Why: N1 WP2/WP3 host side - the kernel ask loop must reach the HITL
confirm card, and tool gating should run through the typed Policy with
the session-allow store port instead of a hand-built Request.
Evidence: go vet clean; go test ./... all packages ok, including new
TestConvAllowStoreKeysByName, TestPermissionAskRoutesToHITL, and
permissionAskOf tests. Nested agent-native pin at 9758a8d (PR #17).
Impact: runmgr.ExecuteTool decides via agentpolicy.Policy with
convAllowStore (keying unchanged: conversation x tool name);
runCtx.PermissionAsk routes kernel asks to the shared toolConfirmCard
HITL; direct and subagent loops pass PermissionAsk into the kernel
config (nil for hosts without the method, preserving legacy ask=reject).
Refs: Documents proposal 2026-10-07-agent-stack-n1q1i1-plans.md WP2/WP3; Agent-Native PR #17
Why: review of EXT-5 found a column-cap cell (common styled XFD cells) wrongly reported the 200k-cell cap and aborted every remaining worksheet; malformed sheet XML was also dropped silently, contradicting the explicit-failure contract; the legacy-office parser id was missing from the registry.
Evidence: local GOWORK=off go test ./... 29 packages pass with new regressions (wide column keeps later sheets, bad sheet XML warns, registry maps doc/xls/ppt); go vet clean; recorded as SELF on the Dev task card.
Impact: xlsxSheetBlocks returns wide/badXML signals; wide cells skip with a per-sheet warning, cell-cap truncation unchanged; builtin:legacy-office added to ParsersDescription.
Refs: review of backend 727f370; documents proposal 2026-10-06-ext-5-host-parse-document sect.2.
Why: downstream parsers are unreachable via extension.Host and the base lacked xlsx/pptx parsers; MS1 needs Excel and PPT ingest (EXT-5 request, documents proposal 2026-10-06-ext-5-host-parse-document).
Evidence: local GOWORK=off go test ./... all 29 packages pass incl. new ooxml_test (hand-built parts), ooxml_python_test (openpyxl/python-pptx round-trip), inproc owner-scope and limit tests, xlsx upload e2e; go vet clean; recorded as SELF on the Dev task card, PR CI to confirm.
Impact: Host gains ParseDocument (pure compute; errors only on ctx cancel or >100MiB input); builtin:xlsx (sheet order via workbook.xml rels, rich-text shared strings, formula cache, 1900/1904 dates, sparse cells) and builtin:pptx (sldIdLst order, titles, group shapes, AlternateContent Choice, tables, notes) added with 200k-cell/64MiB-part caps; legacy doc/xls/ppt get an actionable hint; ParsersDescription gains xlsx/pptx and the missing text ext; surface snapshot now records exported interface methods; docx part reads share the 64MiB cap.
Refs: documents 2026-10-06-ext-5-host-parse-document.md; EXT-1 host.go precedent.
Why: GET /api/conversations on the default unarchived view appended
AND archived=0. PostgreSQL stores conversations.archived as BOOLEAN
and rejects boolean = integer (42883), so listTasks returned 500.
The previous dialect fix bound parameters and scans but left this literal.
Evidence: before the change, TestConversationFlagsAndTaskList against
pg1 failed with SQLSTATE 42883. After: AGENT_PG_TEST_DSN set to pg1,
go test ./internal/store -count=1 passed; go vet ./... && go test ./...
passed on SQLite.
Impact: the default task list works on the postgres tier. SQLite still
binds the bool as 0/1. openTestStore accepts URL and keyword DSNs and
keeps public on search_path so an existing pg_trgm extension stays visible.
Refs: Agent-System-Dev feature/store-pg-archived-literal
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: user create/reset-password and conversation flag updates wrote 1/0
literals and boolInt ints into BOOLEAN columns; SQLite tolerates it,
PostgreSQL rejects with 42804. The 10-04 user create on pg1 failed midway
(empty password_hash, is_admin=f), and password reset, user list (bool
scanned into int) and login (GetUserAuthState scan) were all broken on
the postgres tier.
