- Unified all package, runtime, CLI documentation, and distribution metadata
to version
v1.0.0, including the Python and npm packages. - Compatibility: runtime protocols and persisted schema versions are unchanged.
- Verification: version consistency checks, compile/import smoke checks, and targeted CLI checks passed.
- Added vivid semantic colors for human interactive output, including success, warning, error, phase, evidence, and transaction cues.
- Added
NO_COLOR=1andFORGECODE_THEME=minimal|noneplain-output modes; JSON/JSONL output is unchanged. - Verification: interactive rendering tests and Python compile check passed.
- Expanded documentation with CLI, configuration/provider, security, session recovery, extension, RPC schema, testing, troubleshooting, and contributing guides.
- Updated the public capability baseline and package version to
v0.9.0. - Compatibility: runtime protocols and safety behavior are unchanged; this is a documentation-focused release.
- Verification: documentation link scan, version consistency, and compile/ import smoke checks passed.
- Plan protocol hardening: non-text Act approval reasons now fail with a
structured
PlanErrorinstead of leaking slicing/type exceptions. - Verification: structured-plan tests, compile, and diff checks passed.
- Memory identity hardening: workspace memory reads now detect regular file replacement by comparing device/inode identity as well as size and timestamps.
- Verification: memory regression tests, compile, and diff checks passed; a manual identity-replacement simulation raised the expected error.
- Session identity hardening: durable session reads now compare device and inode identity in addition to size and timestamps, detecting regular-file replacement during inspection.
- Verification: targeted lifecycle regression, compile, diff checks, and manual replacement-identity simulation passed.
- Shell result resilience: normalize non-string or unrenderable subprocess output before bounded rendering so extension/mocked runners cannot trigger an internal formatting exception.
- Verification: command-boundary tests, compile, diff checks, and manual broken-output rendering passed.
- Cancellation resilience: cancellation remains effective when an extension supplies a reason object whose string conversion raises.
- Verification: provider protocol tests, compile, diff checks, and manual broken-reason cancellation validation passed.
- Cancellation audit hardening: cancellation reasons are normalized to a single line before being retained in diagnostics and session metadata.
- Verification: provider protocol tests, compile, diff checks, and a manual newline/tab normalization check passed.
- Request correlation hardening: provider request IDs now reject control characters before they enter telemetry, retry metadata, or audit records.
- Verification: provider regression tests, compile, diff checks, and a manual newline-injection check passed.
- Provider credential boundary: API keys are now type-checked and reject control characters and oversized values before entering HTTP headers.
- Verification: provider/config regression tests, compile, and diff checks passed; newline injection was manually rejected.
- Configuration fail-closed parsing: malformed
FORGECODE_OFFLINEvalues now raise a configuration error instead of silently disabling offline mode and potentially enabling network access. - Verification: environment/config regression tests, compile, and diff checks passed; malformed-value behavior was manually reproduced.
- Tool-policy completeness: configuration validation now accepts every tool registered by the runtime, including quality, metadata, Git commit, and background-process tools.
- Verification: configuration regression tests, compile, and diff checks
passed; manually loaded a policy allowing
process_status,test, andfile_metadata.
- Demo verification compatibility fix: removed an over-strict final deadline gate in
run_commandthat could classify a completed offline verification as failed when the overall run budget elapsed during result assembly. - Verification: affected CLI, recovery, workflow, extension, and RPC tests passed after reproducing the regression.
- RPC session write-path hardening: session persistence now validates the destination directory and target file against symlink/junction aliases before and after directory creation.
- Verification: RPC lifecycle tests, compile, and diff checks passed.
- RPC session directory integrity: persisted session loading now rejects records when the
rpc-sessionsparent directory is a symlink or junction alias, closing a workspace-boundary replacement gap. - Verification: RPC session lifecycle tests, compile, and diff checks passed.
- Background status boundaries: process status, polling, and listing now honor cancellation and active deadlines while preserving the legacy context-free status API.
- Verification: background-tool regression tests passed after correcting context-free compatibility, with compile and diff checks clean.
- Command deadline finalization:
run_commandnow rejects successful-looking subprocess output when final result assembly crosses an active run deadline. - Verification: command-boundary and cancellation tests, compile, and diff checks passed.
- Responsive file listing:
list_filesnow polls cancellation and deadlines while traversing dense directories, reducing control latency when a single directory contains many entries. - Verification: command-boundary and security tests, compile, and diff checks passed.
- Filesystem scan responsiveness:
read_fileandsearchnow enforce post-read deadline checks and poll cancellation/deadlines while matching lines in large files. - Verification: filesystem/security command tests, compile, and diff checks passed.
- Quality-check deadline correctness: test and diagnostics tools now discard subprocess results only when an actual run deadline is configured and has expired, preserving normal no-deadline behavior while preventing stale successes after expiry.
- Verification: command-boundary tests, compile, and diff checks passed; an initial regression exposed and was corrected during validation.
- Git inspection deadline consistency: status, diff, and log tools now discard subprocess output if the run deadline expires during command execution, preventing stale success results after timeout.
- Verification: targeted command-boundary tests, compile, and diff checks passed.
- Bounded source navigation scans: definition, reference, and hover tools now exclude source files above the shared 2 MiB safety limit before loading them, preventing unbounded memory use during repository-wide scans.
- Verification: focused understanding-tool tests, compile, and diff checks passed.
- Post-read deadline enforcement: understanding and metadata tools now reject results when blocking file I/O crosses the run deadline, keeping expiration semantics consistent before and after reads.
- Verification: understanding and command-boundary tests passed; compile and diff checks passed.
- Responsive code navigation cancellation: symbol, definition, reference, and hover scans now poll cancellation and deadlines while traversing large files, bounding response latency after content loading.
- Verification: focused understanding-tool tests passed; full regression gate remains green at 667 passed and 14 platform-conditional skips.
- Byte-accurate navigation limits: range and symbol readers now enforce the 2 MiB limit on raw bytes before UTF-8 decoding, including CRLF and multibyte files.
- Verification: command-boundary tests, compile checks, and manual CRLF-size inspection passed.
- Navigation alias safety: range reads and symbol listing now reject symlink/junction aliases, aligning all source-reading tools with the workspace path policy.
- Verification: command-boundary tests, compile checks, and manual alias inspection passed (symlink test is platform-conditional).
- Metadata read consistency:
file_metadatanow compares file identity before and after reading, rejecting concurrent replacement or modification instead of reporting mixed metadata. - Verification: command-boundary tests, compile checks, and manual metadata race review passed.
- Navigation read TOCTOU guard: range and symbol readers now validate decoded content size after reading, closing growth races after the initial file-size check.
- Verification: command-boundary tests, compile checks, and manual oversized-navigation inspection passed.
- Metadata alias safety:
file_metadatanow rejects symlink and junction aliases, matchingread_fileand preventing metadata from silently describing a different target path. - Verification: command-boundary tests, compile checks, and manual alias inspection passed (symlink test is platform-conditional).
- Understanding read limits:
read_rangeandlist_symbolsnow reject files over the shared 2 MiB safety limit before loading full contents. - Verification: command-boundary tests, compile checks, and manual oversized-source inspection passed.
- Metadata TOCTOU guard:
file_metadatanow validates the bytes actually read, closing the race where a file grows after the initial size check. - Verification: command-boundary tests, compile checks, and manual post-stat growth inspection passed.
- Metadata size safety:
file_metadatanow rejects files larger than the shared 2 MiB workspace limit before reading or hashing them. - Verification: command-boundary tests, compile checks, and manual oversized-file inspection passed.
- Approval failure isolation: exceptions from custom approval policies now fail closed as a denial and still notify the approval observer for complete audit evidence.
- Verification: security/tool tests, compile checks, and manual broken-approval inspection passed.
- Policy extension isolation: exceptions from custom tool-policy
permits()callbacks now fail closed, marking the affected tool unavailable instead of aborting the agent or widening access. - Verification: tool/security tests, compile checks, and manual broken-policy inspection passed.
- Background snapshot race: task snapshots now honor the drain worker's
finishedmarker when OS polling briefly lags, preventing completed processes from being reported as running. - Verification: background-tool tests, compile checks, and manual poll-lag inspection passed.
- Patch deadline boundary:
apply_patchnow rechecks the run budget before each atomic replacement and rolls back prepared changes when the deadline expires. - Verification: command/recovery tests, compile checks, and manual expired-patch inspection passed.
- Atomic write deadline gate:
write_filenow rechecks the run budget immediately beforeos.replace, preventing a prepared temporary file from becoming a committed workspace mutation after deadline expiry. - Verification: command/recovery tests, compile checks, and manual deadline-write inspection passed.
- Quality output draining: cancellable test/diagnostic processes now drain stdout and stderr during polling, preventing pipe-buffer deadlocks on verbose commands; cleanup timeouts fail safely.
- Verification: quality/cancellation tests, a 2 MiB-output manual run, compile checks, and diff checks passed.
- Quality process cancellation:
testanddiagnosticsnow run in an isolated process group with polling-based cancellation and bounded process-tree cleanup instead of blocking insubprocess.run. - Verification: quality/cancellation tests, compile checks, and manual mid-run cancellation inspection passed.
- Background process-tree cleanup: background commands now run in an isolated process group/session and kill requests terminate the owned process tree with bounded cleanup and race-safe exit handling.
- Verification: background-tool tests, compile checks, and manual child-process cleanup inspection passed.
- Commit deadline boundary:
git_commitnow checks cancellation and the run deadline after approval before invoking Git, preventing expired sessions from creating commits. - Verification: command-boundary tests, compile checks, and manual expired-commit inspection passed.
- Worktree mutation deadlines: create and remove operations now recheck cancellation and run budgets after approval before touching Git state.
- Verification: command-boundary tests, compile checks, and manual expired-worktree mutation inspection passed.
- Mid-scan cancellation: symbol definition, reference, and hover searches now recheck cancellation and deadlines for every source file, stopping long scans promptly.
- Verification: command-boundary tests, compile checks, and manual navigation-boundary inspection passed.
