACL permitting O_APPEND but not r+) now propagates instead of being swallowed: writing through an unrepaired torn tail would weld it to the new record as permanent interior corruption. ENOENT and the concurrent-writer instability path keep their existing semantics.\n\n* fix(coding-agent): reclaim short event-log writes instead of completing them\n\nThe rlm spawn ledger is multi-writer by documented design (supervisor plus each worker over one file), so completing a short O_APPEND write with a second write could interleave with a rival append and weld two records. A short write now truncates its own torn prefix back off (only while this writer still owns the tail) and fails the append; a torn tail is read-tolerated, a weld is permanent corruption. The append fd opens a+ so the ownership check can read the tail.\n\n* fix(coding-agent): leave the torn tail on a short write instead of reclaiming it\n\nThe tail-match reclaim could truncate a rival's committed record whose final bytes coincide with our torn prefix - committed-data loss, strictly worse than the torn tail it prevented. A short write now just fails the append: the torn tail is the one tolerated shape, skipped on read and truncated by any writer's next repair (verified for both topologies: a resumed single-writer recorder repairs on its first append; every rlm-ledger writer repairs before each append).\n\n* refactor(coding-agent): compress event-log comments\n\n* fix(ai): omit the default service tier, reprice cache writes from message_delta, repoint the zai default\n\nIncorporates #2032 at f82c7fa3688b7e25cef80e2663fe77ed153c5cd9.\n\n* fix(tui,coding-agent): survive lone surrogates in table cells and terminate the WebP EXIF scan\n\nIncorporates #2033 at a3d1139ee6e1f77337ab134b0f0c0cede8c942af.\n\n* fix(coding-agent): restart dead kernels on ensure() and read mcp>=2 tool schemas\n\nIncorporates #2034 at 749e216e901304b310ead9f46c3813a032608d7b.\n\n* fix: one crash-safe owner for durable state writes\n\nIncorporates #2035 at f0f02d2fb090ec427307a65b9e9578ae3c8fc783.\n\n* fix(coding-agent): one zombie-aware process-liveness probe\n\nIncorporates #2041 at 92a0eacf47efc831444b0b4e412f35bd17ac3f28.\n\n* fix(coding-agent): snapshot transfer ids from the materialized cursor; mismatches settle the transfer, not the worker channel\n\nIncorporates #2044 at 5af3bbe8090240507d6b0297d0da007159e15305.\n\n* fix(coding-agent): failed workers recover on touch; roster gaps answer a structured recovering error\n\nIncorporates #2047 at 77b747afab402a9e2f5eada227ffe6fed626a634.\n\n* fix(coding-agent): seven session and IO correctness defects\n\nIncorporates #2037 at 41b5d72d7758723f22ba07f8738d217868ed7baf.\n\n* fix(coding-agent): coalesce child-usage attribution and gate agent-status persistence on real changes\n\nIncorporates #2050 at 6b0af5d2679ddff987ef3b4d43235a872fe2b315.\n\n* fix(coding-agent): incremental single-flight session metadata scans\n\nIncorporates #2043 at df032c1192dd2e38d35fcbaca589db7194f26b6c.\n\n* fix(coding-agent): memoize the passive RLM topology derivation\n\nIncorporates #2051 at 0ee114ce77942d9298136ca193ddc2c0b5d27d58.\n\n* fix(coding-agent): preserve accounting and metadata across deferred updates\n\nKeep durable child-usage aggregates separate from pending sibling usage. Retry optional topology metadata after transient reads. Completes #2050 and #2051 integration.