Why: the sandbox hides /home and only remounts the resolved Python prefix, so executing python/current/bin/python3 failed before the base layer could be imported.
Evidence: go test ./internal/tools/ -run TestResolveInterpreterFollowsManagedSymlink passed, and env doctor against the built base layer printed doctor ok (SELF).
Impact: run_python and env doctor follow the symlink into the mounted prefix or /usr/bin/python3. The layer and the prefix mount stay the same.
Refs: Agent-System-Backend PR 207
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The sandbox hides the host home directory and has no network, so pip install --user cannot supply python-docx, and the service PATH resolved python3 to a linuxbrew path that does not exist inside the sandbox.
Evidence: SELF go test of execenv, tools, store, app, server, runmgr, config, and cmd/agent-system on this worktree. CI has not run.
Impact: Sessions inherit a read-only base layer. Extra packages are requested through python_env, auto-approved only from the allowlist, and mounted per conversation. Schema 35 adds the request and binding tables.
Refs: .task/feature-layered-python-env.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The DOCX parser only read w:r runs that were direct children of w:p, so
text inside w:ins, w:hyperlink and w:fldSimple was dropped with no warning,
violating the no-silent-degradation rule. Separately, runtime.exec is a
user-writable setting, so multi-user deployments could not reliably turn the
exec primitives off.
Evidence: SELF - red tests TestParseDocxTrackedChangesAndHyperlinks and
TestExecHardDisabledOverridesSettings failed before and pass after; backend
go test ./... (32 packages) passes; a mock-mode binary started with
--disable-exec-tools hides run_shell/run_python/register_artifact from
/api/tools even after the user sets runtime.exec=true.
Impact: DOCX paragraphs are decoded from the token stream at any depth;
deleted/moved-from text, field codes and mc:Fallback are excluded and
revised documents carry an explicit warning. New Options.DisableExecTools
(SurfaceVersion 2.5.0-experimental), CLI --disable-exec-tools, config key
disableExecTools and env AGENT_SYSTEM_DISABLE_EXEC_TOOLS; zero value keeps
current behavior.
Refs: Agent-System-RDM docs/proposals/2026-10-09-V22-review-and-implementation-plan.md (G0-7, B-5)
Why: Tool calls stayed invisible until execution finished, and turn, tool, timeout, and output caps stopped long tasks early.
Evidence: go test ./internal/runtime/ ./internal/tools/ ./internal/prompts/ ./internal/squadadapter/ ./internal/runmgr/ ./internal/app/ ./internal/settings/
Impact: tool.call.delta and tool.output reach the client; default profile, subagents, and squad no longer cap turns or tool calls; exec timeout defaults to 600s with no hard ceiling. A profile or subagent maxTurns above 0 still applies.
Refs: feature/stream-display-overhaul
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Generated files kept Word's default theme, US Letter pages,
hand-typed bullets and empty sections. Recipes only showed library
calls, the prompt had no craft standard, and seeded skills could not
be upgraded once written.
Evidence: go test ./... passed. The house-style suite covers three
themes across docx, pptx and xlsx, and rejects a document that repeats
the diagnosed layout failures. lint on the sample minutes exits 1.
Impact: Every run gets a resident quality standard. Office files use
house-style (switchable themes, templates, imitation) and must pass
lint. Skill seeding upgrades untouched builtins and keeps user edits.
Uploads land in inputs/, and the default style is a setting.
Refs: feature/agent-professional-deliverables
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the full-agent batch (Agent-Native PR #3, Agent-Squad PR #3) made
roles capable of declaring model/tools/skills/bash execution, but the
product composition root had no path to register the kernel backend or
inject search/exec/skills config.
Evidence: go vet ./... clean; go test ./... 19 packages ok. New cases:
buildBackends registers agent-native only when composition-root options
are enabled (default backend stays agent-system, per the parity
progressive-enablement clause) and resolves explicit
Backend:agent-native roles; InterpreterExecConfigForKernel validates
absolute interpreter paths and the env whitelist reused from the
product exec tools.
Impact: deps/agent-native pinned to f9ab2ef and deps/agent-squad to
9a402e4; app.go resolves settings.models.chat, tools.tavily.*,
runtime.exec, and <data>/skills into squad.AgentNativeConfig per run;
squadadapter exposes the AgentNativeOptions hook and buildBackends.
Refs: Dev task feature/full-agent-r1 batch B10.
Why: deliverable prompts already tell the model to generate Office files
with run_python and register them, but the executors were never
registered, so calls missed the registry and fell back to text-only
write_artifact.
Evidence: go test ./... — 19 packages ok, including echo/script-retention,
empty-script and runtime.exec gate, process-group timeout, python ZIP
magic, and ExecuteTool backfill of register_artifact after run_python.
Scripts stay under the session .agent/ directory; bash/python3 are
resolved to absolute paths; timeout kills the process group.
Impact: models can execute workspace scripts and register binary
deliverables. runtime.exec=false still fail-closes the whole family.
Office extensions now get real MIME types so binary bytes are not
indexed as text.
Refs: task feature/exec-interpreters
Co-authored-by: Cursor <cursoragent@cursor.com>
weichenandCursor