- Worktree inspection deadlines: Git worktree listing now honors cancellation and expired run budgets before reading ownership metadata or starting Git.
- Verification: command-boundary tests, compile checks, and manual expired-worktree inspection passed.
- Symbol navigation deadlines: definition, reference, and hover tools now fail fast on cancellation or expired runs before scanning source files.
- Verification: command-boundary tests, compile checks, and manual expired-navigation inspection passed.
- Understanding-tool deadlines: bounded range reads and symbol listing now fail fast on cancellation or expired runs before touching workspace files.
- Verification: command-boundary tests, compile checks, and manual expired-understanding inspection passed.
- Navigation deadline boundaries: repository maps and file metadata now fail fast on cancellation or expired runs, avoiding unnecessary snapshot and hashing work.
- Verification: command-boundary tests, compile checks, and manual expired-navigation inspection passed.
- Read deadline boundary:
read_filenow checks cancellation and run deadlines before resolving or reading a workspace file. - Verification: command-boundary tests, compile checks, and manual expired-read inspection passed.
- Filesystem scan deadlines:
list_filesandsearchnow observe cancellation and run deadlines during traversal, stopping safely instead of continuing unbounded scans after a run ends. - Verification: command-boundary tests, compile checks, and manual expired-scan inspection passed.
- Write deadline boundary:
write_filenow checks the run deadline after approval and immediately before mutation, failing and closing any prepared transaction when the budget expires. - Verification: command-boundary tests, compile checks, and manual expired-write inspection passed.
- Recovered task observability:
list_processesnow safely renders stale tasks restored from disk even when runtime-only PID and duration fields are unavailable. - Verification: background-tool tests, compile checks, and manual stale-state inspection passed.
- Workspace-summary deadlines: summary scans now honor cancellation and run deadlines, including the nested Git status query, instead of using an unconditional five-second wait.
- Verification: command-boundary tests, compile checks, and manual expired-summary inspection passed.
- Background failure persistence: persisted task snapshots now retain
failedfor non-zero exits instead of collapsing every finished process intocompleted. - Verification: background-tool tests, compile checks, and manual persisted-state inspection passed.
- Background cleanup reliability: killing a ForgeCode-owned process now uses its independent bounded cleanup window even after the parent run deadline, so successful termination is not misreported as unresolved.
- Verification: background-tool tests, compile checks, and manual expired-deadline kill inspection passed.
- Background deadline boundary: approved background commands now fail fast when the run budget is exhausted, preventing an expired run from spawning a detached process.
- Verification: background-tool tests, compile checks, and manual no-process inspection passed.
- Quality-tool deadline diagnostics:
testanddiagnosticsnow skip process startup after the run deadline and distinguish deadline expiry from ordinary check timeouts. - Verification: command-boundary tests, compile checks, and manual expired-deadline inspection passed.
- Git deadline diagnostics: read-only Git status, diff, and log tools now fail fast with an explicit
deadline_exceededresult when the run budget is exhausted. - Verification: command-boundary tests, compile checks, and manual expired-deadline inspection passed.
- Conservative command mutation audit: command results now mark classified filesystem/repository/system-risk commands as potentially mutating, and expose a bounded
mutation_possiblesignal instead of reporting every successful command as unchanged. - Verification: command-boundary tests, compile checks, and manual risk-metadata inspection passed.
- Session-error callback isolation: callbacks invoked while reporting session append failures are now guarded against recursive callback exceptions.
- Verification: agent-edge tests, compile checks, and manual failing-session-callback inspection passed.
- Event callback isolation: exceptions from external
on_eventcallbacks no longer abort AgentLoop execution; they mark audit completeness false and emit a bounded session error when possible. - Verification: agent-edge tests, compile checks, and manual failing-callback inspection passed.
- Metadata key contract: extension tool results now require string metadata keys, preventing JSON key coercion from changing event/context field identity.
- Verification: security-edge tests, compile checks, and manual malformed-metadata inspection passed.
- Tool message serialization: reject non-JSON-safe metadata instead of coercing arbitrary objects with
default=str; emit a bounded safe marker for model context. - Verification: agent-edge tests, compile checks, and manual metadata serialization inspection passed.
- Tool result contract: require extension tools to return a boolean
ToolResult.okflag, preventing truthy string values from corrupting execution and audit semantics. - Verification: security-edge tests, compile checks, and manual malformed-result inspection passed.
- Request body bound: custom provider transport requests now reject bodies larger than 4 MiB before JSON parsing.
- Verification: provider tests, compile checks, and manual oversized-request inspection passed.
- Provider text strictness: response translators now reject non-string text/content fields instead of coercing arbitrary JSON values into assistant text.
- Verification: provider tests, compile checks, and manual malformed-content inspection passed.
- Transport scheme safety: restrict custom provider transport URLs to HTTP/HTTPS schemes before rewriting or dispatch.
- Verification: provider tests, compile checks, and manual non-HTTP URL inspection passed.
- Transport response bound: cap custom transport response bodies at 4 MiB before parsing, matching provider safety limits and reducing memory pressure.
- Verification: provider tests, compile checks, and manual oversized-body inspection passed.
- Common request validation: Ollama requests now enforce the same object-only message list contract as Anthropic and Google translations.
- Verification: provider tests, compile checks, and manual malformed-message inspection passed.
- Provider tool conversion: validate nested
functionobjects in Anthropic and Google request translation, preventing malformed schemas from raising attribute errors. - Verification: provider tests, compile checks, and manual nested-schema inspection passed.
- Request header safety: custom transport request headers now enforce bounded, non-empty string keys and values without control characters.
- Verification: provider tests, compile checks, and manual malformed-header inspection passed.
- Response body strictness: provider factory response translation now requires bytes-like bodies, matching request transport contracts.
- Verification: provider tests, compile checks, and manual malformed-response inspection passed.
- Transport URL safety: reject control characters in custom transport URLs before provider-specific rewriting or network dispatch.
- Verification: provider tests, compile checks, and manual malformed-URL inspection passed.
- HTTP status strictness: custom transport results now require an integer status code, rejecting floats and strings that could be silently coerced into valid codes.
- Verification: provider tests, compile checks, and manual status coercion inspection passed.
- Transport body strictness: custom transport results now require bytes-like response bodies instead of accepting implicit integer-to-zero-byte conversions.
- Verification: provider tests, compile checks, and manual transport coercion inspection passed.
- Transport request boundary: validate URL and header mapping types before provider-specific rewriting, preventing malformed custom calls from leaking attribute errors.
- Verification: provider tests, compile checks, and manual malformed-header inspection passed.
- Transport body validation: reject non-byte request bodies before decoding, converting malformed custom transport inputs into clear
ValueErrors. - Verification: provider tests, compile checks, and manual malformed-body inspection passed.
- Google request validation: malformed non-list or non-object tool schemas are now rejected instead of silently dropped during provider translation.
- Verification: provider tests, compile checks, and manual malformed-tool inspection passed.
- Transport header validation: constrain custom transport response headers to bounded string keys and values without control characters.
- Verification: provider tests, compile checks, and manual malformed-header inspection passed.
- Transport result validation: normalize and bound status, body, and headers returned by custom transports, converting malformed values into clear
ValueErrors. - Verification: provider tests, compile checks, and manual malformed-transport inspection passed.
- Ollama response validation: reject non-object messages and malformed tool-call arrays before provider translation.
- Verification: provider tests, compile checks, and manual malformed-message inspection passed.
- Google response validation: validate candidates, candidate content, and parts before translation, preventing leaked index/attribute errors on malformed responses.
- Verification: provider tests, compile checks, and manual malformed-candidate inspection passed.
- Anthropic response validation: reject non-list or non-object content blocks before provider translation, avoiding leaked attribute errors on malformed responses.
- Verification: provider tests, compile checks, and manual malformed-content inspection passed.
- Transport response validation: provider factory adapters now reject malformed or non-object response bodies before provider-specific field access.
- Verification: provider tests, compile checks, and manual malformed-response inspection passed.
- Transport request validation: provider factory translation now rejects malformed JSON bodies and non-object message entries before field access.
- Verification: provider tests, compile checks, and manual malformed-request inspection passed.
- Provider factory validation: Anthropic translation now rejects non-object tool schemas before field access, avoiding leaked attribute errors from malformed requests.
- Verification: provider tests, compile checks, and manual malformed-tool inspection passed.
- Outbound description bounds: wrapped and neutral tool schemas now reject oversized or control-character descriptions before network serialization.
- Verification: provider tests, compile checks, and manual malformed-description inspection passed.
- Outbound schema field validation: reject malformed wrapped function descriptions and parameter objects before request serialization.
- Verification: provider tests, compile checks, and manual malformed-schema inspection passed.
- Wrapped schema validation: validate function names inside already-wrapped OpenAI tool schemas, preventing malformed names from bypassing outbound protocol checks.
- Verification: provider tests, compile checks, and manual wrapped-schema inspection passed.
- Outbound schema validation: provider request construction now rejects non-object tool schemas with a typed protocol error instead of leaking attribute errors.
- Verification: provider regression tests, compile checks, and manual malformed-schema inspection passed.
- Extension definition safety: reject all ASCII control characters in tool names and descriptions, keeping registered extension metadata safe for logs and protocol payloads.
- Verification: security-edge regression tests, compile checks, and manual registration checks passed.
- Usage metadata safety: reject control-character usage field names in provider parsing and provider-neutral validation before they reach logs or telemetry.
- Verification: provider tests, compile checks, and manual malformed-usage inspection passed.
- Streaming index validation: reject negative tool-call fragment indexes before assembly, preventing malformed call ordering state.
- Verification: provider regression tests, compile checks, and manual malformed-stream inspection passed.
- Neutral protocol validation: custom providers now receive the same control-character and length checks for tool IDs, tool names, and tool-result correlation IDs as concrete adapters.
- Verification: provider tests, compile checks, and manual constructed-response checks passed.
- Regression correction: fixed the malformed-ID test fixture to exercise an actual newline and verified the new provider guard.
- Tool-call ID safety: reject empty, oversized, or control-character IDs in synchronous and streaming provider responses to preserve log/session correlation integrity.