\n\n* fix: preserve session accounting and read-only persistence boundaries\n\n---------\n\nCo-authored-by: Seth ","tree":"fde2f307a92f71b52dffbe1ec5232617702f5b62"}},{"name":"fs-watch.ts","mode":"0100644","size":573,"lastCommit":{"hash":"f3a2c9d05e5b4e7921347da2fbf0c807aff92fb3","oid":"f3a2c9d05e5b4e7921347da2fbf0c807aff92fb3","parents":["cc76e73c05bdbbb6efb285353a91980606313472"],"author":{"name":"Mario Zechner","email":"badlogicgames@gmail.com","when":"2026-04-22T23:03:19+02:00"},"committer":{"name":"Mario Zechner","email":"badlogicgames@gmail.com","when":"2026-04-22T23:03:19+02:00"},"message":"fix(coding-agent,mom): retry fs watchers on async errors closes #3564\n","tree":"8c3ca1f3a752e7f2f6a4a08d9c9aad8495d887a9"}},{"name":"git.ts","mode":"0100644","size":7895,"lastCommit":{"hash":"2ce443175b55a32075aa23ae41676a16b771d662","oid":"2ce443175b55a32075aa23ae41676a16b771d662","parents":["8a1e958008894705326de541b48e7d158b49ac4f"],"author":{"name":"Sebastian Müller","email":"sebastian@primeintellect.ai","when":"2026-09-07T05:14:48+02:00"},"committer":{"name":"GitHub","email":"noreply@github.com","when":"2026-09-06T23:14:48-04:00"},"message":"fix: improve Windows session and Python reliability (#2036)\n\n* fix(coding-agent): resolve the kernel venv python under Scripts on win32\n\nuv creates /Scripts/python.exe on Windows, but both bootstrap sites\njoined /bin/python unconditionally, so first-run kernel bootstrap\nalways failed on native Windows. Mirror the existing win32 uv.exe branch\nwith one kernelVenvPython helper used at both sites.\n\n* fix(coding-agent): expand ~/ with the platform path separator\n\nTilde expansion concatenated homedir() with the posix remainder at three\nsites (expandPath, expandTildePath, and an inline PI_PACKAGE_DIR copy),\nproducing mixed-separator paths like C:\\Users\\u/rest on Windows. Join\nthrough the platform path module instead and route PI_PACKAGE_DIR through\nexpandTildePath.\n\n* fix(coding-agent): prefer non-System32 bash over the WSL trampoline on PATH\n\nfindBashOnPath took the first where-match, and System32\\bash.exe (the WSL\nlauncher, which executes Linux-side) precedes per-user Git Bash installs on\ndefault PATHs. Order matches so %SystemRoot% entries are only a last\nresort.\n\n* fix(coding-agent): dial the Herdr socket inside the named-pipe namespace on win32\n\nThe built-in Herdr reporter connected to the exported unix-style socket\npath verbatim; on Windows a local-domain connection must target\n\\\\.\\pipe\\, and the reporter swallows connect errors by design, so the\nmismatch was invisible. Map unmapped paths into the pipe namespace before\ndialing.\n\n* fix(coding-agent): cache the win32 process start id per pid for a short TTL\n\ngetWindowsProcessStartId spawns a synchronous powershell query that blocks\nthe event loop, and supervisor liveness checks plus daemon-ps poll loops\ncall it repeatedly for the same pid. Memoize successful ids for 5s so hot\npaths reuse one query.\n\n* fix(coding-agent): derive handshake budgets from the outer connect deadline\n\nconnectWorker granted every hello/worker_auth attempt a fixed 1s clock, so\na handshake that consistently needs longer (slow win32 boxes) failed every\nretry regardless of the 30s outer budget, and the adopt/recover paths\nshrank even the outer budget to 1.5-2s. Per-attempt waits now consume the\nremaining outer deadline, all connectWorker callers use the one 30s\nconstant, and the downward 1s hello/auth overrides in daemon-mode and the\nrouted client fall back to the client defaults.\n\n* fix(coding-agent): route background spawns through hidden-window wrappers\n\nwindowsHide defaults to false, so console-subsystem children of a\nwindowless daemon or detached worker allocate a fresh console and flash or\nsteal focus on every spawn; only one call site in the repo set the flag.\nAdd spawnHidden/spawnSyncHidden/execSyncHidden/execFileHidden/\nexecFileSyncHidden to utils/child-process.ts and migrate all 49\nnon-interactive coding-agent spawn/exec sites; the tui package's two\nbackground spawns set windowsHide inline. Interactive spawns (editors,\ninherit-stdio installers and relaunches) intentionally keep their console.\n\n* chore(coding-agent): add windows-seams changelog fragments; tighten new comments\n\n* test(coding-agent): align clipboard and login-dialog spawn assertions with hidden-window wrappers\n\n* revert(coding-agent): drop the win32 start-id TTL cache\n\nThe per-pid cache could hand a recycled pid the dead process's start id\nfor up to 5s. The start id exists solely to detect pid recycling, and its\nconsumers act on that identity: the orphan-process journal decides\ntaskkill /T from it and daemon-ps shutdown waits poll it for change, so a\nstale match can kill a replacement process tree or mask an exited owner.\nNo caller is both hot and staleness-tolerant; the handshake latency issue\nis already addressed by deriving budgets from the outer deadline.\n\n* fix(coding-agent): match Herdr pipe-namespace prefixes case-insensitively\n\nWindows pipe names are case-insensitive, but the pass-through check was\ncase-sensitive, so a valid \\\\.\\PIPE\\... target was re-joined into a\ndifferent pipe name and the error-swallowing reporter failed silently.\nLowercase only the prefix check; the returned path keeps its casing.\n\n* refactor(coding-agent): tighten windows-seam comments and consolidate pins\n\nCollapse the wrapper doc block to one line, drop test comments that restate\nassertions, share one recording wrapper in the child-process mock, unwrap\nsingle-test describes, and remove one posix assertion already covered by\nits sibling. No behavior coverage removed; all pins keep their failing\nassertions.\n\n* fix(coding-agent,tui): harden current-runtime Windows sessions\n\nImport selective Bun-independent fixes from #1994 at\nce2d04f872ae7df567e68695aa258a1a5cdf254c, relative to declared\n#1982 base 9680ac3dfa8bdafae0f9e53286e2274d8b9c9090.\n\nPreserve #2036 Windows seams and current Node runtime. Keep Bun,\ninstaller, shell-policy rollout, scratch directories, and CPython\nbatch overrides outside this consolidation. #1994 remains partial.\nAtomic writer and bootstrap-lock overlap awaits canonical #2035\nreconciliation after parent stacks land.\n\n* fix(coding-agent): normalize Windows bash candidate paths\n\n---------\n\nCo-authored-by: Seth ","tree":"d8a9dec4332c83f71b05ba702c027932cab8ac19"}},{"name":"image-convert.ts","mode":"0100644","size":1062,"lastCommit":{"hash":"738319e465f5a03f8ffba5924c9f10dd490b517b","oid":"738319e465f5a03f8ffba5924c9f10dd490b517b","parents":["bd2c3ab67ee08b8febd573cfe2ebc7bcfa5ea0be"],"author":{"name":"Melih Mucuk","email":"melih@monkeysteam.com","when":"2026-03-13T19:44:14+03:00"},"committer":{"name":"GitHub","email":"noreply@github.com","when":"2026-03-13T17:44:14+01:00"},"message":"fix(coding-agent): Fix EXIF orientation for JPEG and WebP images (#2105)\n\n* fix(coding-agent): apply EXIF orientation correction during image convert and resize\n\n* docs(coding-agent): add PR reference to changelog entry","tree":"ec15d163ff32d86425ecb578ea457858862bada4"}},{"name":"image-resize.ts","mode":"0100644","size":5376,"lastCommit":{"hash":"3e5ad67e0f325d4888f82f9b82966218eb4407f5","oid":"3e5ad67e0f325d4888f82f9b82966218eb4407f5","parents":["801db80b65210b25462bce1700675e073fe3dbe5"],"author":{"name":"Mario Zechner","email":"badlogicgames@gmail.com","when":"2026-05-07T15:59:42+02:00"},"committer":{"name":"Mario Zechner","email":"badlogicgames@gmail.com","when":"2026-05-07T15:59:42+02:00"},"message":"chore: migrate pi packages to earendil works