- Verification: provider tests, compile checks, and manual malformed-ID inspection passed.
- Streaming protocol guard: reject non-object SSE events during chat-stream assembly with a structured protocol error.
- Verification: provider regression tests and compile checks passed.
- Tool-name log safety: reject oversized or control-character tool names before lookup, preventing malformed model data from polluting structured logs.
- Verification: command-bound regression tests and compile checks passed.
- Provider payload guard: direct chat-completion parsing now reports a protocol error for non-object JSON payloads, matching the HTTP adapter contract.
- Verification: provider regression test and compile checks passed.
- Tool name validation: malformed or empty tool-call names now return a structured error instead of triggering unhashable-key or lookup failures.
- Verification: command-bound regression tests and compile checks passed.
- Tool argument key validation: reject non-string JSON object keys before schema validation, returning a structured
invalid_argumentserror instead of raising a sorting exception. - Verification: targeted command-bound tests and compile checks passed.
- Treat
nullvalues for schema-required tool fields as missing at the registry boundary, producing consistent structured validation errors. - Verification: null-required-field regression, manual dispatch check, compileall, and diff checks passed.
- Enforced schema
requiredfields at theToolRegistryboundary, returning structured missing-field errors before tool dispatch. - Verification: required/unknown field regressions, manual registry checks, compileall, and diff checks passed.
- Enforced
additionalProperties: falseat the registry execution boundary, rejecting unknown tool-call fields before tool dispatch. - Verification: registry unknown-field regression, manual dispatch check, compileall, and diff checks passed.
- Added object-argument validation to
repository_map, aligning runtime behavior with its published schema and preventing leaked attribute errors. - Verification: invalid-input regression, manual API check, compileall, and diff checks passed.
- Hardened code-understanding source selection against symlink/junction aliases, preventing static tools from following redirected files.
- Verification: alias-path regression, manual source-selection check, compileall, and diff checks passed.
- Added object-argument validation to
workspace_summary, aligning the read-only workspace inspection tool with the common input contract. - Verification: invalid-input regression, manual API check, compileall, and diff checks passed.
- Added object-argument validation to
lsp_status, aligning the read-only discovery tool with the repository-wide tool input contract. - Verification: invalid-input regression, manual API check, compileall, and diff checks passed.
- Added strict string validation for optional code-understanding
pathfilters, preventing non-string values from leaking path resolution errors. - Verification: invalid-path regression, manual API check, compileall, and diff checks passed.
- Stopped code-understanding source scans immediately at the 500-file bound, avoiding needless traversal of the remainder of large workspaces.
- Verification: 510-file bounded-scan regression, manual traversal check, compileall, and diff checks passed.
- Centralized object-argument validation in the shared filesystem helper, hardening all code-understanding and metadata tools against malformed calls.
- Verification: six-tool invalid-input regression, manual API checks, compileall, and diff checks passed.
- Synchronized the
repository_mapJSON schema with its runtime budget bounds (minimum: 256,maximum: 100000). - Verification: schema-contract regression, targeted tests, compileall, and diff checks passed.
- Added a 100,000-character upper bound to
repository_map.budget_chars, preventing unbounded context allocation from model-supplied requests. - Verification: oversized-budget regression, manual boundary check, compileall, and diff checks passed.
- Rejected newline-bearing Git worktree
start_pointrefs to prevent approval and command-output injection through malformed metadata. - Verification: malformed-ref regression, manual API check, compileall, and diff checks passed.
- Restricted worktree ownership paths to safe workspace-relative paths, rejecting absolute, empty, and traversal components in metadata.
- Verification: malformed-path regressions, manual parser checks, compileall, and diff checks passed.
- Added object-argument validation to
git_worktrees, completing consistent malformed-input handling across Git worktree tools. - Verification: four-tool boundary regression, manual API check, compileall, and diff checks passed.
- Rejected newline-bearing worktree ownership metadata fields to prevent forged records from injecting lines into worktree output and audit text.
- Verification: malformed metadata regression, manual parser check, compileall, and diff checks passed.
- Enforced string validation for the Git diff
pathargument, preventing implicit coercion of numbers or objects into filesystem paths. - Verification: path-boundary regression, manual API check, compileall, and diff checks passed.
- Enforced strict boolean validation for
git_worktree_remove.force, preventing values such as"false"from enabling destructive--force. - Verification: non-boolean force regression, manual API check, compileall, and diff checks passed.
- Added object-argument validation to Git worktree create, remove, and reconcile tools, preventing malformed direct calls from leaking exceptions.
- Verification: three-tool boundary regression, manual API checks, compileall, and diff checks passed.
- Enforced strict boolean validation for Git status
porcelainand diffstagedflags, preventing truthiness-based command selection. - Verification: non-boolean flag regression, manual API checks, compileall, and diff checks passed.
- Added object-argument validation to
git_commit, preventing malformed direct calls from leaking attribute errors before approval handling. - Verification: commit-tool boundary regression, manual API check, compileall, and diff checks passed.
- Added object-argument validation to Git status, diff, and log inspection tools, preventing leaked attribute errors on malformed direct calls.
- Verification: three-tool invalid-input regression, manual API checks, compileall, and diff checks passed.
- Serialized background state snapshots with the manager's re-entrant lock,
preventing inconsistent
_items/_stalereads during concurrent persistence. - Verification: concurrent persistence regression, background tests, compileall, and diff checks passed.
- Added consistent object-argument validation to all core filesystem tools, preventing leaked attribute errors on malformed direct calls.
- Verification: four-tool invalid-input regression, manual API checks, compileall, and diff checks passed.
- Converted background process startup failures into structured tool results,
preventing
run_backgroundfrom leaking spawn exceptions into the agent loop. - Verification: injected startup failure regression, manual tool invocation, compileall, and diff checks passed.
- Hardened
kill_processagainst a process-exit race, returning structuredalready_exitedortermination_failedresults instead of leaking OS exceptions. - Verification: injected
ProcessLookupErrorregression, manual termination race check, compileall, and diff checks passed.
- Protected stale background-task lookups with the manager lock, preventing races between snapshot reads and concurrent task cleanup.
- Verification: concurrent unknown-task snapshot regression, manual stress check, compileall, and diff checks passed.
- Enforced task-ID validation in public
ProcessManager.get()andsnapshot()APIs, preventing unhashable or newline-bearing values from leaking internal errors or ambiguous lookups. - Verification: manager API boundary regression, background tests, compileall, and diff checks passed.
- Preserved command risk metadata on quality-tool approval-denied and cancellation results, improving auditability of early exits.
- Verification: denial metadata regression, manual approval-path check, compileall, and diff checks passed.
- Enforced non-empty, newline-safe string task IDs across process status, polling, and termination tools instead of coercing arbitrary values.
- Verification: task-ID boundary regression, manual API checks, compileall, and diff checks passed.
- Validated
ProcessManager.start()working directories as existing, path-like, non-alias directories before spawning child processes. - Verification: invalid-root regression, manual directory boundary check, compileall, and diff checks passed.
- Added object-argument validation to
list_processes, completing consistent malformed-input handling across all background process tools. - Verification: five-tool invalid-input regression, compileall, and diff checks passed.
- Filtered sensitive environment variables in direct
ProcessManagerchild processes, closing a credential-leakage bypass outside the tool wrapper. - Verification: injected-secret manual check, background tests, compileall, and diff checks passed.
- Enforced destructive-command blocking inside
ProcessManager.start(), so direct manager callers cannot bypass the background tool safety boundary. - Verification: direct
git clean -xfdrejection, background tests, compileall, and diff checks passed.
- Added consistent object-argument validation across all background process tools, preventing leaked attribute errors on malformed direct calls.
- Verification: four-tool invalid-input regression, manual API checks, compileall, and diff checks passed.
- Added explicit object validation to test and diagnostics tool entrypoints,
replacing leaked
AttributeErrorfailures with actionable input errors. - Verification: direct
None/non-object checks, command tests, compileall, and diff checks passed.
- Filtered sensitive environment variables from test and diagnostics subprocesses, closing a credential-leakage bypass through quality tools.
- Verification: injected-secret manual check, command tests, compileall, and diff checks passed.
- Applied the shared command risk classifier to test and diagnostics tools, blocking destructive commands before approval or execution.
- Verification: hard-block regression, manual destructive-command check, targeted command tests, compileall, and diff checks passed.
- Tightened explicit command validation for test and diagnostics tools so whitespace-only commands cannot fall through to shell execution.
- Verification: direct tool boundary checks, targeted command tests, compileall, and diff checks passed.
- Added manager-level validation for background commands, rejecting empty, non-text, and oversized commands before process creation.
- Verification: direct API boundary checks, background tests, compileall, and diff checks passed.
- Made
process_statusreturn a failed tool result for unknown task IDs, matchingpoll_processand preventing false-positive status checks. - Verification: status contract regression, manual unknown-task invocation, compileall, and diff checks passed.
- Made
process_statusderive its message and metadata from one snapshot, preventing contradictory results when a task exits between reads. - Verification: background tests, manual completion-race inspection, compileall, and diff checks passed.
- Validated direct background
snapshot()cursors as non-negative integers, preventing negative slicing and leaking internal type errors. - Verification: cursor boundary regression, background tests, compileall, and manual API checks passed.
- Hardened background state persistence by rejecting symlink/junction aliases before loading or writing task state.
- Verification: alias-path regression, background tests, compileall, and manual state-file checks passed.
- Hardened background task state persistence with unique temporary files and durable flushes before atomic replacement.
- Verification: background tool tests, compileall, diff checks, and manual concurrent state-write inspection passed.
- Hardened trust persistence by rejecting symlink/junction
.forgecodedirectories before creating or writing trust records. - Verification: alias-directory regression, targeted trust tests, and manual boundary check passed.
- Hardened trust grants with unique, flushed, fsynced temporary files so concurrent grants cannot collide or expose a partial record.
- Verification: concurrent grant regression, full pytest, compileall, and manual trust-file inspection passed.