scope\n","tree":"e9426bc02876b5d4e3bbfbe07a1567300bc8a931"}},{"name":"mime.ts","mode":"0100644","size":819,"lastCommit":{"hash":"6e929e1560143d3d6fba8f36cda51bbc99301954","oid":"6e929e1560143d3d6fba8f36cda51bbc99301954","parents":["bb6ede7251429a67d04e4f19844b98a007088e74"],"author":{"name":"kt","email":"kevin.jt2007@gmail.com","when":"2026-06-26T18:43:51-07:00"},"committer":{"name":"GitHub","email":"noreply@github.com","when":"2026-06-26T18:43:51-07:00"},"message":"load on-disk images into model context via attach-media skill (#274)\n\n* add attach-media skill to load on-disk images into context\n\n* declare attachments on ipython tool details\n\n* address review: fix console-script name, emit attachments atomically, guard sizes\n\n* stream attachment encoding one image at a time\n\n* clarify vision-unsupported error to prompt telling the user\n\n* rename skill to attach-image and trim skill description\n\n* document attachment size-cap invariant so skill images are never silently dropped\n\n* add live-kernel integration test for attach-image skill\n\n* fail loudly on oversized attachment instead of silent drop","tree":"3f8cf49e380110b23db22202db6779c6d71e86c4"}},{"name":"native-installation.ts","mode":"0100644","size":5668,"lastCommit":{"hash":"ebe299ee599d2e7444c034d1b38af38808036e74","oid":"ebe299ee599d2e7444c034d1b38af38808036e74","parents":["ebe530d28c9f24fb03353085c05a68dcd29e7fbc"],"author":{"name":"kt","email":"kevin.jt2007@gmail.com","when":"2026-09-15T11:43:17-07:00"},"committer":{"name":"GitHub","email":"noreply@github.com","when":"2026-09-15T14:43:17-04:00"},"message":"publish musl and baseline linux archives so linux stops falling back to node (#2344)\n\n* publish musl and baseline linux archives so linux stops falling back to node\n\nAdds linux-arm64-musl, linux-x64-baseline, linux-x64-musl, and\nlinux-x64-musl-baseline to the compiled release set, and teaches the\ninstaller to select them from the host's libc and CPU flags.\n\n* name the missing libstdc++ package instead of routing musl hosts to node\n\nCompiled musl archives link libstdc++, which Alpine does not preinstall. On a\nbare Alpine host the probe failed, the installer printed sixty raw relocation\nerrors and then `the compiled executable cannot run on this machine`, which is\nfalse: one `apk add --no-cache libstdc++` makes the same binary run. With the\ndefault auto method it was worse - the installer announced the Node fallback and\nthen died on `Node.js 20.6.0 or newer is required`, telling a bare-Alpine user to\ninstall Node when the real fix is a 2 MB package.\n\nThe installer now recognises that loader failure (the named library, or musl's\nC++ relocation signature), hides the relocation wall, and prints three lines\nnaming the package and the Alpine command.\n\nAuto mode deliberately stops there instead of falling back to Node: the host can\nrun the compiled build, so downloading a 377 MB Node installation is the wrong\ndefault, and on the most common musl host that fallback cannot even succeed.\n`PRIME_AGENT_INSTALL_METHOD=node` remains the explicit escape hatch and is named\nin the message. Every other probe failure keeps the previous behaviour, including\nthe auto fallback to Node.\n\nSecond fix, same path: a failed first install left `.managed` plus empty `bin/`\nand `releases/` behind, so a later run saw a managed native root with no\nexecutable. The root is now given back when this run adopted it and never\nactivated a release; a root an earlier successful install owns, or one holding\nanything else, is left alone.