- Serialized in-process
MemoryStoreread-modify-write mutations so concurrent callers cannot silently lose user-managed memory entries. - Verification: concurrent thread regression, full pytest suite, compileall, manual filesystem inspection, and diff checks passed.
- Hardened
ToolRegistry.filter()to preserve validated source snapshots without re-reading mutable extension definitions. - Verification: registry tests, manual post-registration mutation check, compileall, and diff checks passed.
- Added explicit path-like validation to
WorkspaceGuard, turning invalid string roots into a clear type error instead of an internal attribute error. - Verification: workspace/tool tests, manual constructor check, compileall, and diff checks passed.
- Required extension tool definitions to provide a genuine boolean
side_effectingflag, preventing truthy strings from weakening mode policy. - Verification: registry tests, manual string-flag check, compileall, and diff checks passed.
- Included
side_effectingin registered tool definition snapshots so mode filtering cannot drift when extensions mutate their definitions later. - Verification: registry/loop tests, manual side-effect mutation check, compileall, and diff checks passed.
- Made
ToolRegistry.definitions()return immutable-definition snapshots, preventing callers from mutating registered schemas through introspection. - Verification: registry/loop tests, manual definition mutation check, compileall, and diff checks passed.
- Returned deep-copied tool schemas from
ToolRegistry.schemas(), preventing callers from mutating registered provider payloads through the result. - Verification: registry tests, manual return-value mutation check, compileall, and diff checks passed.
- Made redaction secret normalization stop after the configured bound, preventing infinite generators from being consumed indefinitely.
- Verification: session/redaction tests, manual generator-bound check, compileall, and diff checks passed.
- Rejected strings and byte strings as direct redaction secret containers, preventing accidental character-by-character over-redaction.
- Verification: session/redaction tests, manual helper checks, compileall, and diff checks passed.
- Isolated registered tool schema names and descriptions from post-registration definition mutation, preventing schema lookup failures and payload drift.
- Verification: registry/CLI tests, manual definition mutation check, compileall, and diff checks passed.
- Snapshot validated tool schemas at registration time so post-registration mutation of extension-owned dictionaries cannot alter provider payloads.
- Verification: registry tests, manual schema mutation check, compileall, and diff checks passed.
- Hardened tool schema registration against recursion-depth failures by
converting
RecursionErrorinto a bounded validation error. - Verification: registry tests, manual 10,000-level schema check, compileall, and diff checks passed.
- Added strict JSON and 1 MiB size validation for registered tool parameter schemas, rejecting non-finite values and oversized provider definitions.
- Verification: registry tests, manual malformed-schema checks, compileall, and diff checks passed.
- Validated extension tool definitions during registration, bounding names and descriptions and requiring object-shaped parameter schemas.
- Verification: registry/CLI contract tests, manual malformed-definition check, compileall, and diff checks passed.
- Preserved the existing non-finite redaction marker while using a distinct marker for finite oversized floats, maintaining compatibility for clients.
- Verification: session/redaction tests, manual serialization checks, compileall, and diff checks passed.
- Normalized finite but oversized floats in recursive redaction, preventing
pathological metadata values such as
1e308from reaching JSON output. - Verification: session/redaction tests, manual JSON serialization checks, compileall, and diff checks passed.
- Aligned provider-neutral usage validation with concrete adapters by requiring bounded non-empty string field names.
- Verification: provider tests, manual malformed-key validation, compileall, and diff checks passed.
- Added oversized-integer normalization to recursive metadata redaction, preventing extreme provider/tool numbers from reaching logs or JSON output.
- Verification: session/redaction tests, manual 5,000-digit metadata check, compileall, and diff checks passed.
- Applied bounded secret-list validation directly inside
redact_text()andredact_value(), covering callers outsideToolContext. - Verification: session/redaction tests, manual direct-helper checks, compileall, and diff checks passed.
- Normalized non-finite floats in recursive redaction to a safe placeholder, fulfilling the JSON-compatible metadata contract for persisted events.
- Verification: session/redaction tests, manual JSON serialization check, compileall, and diff checks passed.
- Added bounded secret material validation to
ToolContext, limiting entries to 64 values of at most 4,096 characters before output redaction. - Verification: tool boundary tests, manual secret-limit checks, compileall, and diff checks passed.
- Added bounded newline-safe task-ID validation at the
ProcessManager.start()boundary, protecting direct and extension callers from state-key injection. - Verification: background tests, manual task-ID checks, compileall, and diff checks passed.
- Extended destructive Git push hard-blocking to short
-f,-d, and combined-fdoptions, while preserving ordinary-upushes. - Verification: command classifier tests, manual short-option variants, compileall, and diff checks passed.
- Hardened destructive Git push detection to hard-block
--mirrorand--deleteoperations alongside force pushes and force refspecs. - Verification: command classifier tests, manual destructive-push variants, compileall, and diff checks passed.
- Extended force-push hard-block detection across Git
-c key=valueglobal options, including force refspecs. - Verification: command classifier tests, manual
git -cvariants, compileall, and diff checks passed.
- Extended force-push hard-block detection across Git
--git-dirand--work-treeglobal options, including force refspecs. - Verification: command classifier tests, manual option variants, compileall, and diff checks passed.
- Hardened the tool result boundary by rejecting non-mapping metadata from extensions before redaction and output truncation.
- Verification: tool registry tests, compileall, diff checks, and manual malformed-result inspection passed.
- Bounded
ToolRegistryoutput limits to integer values from 1 through 1,000,000, rejecting booleans and unbounded memory settings. - Verification: tool registry tests, compileall, diff checks, and manual constructor-boundary validation passed.
- Hardened force-push detection to cover
git -C <repo> pushand+refspecforms, keeping irreversible repository operations at the hard-block level. - Verification: command-classifier tests, manual variant checks, compileall, and diff checks passed.
- Added a realistic bounded range for provider usage counters, rejecting
finite but pathological values such as
1e308before metrics aggregation. - Verification: provider tests, compileall, diff checks, and manual extreme finite-float validation passed.
- Applied the oversized-integer bound to provider usage counters as well as tool arguments, preventing custom providers from corrupting metrics with extreme numeric values.
- Verification: provider tests, compileall, diff checks, and manual usage boundary validation passed.
- Hardened oversized-integer validation to use
bit_length()instead of decimal conversion, ensuring extreme provider values are rejected without triggering Python's integer string-conversion exception. - Verification: provider contract tests, compileall, diff checks, and manual 5,000-digit integer validation passed.
- Added a bounded integer magnitude to provider tool arguments, preventing oversized numeric values from bypassing JSON budgets and inflating logs or downstream validation work.
- Verification: provider contract tests, compileall, diff checks, and manual oversized-integer validation passed.
- Hardened background-task state recovery with file-size, task-ID, and status bounds, and removed untrusted persisted fields from stale-task responses.
- Verification: background tool tests, compileall, diff checks, and manual malformed-state inspection passed.
- Isolated
EmbeddedSessionstderr readers by reconnect generation so stale worker diagnostics cannot contaminate a restarted session. - Verification: embedding/recovery tests, compileall, and manual reconnect diagnostics inspection passed.
- Made background task admission atomic and rejected duplicate task IDs, preventing concurrent starts from exceeding limits or replacing live tasks.
- Verification: background tool tests, compileall, and manual process-manager inspection passed.
- Bound
EmbeddedSessionreader threads to their process generation so a reconnect cannot leak stale process-exit events into the new session queue. - Verification: embedding/recovery tests, compileall, and manual reconnect queue inspection passed.
- Fixed Node
invokeStream()to close stdin for both RPC and CLI JSONL modes, preventing child processes from waiting indefinitely for EOF. - Verification: Node SDK contract test and manual child-process lifecycle inspection passed.
- Rejected negative usage counters at the provider-neutral response boundary, preventing custom providers from corrupting run metrics and diagnostics.
- Verification: provider contract tests, compileall, and manual response-path inspection passed.
- Rejected non-finite timeout values in Python embedding
session_waitandsession_events, aligning SDK validation with Node and RPC behavior. - Verification: Python embed contract tests and compileall passed.
- Added the missing Python
session_status()embedding helper and package-level export, aligning Python SDK coverage with the Node SDK and RPC contract. - Verification: Python embed contract tests, compileall, and diff checks passed.
- Added bounded finite timeout validation to the Node
sessionWaithelper, matching the Python SDK and RPC contract. - Verification: Node SDK contract, Python embed contract, and diff checks passed.
- Exposed bounded
waitand eventtypefiltering in Python and Nodesession.eventsSDK helpers, matching the underlying RPC contract. - Verification: Python/Node SDK contract tests, compileall, and diff checks passed.
- Refreshed top-level lifecycle metadata in
session.eventsafter long-poll updates so state, sequence, execution, and active flags match returned events. - Verification: targeted RPC regression, manual durable update simulation, compileall, and diff checks passed.
- Refreshed
executionmetadata insession.waitresponses after durable cross-process updates, keeping lifecycle fields internally consistent. - Verification: targeted RPC regression, manual durable update simulation, compileall, and diff checks passed.
- Hardened durable RPC refresh when a process changes state without advancing its event sequence, while preserving active in-process worker ownership.
- Verification: targeted lifecycle regressions, manual durable-state injection, compileall, and diff checks passed.
- Made long-polling RPC
session.waitandsession.eventsobserve durable cross-process updates with bounded polling while retaining condition-based in-process wakeups. - Verification: targeted lifecycle regressions, manual second-writer timing simulation, compileall, and diff checks passed.
- Added safe cross-process refresh for read-only RPC session views, allowing status, result, wait, and event polling to observe newer durable cursors.
- Verification: targeted regression, manual second-writer simulation, compileall, and diff checks passed.
- Corrected
session.waitresponses so lifecycleactive_flagsare refreshed after a run transitions to a terminal state. - Verification: targeted RPC regression, manual lifecycle simulation, compileall, and diff checks passed.
- Hardened RPC session recovery by restoring execution metadata and filtering malformed or duplicate persisted event cursors before exposing them to clients.
- Verification: targeted RPC lifecycle tests, compileall, diff checks, and a manual restart simulation with malformed events passed.
- Added a
cache_hitdiagnostic to/statusmetrics so operators can tell whether the session aggregate was reused or recomputed. - Verification: manually reviewed cache hit/miss paths and confirmed the field is additive metadata; status CLI tests and compile checks passed.
- Strengthened
/statuscache invalidation with filesystem ctime/inode identity in addition to sequence, size, and mtime. - Verification: cache-key replacement scenarios were manually reviewed; status CLI tests and compile checks passed.
- Extended
/statusmetric cache invalidation with session file size and mtime, so appends from another process become visible without stale reuse. - Verification: cache-key logic was manually reviewed for append, missing-file, and stat-error paths; existing status tests passed.
- Cached interactive
/statusaggregate metrics by the session event cursor, avoiding repeated full JSONL scans when no new events exist. - Verification: CLI status tests passed; manual review confirmed cache invalidation on append and unchanged malformed-stream diagnostics.
- Corrected live status semantics so recovery-required runs are reported as stopped rather than active.
- Verification: recovery-state regression passed; manual review checked all lifecycle states and confirmed only executing phases report active.
- Added hard step and tool-call limits to live run diagnostics so operators can distinguish normal progress from budget exhaustion.
- Verification: status snapshot regression passed; manual review confirmed the values are configuration metadata only and cannot alter enforcement.
- Added the current durable event sequence to live run snapshots, allowing clients to correlate status refreshes with incremental session reads.
- Verification: snapshot regression passed; manual review confirmed the value is sourced only from the validated session append cursor and is zero without a session.
- Reset live status counters at run entry so reusable embedded loop instances cannot report stale provider/tool activity from a prior invocation.
- Verification: status regression passed; manual review confirmed the reset occurs only after prompt validation and before repository/provider work.
- Added live provider-request and tool-call counters to the bounded run status snapshot for diagnosing retries and excessive tool activity.
- Verification: status snapshot assertions passed; manual review confirmed counters include attempted provider requests and only dispatched tool calls.
- Included RunService loop diagnostics in interactive
/statusoutput while preserving the existing controller metrics and additive machine contract. - Verification: CLI status/inspect contract tests passed; manual review checked lock ordering and idle fallback behavior.
- Exposed the bounded live run snapshot through
RunService, including startup and pending-control state for CLI/RPC clients. - Verification: service status unit test and manual startup/idle race review.
- Added a bounded AgentLoop status snapshot with lifecycle, step, timing, steering, cancellation, and audit fields for live diagnostics.
- Verification: targeted
tests/test_loop.py -k status_snapshotpassed; manual review confirmed no prompts, tool arguments, paths, or secrets are exposed by the snapshot.
- Added interactive
/memorymanagement so users can inspect, add, remove, or clear workspace memory without leavingfccor involving the model. - Multi-word additions are preserved and invalid actions fail with bounded usage guidance.
- Manually verified interactive dispatch and reran focused controls/memory tests.
- Added bounded workspace-local user memory with explicit
memory add/show/remove/clearcommands. - Memory is atomically persisted, schema-checked, isolated under
.forgecode, injected as untrusted context, and never exposed as a model mutation tool. - Manually verified round-trip, tamper rejection, context loading, and removal.
- Added bounded
/steer <message>control for guiding an active run at its next safe model boundary without interrupting tool side effects. - Steering messages are redacted, auditable, capped, and cleared on cancellation; existing follow-up queue behavior remains unchanged.
- Manually verified a two-turn steering run and reran the focused regression suite.
- Version synchronization release for the assessment submission build.
- Verified the interactive CLI, machine-readable output modes, and local provider-independent startup path.
- Google
generateContentrequests now preserve the selected model field when translating from the provider-neutral request shape.
- Trajectory evaluation now distinguishes newly opened sessions (
not_started) and active sessions (in_progress) from genuine failures, avoiding a falsefailedstatus when no run has completed yet.
- Added bounded validation for provider capability declarations, rejecting invalid limits, malformed transport names, and duplicate transports before they reach AgentLoop or RPC diagnostics.
- Ollama responses now normalize local-model
message.tool_callsinto the provider-neutral tool-call contract for both JSON and streaming transports. - Tool IDs, names, arguments, and
tool_callsfinish reasons are preserved.
- Provider adapters now translate prior assistant tool calls and tool results
into Anthropic content blocks and Google
functionCall/functionResponseparts, preserving multi-turn tool conversations.
- Google streaming responses now normalize Gemini
functionCallparts into ForgeCode tool-call fragments and selecttool_callswhen a function call accompanies the provider'sSTOPfinish reason.
- Google provider requests now translate OpenAI-style tool schemas into
functionDeclarationsforgenerateContent. - Google
functionCallresponse parts are normalized into ForgeCode tool calls, preserving arguments and finish reasons.
- Anthropic streaming responses now normalize
tool_useblocks and incrementalinput_json_deltaarguments into the provider-neutral tool-call protocol, preserving tool IDs, names, arguments, and finish reasons. - Existing text-only streaming behavior remains compatible.
- Fixed named provider adapters so their default production transport also applies Anthropic, Google, and Ollama wire-format translation.
- Custom transports remain supported and continue to receive the same provider-specific normalization.
rpc.describenow advertises the complete bounded session event catalogue, including model, tool, verification, context, transaction, and recovery events already returned bysession.events.- The catalogue is observational metadata only and does not grant permissions.
- Model progress, request, and response events now share a stable bounded
turn_id, allowing RPC/session clients to correlate each model turn without depending on provider-specific request IDs. - Existing event fields and provider request identities remain unchanged.
- RPC session status now includes bounded
active_flags(turn_in_progress,paused, orrecovery_required) while preserving the existing state field. - Flags are descriptive metadata only and do not grant control or execution.
- Provider capabilities now advertise transport modes (
json, andssewhen streaming is enabled), making protocol negotiation explicit without claiming unsupported WebSocket support.
- Added
/queue, a read-only interactive view of pending follow-up capacity and worker activity; queued message contents are intentionally not exposed.
- Approval audit events now carry a stable risk
scope, normalizeddecision, and the policy decision source alongside the existing bounded arguments. - This is additive observability only; approval, plan, trust, and WorkspaceGuard enforcement remain unchanged.
session.eventsnow reportshas_more, allowing clients to distinguish an exhausted cursor from a bounded page that needs another request.
- RPC session event responses now include stable
event_id,session, andschema_versionmetadata while preserving existing event payloads and cursors. - Event identity is derived from the session handle and monotonic sequence, making client polling and deduplication deterministic.
rpc.describenow publishes a versioned session event schema and the stable event type catalog used bysession.eventspolling.- The catalog is explicitly forward-compatible with unknown future event types.
session.eventssupports bounded long-polling withwait(0–30 seconds), waking when a new event is persisted while preserving cursor semantics.- Completion and failure paths now notify event waiters without changing worker isolation or side-effect approval behavior.
session.eventsnow accepts an optional boundedtypefilter, making RPC event polling cursor-friendly without streaming unbounded data.- Responses echo the filter and retain existing
after,limit, and truncation metadata for deterministic clients.
rpc.describenow publishes an explicit approval capability catalog: supported modes, granular risk scopes, and unsupported Codex-style domains are separated.- Clients can negotiate safety behavior without mistaking capability discovery for authorization; existing workspace and approval checks remain authoritative.
- RPC session recovery now validates persisted lifecycle states; unknown future
values are restored as
recovery_requiredinstead of ambiguous active states. - Added regression coverage for forward-incompatible state records.
- Serialized AgentLoop pause/resume flag access across the worker thread and event loop, reducing approval-boundary races that could incorrectly cancel an interactive task.
- The pause behavior remains cooperative and fail-closed; no side effect runs while an interactive pause is pending.
- RPC session recovery now validates that persisted
session_pathis a workspace-local relative.jsonlpath under.forgecode/sessions. - External, traversal, malformed, or otherwise unsafe paths are ignored before a session can be restored.
- Hardened RPC session recovery with a 512 KiB record-size limit, alias rejection, and minimum workspace/mode/session schema validation.
- Oversized, malformed, or symlinked records are ignored rather than loaded into the daemon session table.
- Added read-only
git_worktree_reconcileto compare actual Git worktrees with ForgeCode ownership records and report healthy, unmanaged, missing-path, or mismatched entries without mutating either source. - Registered the tool in the read-only policy, RPC capability catalog, and AgentLoop parallel allowlist.
rpc.describenow exposes a bounded built-in tool capability catalog with risk groups and side-effect markers, while explicitly stating that active policies may narrow the catalog and that discovery is not authorization.- Added machine-contract coverage for tool capability discovery.
- Added a 256 KiB bound and strict key/value validation when reading managed worktree ownership metadata.
- Oversized or malformed state now fails closed with a structured tool error before JSON parsing can consume unbounded input.
- Worktree listing and removal now convert invalid or aliased ownership metadata into bounded structured tool errors instead of leaking exceptions into the agent loop.
- Added regression coverage for the fail-closed metadata alias boundary.
- Hardened managed worktree ownership persistence with atomic replacement and process-local serialization, preventing partial JSON state during concurrent or interrupted updates.
- Worktree ownership metadata is now updated with a bounded, same-directory
temporary file,
fsync, and atomic replace under an in-process lock. - Interrupted or concurrent updates cannot expose a partially written JSON state file; temporary artifacts are cleaned up on failure.
- Worktree creation now records bounded, non-sensitive session ownership
metadata in
.forgecode/worktrees.json. - Worktree listing surfaces managed names and run IDs, while removal rejects a mismatched session owner and cleans the record after successful removal.
- Added approved
git_worktree_createandgit_worktree_removetools for isolated, workspace-local lifecycles under.forgecode/worktrees. - Creation and removal remain unavailable in plan mode, are classified under the changes risk group, and reject unsafe names before Git runs.
- Added
lsp_status, a bounded read-only capability discovery tool that reports common language-server executables onPATHwithout starting processes or claiming full LSP support. - Registered the tool in the default registry and read-only execution policy, with regression coverage for its discovery-only contract.
- Extended bounded read-only batch parallelism to
git_worktreesandsymbol_hover, preserving serial execution for mixed or side-effecting calls. - Added regression coverage for the new read-only batch members.