\n\nVerified on a real bare arm64 alpine:3.21 container against a local release feed\nbefore and after the change, including that the install still succeeds after\n`apk add --no-cache libstdc++`.","tree":"cd829a56d727d06ff1342f1df16790984b7f8680"}},{"name":"paths.ts","mode":"0100644","size":1845,"lastCommit":{"hash":"3421726e8629d4cd344e75b94bdf9d7412dfddca","oid":"3421726e8629d4cd344e75b94bdf9d7412dfddca","parents":["783e96a14431e9cb33299d8c5e162cc5ad6e7c69"],"author":{"name":"Armin Ronacher","email":"armin.ronacher@active-4.com","when":"2026-05-08T00:16:28+02:00"},"committer":{"name":"Armin Ronacher","email":"armin.ronacher@active-4.com","when":"2026-05-08T00:16:28+02:00"},"message":"fix(coding-agent): disambiguate resource paths\n","tree":"4bc7530213e9ea757a5185cd5d1ab789f91666d9"}},{"name":"photon.ts","mode":"0100644","size":3659,"lastCommit":{"hash":"964f17b8d164d900edf4097f5f4a0f8a37929b10","oid":"964f17b8d164d900edf4097f5f4a0f8a37929b10","parents":["61833b3dc94aa5d5cf470aed33518851cfda98b9"],"author":{"name":"Mario Zechner","email":"badlogicgames@gmail.com","when":"2026-01-18T17:11:31+01:00"},"committer":{"name":"Mario Zechner","email":"badlogicgames@gmail.com","when":"2026-01-18T17:11:49+01:00"},"message":"fix(coding-agent): load photon wasm in compiled binaries\n","tree":"a602d77d9574c44a77c7bd772113968224dace11"}},{"name":"pi-user-agent.ts","mode":"0100644","size":244,"lastCommit":{"hash":"a04350e4a7b96cdf1835d387a1cc3e55ad2426fe","oid":"a04350e4a7b96cdf1835d387a1cc3e55ad2426fe","parents":["22583b24d50a8bf637d898ddb4355ca094e0291f"],"author":{"name":"Kevin Thomas","email":"kevin.jt2007@gmail.com","when":"2026-05-19T15:47:12-07:00"},"committer":{"name":"GitHub","email":"noreply@github.com","when":"2026-05-19T15:47:12-07:00"},"message":"switch update checks to prime agent releases (#49)\n\n* fix(coding-agent): use prime update manifest\n\n* fix(coding-agent): remove pi telemetry from update flow\n\n* fix(coding-agent): avoid redundant tarball self-updates\n\n* fix(coding-agent): use manifest install spec for forced updates\n\n* fix(coding-agent): clean up old package after tarball rename","tree":"146430bdd9a74c67635709c81df5b713579de323"}},{"name":"piped-stdin.ts","mode":"0100644","size":3975,"lastCommit":{"hash":"4535c87e5112f1c976b6f6dabb831f0d2ef93edf","oid":"4535c87e5112f1c976b6f6dabb831f0d2ef93edf","parents":["5362cf3005126f9413a610eb9b610eb34a07c258"],"author":{"name":"Seth Karten","email":"32787133+sethkarten@users.noreply.github.com","when":"2026-09-13T16:59:35-04:00"},"committer":{"name":"GitHub","email":"noreply@github.com","when":"2026-09-13T22:59:35+02:00"},"message":"[RSI] fix(coding-agent): guard stdin reads in non-interactive mode (#2285)\n\n* fix(coding-agent): guard non-interactive stdin reads against held-open pipes\n\nNon-interactive parents (daemon workers, agent harnesses, CI runners) spawn this CLI with a stdin pipe they never write to and never close; the boot-time piped-stdin read waited for end forever. readPipedStdin now bounds the read with a short idle window (PI_STDIN_TIMEOUT_MS, default 250ms), handles read errors, and pauses stdin on give-up so later bytes stay buffered. The cross-project resume fork confirm, daemon attach, and the deprecation keypress wait now fail fast or skip without a TTY instead of blocking on reads that can never be answered.