- Fixed
rpc.describerequest-id handling so capability discovery follows the same bounded replay and idempotency contract as other JSONL RPC methods. - Added regression coverage for repeated capability requests.
- Static
symbol_hovernow recognizes common JavaScript/TypeScript arrow function and exported variable definitions. - Results remain bounded and explicitly marked as static precision.
- Exposed
rpc_describe()through the Python embedding API and package-level exports, matching the JSONLrpc.describecapability discovery method. - Added embedding contract coverage without changing session execution.
- Added read-only
rpc.describecapability discovery with protocol version, session controls, and explicit safety guarantees. - Existing JSONL RPC methods and request/replay semantics remain unchanged.
- Human
/toolsoutput is now grouped by risk category and marks side-effecting tools, making the permission boundary visible at a glance. - Machine-readable tool output remains unchanged.
- Added
symbol_hover, a bounded static symbol definition/context tool that safely degrades when no definition is found and explicitly reportsprecision = "static". - Included the tool in read-only policy and discovery surfaces.
- Added the read-only
git_worktreestool to inspect bounded worktree paths, branches, and HEADs without creating, switching, or mutating worktrees. - The listing is workspace-validated and capped at 64 entries.
- Included
git_worktreesin theread_onlyrisk group and configuration validation so policy filtering and tool discovery stay consistent.
- Approval audit events now identify whether a scoped allow/deny or the global fallback policy made the decision, improving explainability without logging commands, file contents, or credentials.
- Added optional
[approval_scopes]configuration for per-domainallow,ask, ordenydecisions across changes, execution, and evidence tools. - Existing global approval modes remain compatible; scoped decisions are exposed in policy diagnostics without exposing credentials.
- Background task metadata is persisted under
.forgecodewithout commands or output; tasks observed after a process restart are reported asstaleand explicitly non-recoverable instead of being replayed. - Added bounded persistence and restart-safety regression coverage.
- CLI tool policy now accepts audited risk groups (
read_only,changes,execution, andevidence) and expands them to the available exact tools. - Group expansion preserves existing unknown-tool, duplicate, overlap, and registry-narrowing checks; configuration files continue to use exact names.
- Added parser regression coverage for allow and deny group usage.
- Read-only batch scheduling now stays serial whenever lifecycle hooks are configured, preserving hook ordering and avoiding concurrent hook state.
- Added regression coverage for the hook-enabled safety fallback.
- Optional streaming now falls back to JSON when a gateway returns HTTP 404, 405, or 501 for the SSE endpoint; required streaming remains fail-closed.
- Added regression coverage for HTTP capability fallback.
- AgentLoop now fails fast when a provider is configured to require streaming but explicitly reports streaming unsupported, with a bounded capability mismatch result and audit event.
- Added regression coverage for required-stream capability negotiation.
- Tool inventory output now shows an explicit total count in human and machine responses, making capability discovery consistent with the registered set.
kill_processnow distinguishes already-exited, confirmed termination, and unresolved termination after a bounded wait instead of reporting cancellation optimistically.- Added regression coverage for confirmed termination metadata.
- Removed the full command from successful
run_backgroundtool metadata; task IDs and status remain visible while command arguments stay out of model context and structured tool results. - Added regression coverage for startup metadata non-disclosure.
- Removed command text from
list_processessummaries so task discovery cannot expose credentials or other sensitive command arguments. - Added regression coverage for command-argument non-disclosure.
- Bounded background-process history to prevent completed task metadata from growing without limit during long-lived sessions; active tasks are never evicted.
- Added regression coverage for history eviction and active-task protection.
- Synchronized the interactive and machine tool inventories after adding
list_processes; it is exposed as a read-only capability in/tools.
- Added a bounded
list_processesbackground-task tool for discovering active and completed tasks without replaying captured output.
- Hardened background task observability with a 64-task active limit, strict output accounting, bounded line truncation, process IDs, and stable elapsed duration after completion.
- Added regression coverage for hard output bounds and stable completion state.
- Provider capability declarations are now enforced before a tool-enabled
request: an explicit
tool_calling=falseprovider fails fast with a bounded capability-mismatch result instead of sending an incompatible request. - Model request audit events now include the provider capability snapshot.
- Added regression coverage for fail-fast capability negotiation.
- Added guarded, bounded
find_definitionandfind_referencestools for language-neutral static navigation across common source files. - Navigation never imports or executes project code and returns structured, capped matches suitable for model context and audit output.
- Added regression coverage for definition/reference results and workspace boundaries.
- Restricted read-only parallel scheduling to an explicit audited allowlist.
- Bounded in-flight work now honors cancellation for queued calls and returns
a paired
cancelled_before_startresult for every interrupted tool call. - Added regression coverage for cancellation and protocol-safe tool pairing.
- Same-turn batches made entirely of read-only tools now run with bounded concurrency (up to four workers), while mixed or side-effecting batches stay serial. Results, call IDs, checkpoints, and audit events retain model order.
- Added regression coverage for concurrent execution and deterministic result ordering.
- Full regression gate now passes: 485 tests passed, with 8 Windows symlink-privilege skips and two collection warnings.
- Streaming providers now expose validated text deltas to the interactive renderer, making assistant prose appear progressively while preserving the complete provider response and tool-call validation.
- Completed interactive runs now summarize the actual files changed by write/patch tool results, alongside verification and timing metrics.
- Human interactive sessions now emit a bounded five-second working heartbeat during provider waits; machine JSON/JSONL output is unchanged.
/toolsmachine envelopes now include stable capability categories matching the human-readable inventory.- Quality
diagnosticsis classified as evidence in both human and machine tool inventories, matching its verification role. - Restored machine interactive result emission while keeping terminal redraw escape sequences out of JSON/JSONL transports.
/statusnow reports elapsed seconds for an active interactive run, making long provider work visible without exposing internal process details.- Active
/statussnapshots now also expose the current workflow phase and completed tool-step count for live progress dashboards. - Provider retries and failed attempts now appear in the human timeline with bounded attempt/category details, while machine audit events remain intact.
- Automatic context compaction now preserves its evidence summary as a high-priority system message when fitting the next provider request.
- Added read-only interactive
/diff, reusing the bounded Git diff path so users can inspect changes without asking the model or invoking side effects. - Slash-command completion now includes
/diff, and unknown commands provide a close-match suggestion when a typo is detected. - Completion now also suggests valid arguments for
/mode,/plan,/model, and/undo, reducing command syntax friction during live use. - Optional streaming requests now retry truncated or malformed SSE frames before surfacing an error; incomplete tool calls stay inside the provider and cannot reach the executor as partial side effects.
/statusnow retains the last completed run's duration and tool-step count, so long-task evidence remains visible after the worker returns to idle./statusnow also reports cumulative provider attempts, retries, tool calls, and context characters for the current session.- Added read-only interactive
/context, which reports bounded context-index health, stale entries, exclusions, and diagnostics without exposing source content or rebuilding the index implicitly. - Context health responses now omit full index entries and return only bounded metadata, keeping interactive and machine envelopes predictable on large repositories.
- Context health now reports bounded symbol totals and language distribution, making index quality visible without exposing source content.
- Added read-only interactive
/eventsto show the last 40 persisted event types and outcomes, making long-run progress and failures inspectable without exposing event payload contents. - Event timeline rows now include bounded relative elapsed time, making provider waits, retries, and tool activity visible at a glance.
/eventsaccepts an optional limit from 1 to 100, allowing focused inspection of the latest session activity without changing the persisted audit log.- Event failures now show their bounded error code inline in the human timeline, so common recovery causes are visible without opening the raw session log.
/eventsaccepts an optional event-kind filter (for example/events 20 error), while retaining strict bounds on query size./eventsargument completion now suggests common audit kinds and the human renderer displays the active filter explicitly./events <kind>is now a shorthand for filtering the latest 40 events, matching the completion menu and keeping the full bounded form available.- Event query callbacks retain compatibility with older embedded integrations: zero-argument callbacks continue to work while the built-in session handler receives bounded limit and kind parameters.
- Event timeline rows now include validated per-event duration when available, alongside relative position in the run.
- Empty
/eventsfilters now explicitly reportNo matching events, separating a healthy no-match query from an unavailable or unreadable audit stream. - Provider request identities retain zero-based per-turn suffixes for compatibility with existing audit consumers while the UI remains 1-based.
- Interactive Act/Bypass sessions now ask once whether the current workspace should be trusted for side effects; declining keeps the session read-only.
- Machine-readable chat output no longer receives terminal redraw escape codes.
- Added grouped, human-readable
/toolsoutput for read-only, change, execution, and evidence capabilities. - Refined completed-run summaries so verification, elapsed time, and tool-step metrics appear together as a clear outcome card.
- Opened the presentation-focused release line for a polished, legible demonstration of ForgeCode's normal agent workflow.
- Added an npm distribution wrapper that launches a bundled native ForgeCode
binary, so installed users can run
fccwithout Python or uv. - Added the Windows x64 build pipeline and package layout for future platform
binaries; the initial package is published as
@onlyslime/forgecodebecause the unscopedforgecodename is already owned by another project.
- Consolidated the historical root changelog into
docs/CHANGELOG.md. - Removed the duplicate root changelog and updated documentation references to the single canonical history location.
- Reworked public documentation into a concise English README with a linked standalone Chinese README, plus a compact assessment handoff.
- Documented
/loginas the primary connection path and removed the unused.env.exampletemplate from the public setup flow.
- Completed repository cleanup rules for local source audits and vendor clones.
- Confirmed runtime state, caches, environments, temporary files, and private goal/strategy data remain ignored and are not release artifacts.
- Started the整理-focused release line. This version entry only establishes the release baseline; functional cleanup changes will be added separately.
- Disabled fragile SSE negotiation for DeepSeek endpoints and use the bounded JSON response path, preventing incomplete tool-call argument failures.
- Simplified interactive login to exactly three prompts: endpoint URL, model ID, and API key; provider adapter is inferred internally from the URL.