\n\n* fix(coding-agent): honor --json for non-interactive daemon open\n\ndaemon open always attached after create and ignored --json, so the new non-TTY attach guard left open callers no working machine-readable path. runOpen now prints the created session summary (matching daemon create --json) and skips the attach terminal when --json is set. Regression tests cover the non-TTY attach error and the --json open path.","tree":"eaf78fe5b20a7972851f8922de0ef861d2f046d7"}},{"name":"semaphore.ts","mode":"0100644","size":1701,"lastCommit":{"hash":"a556dfde8274b175178129af227fd0d32d253eb3","oid":"a556dfde8274b175178129af227fd0d32d253eb3","parents":["fdac4bf7f5aa3e8715e438f20b142b78f59e4de5"],"author":{"name":"kt","email":"kevin.jt2007@gmail.com","when":"2026-06-30T18:05:13-07:00"},"committer":{"name":"GitHub","email":"noreply@github.com","when":"2026-06-30T18:05:13-07:00"},"message":"bound subagent kernel-boot concurrency (#294)\n\n* bound subagent kernel-boot concurrency\n\nGate IPython kernel boots behind a process-wide semaphore so a large\nrlm.run fan-out no longer spawns every kernel at once and starves the\nbox. Runs start queued and flip to running on slot acquire; default\nlimit is cpus-2, overridable via PRIME_AGENT_MAX_CONCURRENT_SUBAGENT_BOOTS.\n\n* move kernel-boot gate to the real boot; raise default limit\n\nGate the actual kernel boot inside the lazy IPython provisioner (start +\nrestore + bootstrap) instead of subagent runtime creation, so session\ncreation is never delayed -- only the first IPython boot waits for a slot.\nThe boot weight is the cold Python interpreter + import graph, not the\nports; default limit is now min(16, 2*cores), override via\nPRIME_AGENT_MAX_CONCURRENT_KERNEL_BOOTS.\n\n* trim comments to non-obvious why-notes only\n\n* hold boot permit only across bounded start(); harden env override\n\n* make semaphore acquire abortable so a queued waiter can drop out\n\n* cancel a disposed provisioner's queued kernel boot\n\n* fall back to default for out-of-range boot-concurrency env (e.g. 00)","tree":"74fcd4fd8924fbacb228b739e73f9ed7e177e90c"}},{"name":"shell.ts","mode":"0100644","size":9075,"lastCommit":{"hash":"766ddce2ce03b61636e8c10223542e9b3a534802","oid":"766ddce2ce03b61636e8c10223542e9b3a534802","parents":["9150cc28a3e1989b44ce5070910d1c7cfb052340"],"author":{"name":"Seth Karten","email":"32787133+sethkarten@users.noreply.github.com","when":"2026-09-13T16:59:15-04:00"},"committer":{"name":"GitHub","email":"noreply@github.com","when":"2026-09-13T22:59:15+02:00"},"message":"[RSI] Make agent-spawned shells non-interactive-safe by default (#2219)\n\n* fix(shell): make agent-spawned shells non-interactive-safe by default\n\nAgent shells never have a usable stdin (stdio: [\"ignore\", \"pipe\", \"pipe\"]),\nbut commands still open interactive prompts through /dev/tty: git commit\nwithout -m launches $EDITOR (vim grabs the TTY and hangs the session until\nkilled), git credential prompts block, pagers read the terminal directly.\nThis is a recurring operator failure mode (four duplicate lessons in this\nagent's own harness history) that every agent re-learns.\n\nSet non-interactive defaults at both shell env choke points: getShellEnv()\nin packages/coding-agent (bash tool, user ! commands, remote\nBashOperations) and _child_env() in prime-agent-runtime/src/rlm/bash.py\n(kernel bash):\n\n GIT_EDITOR=true GIT_TERMINAL_PROMPTS=0 EDITOR=true VISUAL=true\n PAGER=cat GIT_PAGER=cat DEBIAN_FRONTEND=noninteractive\n\nThe overrides deliberately replace inherited terminal settings (an\nEDITOR=vim inherited from the launching shell is exactly the hang we are\npreventing; stdin is ignored even for user ! commands, so an interactive\neditor can never receive keystrokes anyway). Per-command escape hatch is\nunchanged: inline assignment (`GIT_EDITOR=vim git commit`) takes\nprecedence over exported vars.\n\nTests: getShellEnv unit coverage (defaults, override-not-honor semantics,\nunrelated vars preserved) and runtime coverage (_child_env unit + a real\nspawned bash echoing the env).