- Simplified interactive connection to explicit manual Provider ID, endpoint, model ID, and API key entry with no preset values or model guesses.
- Replaced the full-screen provider dialog with an inline bounded overlay so the chat background is not repainted blue.
- Provider and live model choices remain separated and cancellable.
- Model selection now follows OpenCode's live
models.opencode.ai/api.jsoncatalog and omits deprecated entries. - Removed stale hard-coded model choices from the interactive picker; offline use falls back to an explicit custom model ID.
- Replaced the blue default provider dialog with a dark themed selector.
- Added a second model picker with verified provider model IDs and an explicit custom-model option; no model is silently guessed.
- Based the picker flow on OpenCode's provider/model separation and cancellation behavior.
/loginand/connectnow open a modal provider picker in interactive TTYs.- Connection prompts are flushed in the correct order and models require an explicit value instead of silently accepting a default.
- Unified interactive
/loginwith/connectand added an explicit provider selection screen. - Models are no longer silently defaulted; users must enter the model while a recommendation is shown.
- Fixed bypass-mode interactive checkpoints and rendered command feedback.
- Consolidated provider setup around
/connect;/loginis now a compatibility alias with guidance to use/connect. - Added built-in provider defaults for OpenAI, Anthropic, Google, DeepSeek, OpenRouter, Groq, Mistral, xAI, and Ollama, including endpoint, credential environment variable, and recommended model hints.
- OpenAI-compatible adapters can now target the expanded provider catalog.
- Fixed human-readable
/statusoutput; it now shows mode, run ID, last state, transaction count, verification state, and worker queue status.
- Fixed the interactive TTY prompt to catch invalid slash commands and render a recoverable error instead of terminating the chat process.
- Started the repair-focused release line. This release only updates the version and records the theme; command-by-command fixes will follow after real interactive reproduction.
- Added controlled background process tools:
run_background,process_status,poll_process, andkill_process. - Background tasks have ForgeCode-owned IDs, bounded incremental output, status and exit metadata, cancellation, approval, and command risk checks.
- Added read-only
git_logfor recent commit history. - Added approval-gated
git_commit; it refuses plan mode, cancellation, and empty unstaged commits.
- Added
read_rangefor precise bounded line-range inspection. - Added
list_symbolsfor lightweight source structure discovery. - Added
file_metadatafor encoding, size, line count, mtime, and SHA-256 inspection.
- Added
find_filesfor bounded glob discovery. - Added
testfor approved, bounded project test execution. - Added
diagnosticsfor approved compile/lint-style checks with structured exit results.
- Started the tools-focused release line with dedicated read-only
git_statusandgit_difftools for auditable repository inspection and review. - The tools are workspace-scoped, bounded, and available through the normal
registry and
/toolsinventory.
- Added the interactive
/toolscommand with descriptions and mode-aware availability, plus slash completion support.
- Added a compact startup status card with mode, model, tool count, and workspace state.
- Added visible Understand/Inspect/Modify/Verify phase separators and numbered tool steps to the human timeline.
- Added a structured
Completedsummary with verification status and tool-step count.
- Improved the human timeline with bounded file-content previews (line
numbers), command/search output panels, truncation hints, and cumulative tool
step counts in the final
Worked for …summary.
- Enabled SSE streaming by default for profiles using
streaming = "auto"; providers without stream transport still fall back to normal completion. This makes supported interactive providers visibly responsive without changing machine-output contracts.
- Improved human-readable task timelines with numbered assistant turns, elapsed time, and cumulative tool-step counts.
- Added immediate assistant progress events before each model turn, so multi-step tasks visibly show analysis and continuation instead of appearing silent between tool calls.
- Bound standalone
Escin the prompt UI to cancel the active task while keeping the chat session and input buffer available.
- Started the 0.3 release line with the current interactive launcher modes, slash-command completion, live progress display, and robust tool-call context handling.
- Added
fcc --planandfcc --actlaunch shortcuts alongsidefcc --bypass. - Fixed
/clearto flush the terminal clear sequence immediately and return a structured result for interactive transports.
- Added
fcc --bypassto launch directly in bypass mode. - Added interactive slash-command completion; typing
/msuggests commands such as/modeand/model.
- Added a conversational execution contract: the model is instructed to give a brief plan before tools, concise progress updates during multi-step work, and a final summary with verification and remaining limitations.
- Interactive chat now renders assistant progress messages as soon as each model turn completes, instead of showing only the final response. Tool progress remains visible and machine JSON output is unchanged.
- Replaced the
fclauncher withfccto avoid PowerShell's built-in alias.
- Added the
fcexecutable shortcut, which opens chat directly without arguments. - Fixed runtime duration tracking by importing the monotonic clock module.
- Added elapsed runtime markers to interactive progress events and a final
Worked for …duration in completed chat responses.
- Removed the default fixed 12-step AgentLoop cap. Runs now continue until the
model finishes, fails, is cancelled, or an explicit
max_stepsis set.
- Added dark-background file previews with unified red deletion and green addition lines during write operations.
- Added inline previews for write and patch operations in interactive progress, with green additions and red deletions.
- Improved live progress labels with file paths and command text, including distinct success and failure markers for tool and verification events.
- Added live human-readable progress events for interactive runs, including tool calls, successful/failed results, and verification status.
- Progress lines use cyan, green, and red markers and remain above the input area.
- Promoted the stable multiline, fixed-footer terminal chat interface to the 0.2 feature release.
- Enter submits input, Shift+Enter inserts newlines, and multiline rendering remains compatible with the supported prompt-toolkit callback signature.
- Fixed multiline prompt rendering on prompt_toolkit versions that pass the wrap-count argument to continuation callbacks.
- Styled multiline continuation rows so the entire input buffer keeps the dark input background.
- Enter submits; the terminal's Shift+Enter escape sequence inserts a newline.
- Fixed chat startup failure caused by an unsupported prompt-toolkit
s-enterbinding; Ctrl-J now inserts a newline while Enter submits.
- Enter now submits chat input; Shift+Enter inserts a newline in the multiline buffer.
- Added explicit dark styling for the fixed input area.
- Added a prompt-toolkit chat surface with a fixed bottom multiline input buffer and safe asynchronous output repainting.
- Pasted multiline content is submitted as one prompt when Enter is pressed.
- Published the next patch release after validating interactive bypass-mode
file creation with a short
hello.txttask. - Keeps long provider requests unchanged for a follow-up investigation; those requests may still hit the configured provider deadline.
- Verification:
uv run python -m compileall -q src;forgecode doctor.
- Declares the first minor release milestone for the runnable CLI harness.
- Consolidates the provider connection flow, human terminal presentation, and safety/audit boundaries delivered through the v0.0.x development series.
- Verification:
forgecode doctor --json, Python compile check, review scan, and interactive CLI smoke checks.
- Stabilized explicit cancellation while a legacy provider is still
unwinding: the loop reports
cancelledunless an unresolved worker is tied to a pending side-effecting action requiring recovery. - Preserved unresolved-provider audit events and recovery semantics for deadlines and side-effect conflicts.
- Verification: cancellation hardening regression and recovery tests.
- Added Python embedding
loginfor provider/profile credential references; only environment-variable names cross the RPC boundary. - Verification: embedding contract, compile, doctor, and full regression tests.
- Added provider discovery and health helpers to Node/Python SDKs, exposing
the existing
provider.list/provider.healthRPC contract programmatically. - Verification: SDK, embedding, RPC, doctor, compile, and regression tests.
- Added Python embedding
config_profilesprovider/model discovery, bringing configuration introspection parity with the Node SDK and RPC CLI. - Verification: embedding contract, RPC, compile, and doctor checks.
- Added Node SDK convenience controls
sessionCancel,sessionPause, andsessionResume, matching Python embedding and the RPC session protocol. - Verification: Node SDK parity smoke, full regression, and compile checks.
- Added Python embedding
session_inspectandsession_eventsread APIs for durable-session metadata and incremental audit retrieval. - Verification: embedding contract, compile, and RPC envelope tests.
- Added Python embedding
session_openandsession_runhelpers so programmatic clients can create and drive durable sessions through the same RPC envelope and workspace/mode/prompt validation as Node and CLI clients. - Verification: embedding contract, compile, and RPC envelope tests.
- Added Python embedding session controls (
session_cancel,session_pause,session_resume,session_approval) with bounded workspace validation and standard RPC envelopes, bringing Python parity with Node and CLI controls. - Verification: embedding contract and compile checks.
- Enforced canonical workspace binding on RPC session controls. A caller
supplying a workspace must match the workspace captured at
session.open; mismatches are rejected before session control is applied. - Verification: RPC session lifecycle and workspace mismatch regression tests.
- Added
--mode plan|acttoconfig policyand matching RPC/Node/Python parameters, so policy explanations reflect runtime mode overrides. - Verification: policy, RPC, embed, compile, and diff contract checks.
- Added read-only
config policy/config.policypermission explanations, including per-tool runtime narrowing, mode, approval, and trust reasons. - Added Node
configPolicy()and Pythonconfig_policy_embedded()helpers. - Verification: CLI policy contract, RPC, Node, and Python embedding tests.
- Policy output now includes redacted rule source metadata (fingerprint, path, scope, priority, digest, diagnostics) without including rule text.
- Added direct RPC and Python embedding contract coverage for policy parameter mapping, rule redaction, and boolean/size validation.
- Fixed Node
sessionList()to map workspace, lifecycle state, and limit into RPC parameters instead of silently treating them as process options. - Verification: Node SDK contract and RPC session tests.
- Corrected Node
sessionTree()direct workspace/limit options to map into RPC parameters; this compatibility fix remains grouped under v0.0.33. - Aligned direct workspace options across Node session open/status/result/wait, events, control, inspect, and run helpers; grouped under v0.0.33.
- Added Python
session_tree()andsession_tree_embeddedfor parity with the CLI, RPC, and Node session-tree discovery contract; grouped under v0.0.33.
- Bound RPC
session.treediscovery to its explicitly supplied canonical workspace, matchingsession.listand preventing cross-workspace metadata reads from programmatic clients. - Verification: RPC lifecycle contract tests.
- Added Python
session_list_embedded()helper, completing session discovery parity across CLI, RPC, Node, and Python embedding APIs. - Verification: RPC/CLI contract tests and Python import/compile checks.
- Added
session.listRPC and NodesessionListhelper with bounded workspace, lifecycle-state filtering, and consistent machine envelopes. - Verification: RPC lifecycle and CLI machine-contract tests.
- Added bounded
sessions --statefiltering for scriptable background-session orchestration while preserving human and JSON/JSONL envelopes. - Verification:
tests/test_cli_machine_contract.py(24 passed).
- Added opt-in background RPC session runs.
session.runwithbackground: truereturns an immediate accepted envelope while the shared handle executes on a daemon worker; status/events expose terminal completion and concurrent controls can cancel or pause the run. - Synchronous
session.runbehavior remains backward compatible. - Recovered orphaned running handles now report
recovery_requiredand emit a restart event when explicitly reclaimed by a new run. - Background run envelopes are now retained with a bounded result payload and survive session recovery.
- Added opt-in isolated background workers so cancellation can terminate a non-cooperative provider process without changing synchronous runs.
- Unified RunService AgentLoop lifecycle callbacks with the privacy-filtered telemetry recorder for auditable provider/tool/session families.
- Added a bounded
EmbeddedSessionevent queue (max_events) to make Python embedding backpressure explicit and reject unsafe queue sizes. - Bounded Node SDK stderr diagnostics and interactive event retention with
explicit
maxStderrBytes/maxEventslimits. - Added typed closed-session writes and bounded
interactive.closeAndWait()cleanup with terminate fallback. - Converted malformed Node interactive JSON into typed
process_errorevents with worker termination instead of uncaught host exceptions. - Added bounded stderr draining for Node interactive workers to prevent pipe backpressure deadlocks; the retained diagnostic tail is exposed read-only.
- Added
AbortSignalcancellation to Nodeinvoke/invokeStreamwith typedcancellederrors and immediate child termination. - Cleaned Node abort listeners on every terminal path to prevent long-lived SDK hosts from accumulating request references.
- Converted Node interactive child-process spawn failures into typed
process_errorevents instead of uncaught host exceptions. - Added Python
session_result()convenience API to match the Node SDK result retrieval contract. - Exported the Python result helper through the package-level
session_result_embeddedAPI for discoverable embedding use. - Added bounded
session.waitRPC plus Node/Python helpers to await background runs without polling. - Exported the Python wait helper through the package-level
session_wait_embeddedAPI for discoverable embedding use. - Aligned Python
session_wait()workspace validation with the result helper for cross-workspace daemon clients. - Replaced session wait polling with condition notifications on state changes, reducing idle wakeups without changing timeout behavior.
- Corrected
session.waitto refresh state, sequence, and worker liveness after waiting, returning a coherent terminal snapshot. - Isolated RPC pause/resume now attempt OS-level suspension signals where supported and record the applied control mechanism in session events.
- Prevented closing paused RPC handles while their worker may still be alive; callers must resume or cancel first.
- Made control/close operations on orphaned
recovery_requiredhandles fail closed until an explicit recovery run reclaims them. - Exposed validated model profile discovery through the
config.profilesRPC method and NodeconfigProfileshelper. - Made config/provider/doctor RPC workspace selection explicit and canonical, with the selected workspace echoed for auditability.
- Kept Act-session cancellation available after trust revocation so active workers can always be stopped while new execution remains denied.
- Enforced existing-directory validation for diagnostic RPC workspace parameters before invoking downstream CLI code.
- Kept read-only Act
session.resultretrieval available after trust revocation for post-incident audit evidence. - Spool-isolated RPC stdout to bounded temporary storage, preventing large provider/tool output from exhausting daemon memory.
- Corrected output truncation handling so successful isolated runs remain
completedrather than being misclassified as failed. - Prevented closing cancelled handles while their isolated child process is still alive, eliminating a teardown/recovery race.
- Added bounded terminate/kill cancellation fallback and auditable termination method metadata for isolated RPC workers.
- Included execution mode and explicit
worker_alive=falsein recovered open responses for deterministic client recovery decisions. - Allowed read-only
session.waiton trust-revoked/recovery handles so clients can observe terminal state without re-enabling execution. - Finalized isolated RPC handles on child-process startup failure with a
structured process error instead of leaving them stuck in
running. - Added read-only
session.resultRPC and Node helper for retrieving bounded background run envelopes without polling full status metadata. - Verification: full regression
456 passed, 8 skipped, 2 warnings, RPC lifecycle suite, compile, and CLI/doctor checks.
- Synchronized release metadata after the v0.0.26 telemetry retention work.
- Added profile-aware
/login --profilediagnostics so credential references, provider, and model selection are consistent across CLI, RPC, and chat. - Added RPC event-cursor truncation metadata (
oldest_sequenceandtruncated) for safe disconnect recovery. - Added an auditable
cancel_requestedmarker to RPC session control state. - Hardened Node streaming JSON parsing to return typed
invalid_jsonerrors. - Aligned Python embedding stream parsing with the typed
invalid_jsonerror contract. - Added telemetry event-family classification and unknown-event audit markers.
- Serialized telemetry append/retention operations for concurrent workers.
- Made act-mode embedded reconnect fail closed when workspace trust is revoked.
- Added trust revalidation at RunService side-effect boundaries during act runs.
- Hardened embedded shutdown with terminate/kill fallbacks and bounded waits.
- Serialized RPC session runs and made cancelled/failed/denied handles terminal with explicit recovery semantics.
- Prevented closing active RPC handles before cancellation or completion.
- Restricted provider error parsing to safe scalar messages, preventing nested credential fields from entering diagnostics.
- Added stable RPC lifecycle error codes for busy, terminal, and denied states.
- Bounded JSONL RPC request lines to 1 MiB before parsing.
- Documented the bounded request-line contract and
request_too_largeerror. - Verified cancellation markers survive persisted RPC handle recovery.
- Closed embedded worker pipe handles during shutdown to avoid Windows resource warnings after forced termination.
- Canonicalized persisted RPC workspaces and bounded request identifiers.
- Normalized Node/Python SDK limits and process/JSON error contracts.
- Verification: targeted RPC/embed/provider/telemetry/cancellation/context/review gate (86 passed), Node smoke, Python compile, doctor JSONL, and diff checks.
- Additional hardening: bounded SDK argv/params and request ids, typed process and JSON errors, RPC busy/terminal/approval taxonomy, cancellation recovery, canonical workspace persistence, trust fail-closed execution, and provider error redaction.
- Bounded Python embedding stream requests to JSON objects and 1 MiB payloads, aligning client-side validation with the RPC protocol.
- Included persisted state, sequence, and cancellation metadata in recovered
session.openresponses. - Added telemetry export
returned_countandtruncatedmetadata for bounded audit exports. - Applied argv bounds consistently to Node streaming invocation.
- Rejected non-standard NaN/Infinity values in Python embedding stream JSON.
- Normalized writes to exited embedded workers as typed
process_errorfailures. - Added profile/provider credential selectors to the Node login helper.
- Normalized Node child-process spawn failures to typed
process_errorerrors. - Verification: version/import consistency and targeted telemetry checks.
- Added bounded local telemetry retention with atomic trimming of old records.
- Verification: telemetry retention, privacy, compile, and diff checks.
- Added
telemetry statusandtelemetry exportCLI commands with bounded local audit export and explicit offline policy reporting. - Verification: telemetry CLI tests and doctor smoke check.
- Added Python
EmbeddedSessionand Nodeinteractive()controls for the production chat worker: send, pause, resume, cancel, and quit. - Verification: embedded worker control and RPC regression tests.
- Added RPC methods for
session.inspect,session.tree, andsession.export, with bounded session parameters and Node helpers. - Verification: RPC method and parameter validation tests.
- Added parameterized RPC
runrequests, including bounded prompt, workspace, mode, profile, demo, approval, and trust options. - Verification: JSONL RPC run and malformed-parameter tests.
- Added explicit RPC method dispatch with request IDs and Python/Node embedding
support while retaining the legacy
argvrequest shape. - Verification: RPC request-id, method, and embedding tests.
- Expanded RPC method compatibility and method echoing for machine clients.
- Verification: RPC method dispatch tests.
- Stabilized RPC method dispatch and preserved legacy provider injection paths.
- Verification: CLI compatibility and provider tests.
- Aligned provider capability diagnostics with supported streaming adapters.
- Verification: provider list and protocol tests.
- Added provider registry diagnostics via
provider listfor OpenAI-compatible, Anthropic, Google, and Ollama adapters. - Verification: machine-readable provider registry tests.
- Added the first Python embedded API and RPC request-id foundation.
- Verification: embedded invocation, compile, and doctor checks.
- Completed the CLI harness slice: provider/profile credentials and login, provider protocol adapters, trust grant/revoke, offline/telemetry policy, Escape cancellation, JSONL RPC, Node SDK, and privacy-aware audit events.
- Verification: full regression gate (
374 passed, 8 skipped), doctor, compile, CLI smoke, and diff checks.
- Added monotonic runtime tool narrowing with
--tools,--exclude-tools, and--no-tools, preserving approval, timeout, cancellation, and redaction boundaries. - Verification: v0.0.12 policy regression suite and CLI machine-contract tests.
- Added Pi-inspired
!<command>and!!<command>interactive shortcuts with bounded output and distinct model-visible/local audit semantics.
- Added the controllable interactive worker with bounded FIFO follow-ups and
/pause,/resume, and/cancel.
- Added durable long-run workflows: bounded context compaction, trajectory evaluation, session trees, cloning, and model profiles.
- Hardened cancellation, recovery, checkpoint validation, transaction evidence, and release acceptance workflows.
- Productized extensible local agent workflows with rules, references, plans, skills, repository context, and auditable CLI contracts.
- Refined the interactive terminal presentation with persistent command hints, visible tool cards, clearer error guidance, and phase-aware progress output.
- Long-running model waits are explicitly distinguished from active tool work.
- Verification: targeted interactive UI tests, compileall, and forgecode doctor.