\n\n* fix(shell): close the remaining interactive-credential escape hatches\n\nReview follow-up for the non-interactive shell defaults. Three inherited\nvariables could still hang or block a stdin-less agent shell:\n\n- GIT_SEQUENCE_EDITOR outranks GIT_EDITOR for the `git rebase -i` todo\n list, so an inherited vim still hung interactive rebases.\n- GIT_ASKPASS runs even with GIT_TERMINAL_PROMPTS=0 for authenticated\n HTTP git operations, so an inherited GUI or blocking helper still hung\n credential asks. `true` fails them fast with empty credentials.\n- SSH_ASKPASS_REQUIRE=force makes OpenSSH run SSH_ASKPASS without a\n terminal, so encrypted-key asks blocked git fetch/push. `never` fails\n them fast instead.\n\nSame overrides in both choke points (getShellEnv and _child_env); also\ndrop a comment block that was pasted twice above the defaults.\n\nTests extend the existing env assertions (they fail on the pre-fix code)\nand the spawned-shell echo.","tree":"8a8be8a93c5f1b1099ca9c5ae5903c12a9b3b930"}},{"name":"sleep.ts","mode":"0100644","size":402,"lastCommit":{"hash":"f9eb190ef953bbd87207955342a84bdd74d0029f","oid":"f9eb190ef953bbd87207955342a84bdd74d0029f","parents":["254c00b78825dc2f506960b81f1a4929fb2ebd9b"],"author":{"name":"Mario Zechner","email":"badlogicgames@gmail.com","when":"2026-01-24T01:38:58+01:00"},"committer":{"name":"Mario Zechner","email":"badlogicgames@gmail.com","when":"2026-01-24T01:38:58+01:00"},"message":"refactor(coding-agent): simplify AgentSession\n","tree":"d0a767556e10b2fb9b95cfc86e04daa2e23a294f"}},{"name":"tools-manager.ts","mode":"0100644","size":13741,"lastCommit":{"hash":"a584201e8f472806873357e95741905e3d86e7d3","oid":"a584201e8f472806873357e95741905e3d86e7d3","parents":["9fedf07e857c4d01373a42ae0d136be3fdded2d3"],"author":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-09T19:36:07+03:00"},"committer":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-17T06:20:35+03:00"},"message":"perf(coding-agent): cache resolved tool paths and reuse UI services across session hops\n","tree":"22cab681b3f00d0ce9e63adf06e0dbd9ab82dd09"}},{"name":"version-check.ts","mode":"0100644","size":9423,"lastCommit":{"hash":"e9d68d92c58492fe554c843ba90f894bcff3fe66","oid":"e9d68d92c58492fe554c843ba90f894bcff3fe66","parents":["8d64d3e1cd1b16dc77a736126f8757673138d0b7"],"author":{"name":"kt","email":"kevin.jt2007@gmail.com","when":"2026-09-15T15:28:12-07:00"},"committer":{"name":"GitHub","email":"noreply@github.com","when":"2026-09-15T15:28:12-07:00"},"message":"make release manifest parsing forward-compatible (#2370)\n\n* fix: make release manifest parsing forward-compatible\n\nUnknown future platform entries in the release manifest no longer cause\nvalid known binary entries to be discarded. The parser now skips unknown\nplatforms while keeping strict validation for known ones (duplicates, bad\nfilenames, bad sha256 still reject).\n\nClient-facing manifests (beta.json / latest.json) now advertise only the\nfour legacy platforms (darwin-arm64, darwin-x64, linux-arm64, linux-x64)\nso pre-fix clients are not bricked by the new musl and baseline archive\nentries. All eight archives remain built, checksummed, and present in\nSHA256SUMS for the installer.\n\n* fix: publish versioned binary manifests","tree":"bd6441fb87a237b983cc8b3d2a312da61ca5ecbf"}}],"lastCommit":{"hash":"6b8fbd8b0831e14a085634ea8a395b60d8041c3b","oid":"6b8fbd8b0831e14a085634ea8a395b60d8041c3b","parents":["bebad881b47634cff2ea4322af7c151b19fd8536"],"author":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-17T20:40:32+03:00"},"committer":{"name":"dawn","email":"90008@klbr.net","when":"2026-09-17T20:40:32+03:00"},"message":"fix(coding-agent): harden kernel bootstrap lock, staging checks, import isolation and postinstall\n","tree":"767a07c6a52e923488e9f09d266afbb76094c9ac"}}