Evidence: store tests green; against the live pg1 the fixed CLI completes
user reset-password and user list (isAdmin=true, mustChangePassword=true,
hasPassword=true).
Impact: auth/account management and conversation list/flag paths work on
postgres; SQLite unchanged (0/1 converts via driver.Bool). No schema
changes.
Refs: dev-repo PR for gitlink bump (feature/store-pg-bool-dialect)
Why: Masks must not be the only copy of a key, and personal instructions, lore hits, and candidate replies have to reach the model without rewriting the system prefix or deleting history.
Evidence: go test ./internal/store ./internal/ctxasm ./internal/settings ./internal/runtime ./internal/server. Migration v16 upgrades and rolls back. Startup snapshots settings before moving raw keys.
Impact: One labeled key is active per service. Excluding a message hides its whole run from the model. Regenerating appends another candidate and rewinds files to the user turn. User slash commands expand to prompt text and do not fire on their own.
Refs: docs/records/2026-10-04-sillytavern-review.md
Why: The embedded tier starts without auth, and nothing checked Origin or Host, so a public bind or a foreign page could call write APIs.
Evidence: go test ./internal/config ./internal/server covering listen policy, origin rejection, and response headers.
Impact: Non-loopback without auth exits before opening the database. HTML artifacts get a sandbox CSP. Reverse proxies must list their public host in allowedHosts.
Refs: feature/sillytavern-review
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: A dotted-key PUT was stored beside the nested object and never read, so replacing a key kept the old pool. GET also returned tools.tavily.apiKeys in clear text, and saving settings would write the mask placeholder back over a real key.
Evidence: go test ./...
Impact: Dotted writes take effect on the next read. Startup expands stored dotted keys, and the existing nested value wins when both forms exist. GET masks schema secrets, including apiKeys. Writing the mask placeholder no longer overwrites a stored secret.
Refs: fix/settings-dotted-keys
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: workflow scripts and run_tool_script should share one Python host, while a slow MCP server must not block the first prompt.
Evidence: GOWORK=off go test ./internal/runtime/ ./internal/app/ ./internal/settings/ ./internal/tools/ ./internal/runmgr/
Impact: runtime.codeOrchestration defaults to false, so the tool stays hidden. Workflow script confirmation and its longer timeout cap stay as they were.
Refs: feature/code-orchestration
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: workspace writes had no checkpoint, and a 5xx before any output stopped the turn instead of trying the next configured model.
Evidence: GOWORK=off go test ./internal/runtime/ ./internal/runmgr/ ./internal/tools/ ./internal/settings/ ./internal/server/ ./internal/app/
Impact: models.chat.fallbacks defaults to empty, so existing runs keep their model. Rewind restores only tracked writes and appends a system note. Usage records the model that served.
Refs: feature/durable-rewind
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Plan mode has to block writes, confirmations dropped the argument preview, and direct chat did not share its stop gate with squad members.
Evidence: GOWORK=off go test ./internal/store/ ./internal/tools/ ./internal/runmgr/ ./internal/runtime/ ./internal/server/ passed. Default mode still runs write_artifact; plan mode rejects it.
Impact: Empty permission mode keeps the profile allow, deny, and confirm lists. High-risk shell commands now ask. There is no bypass-all mode.
Refs: feature/permission-hooks
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: A dropped subscription had no retry hint, and a reconnect had no test that the gap is filled from the cursor.
Evidence: The stream starts with retry: 1000. A live publish is delivered, and Last-Event-ID after an overflow replay skips events the client already has.
Impact: EventSource waits one second before reconnecting. Persisted events are unchanged.
Refs: feature/runstate-shell
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Byte truncation split UTF-8, subagent results could return unbounded text, and a write could overwrite a file that changed after it was read.
Evidence: cutRunes keeps a two-character Chinese prefix; tool selection honors -name; checklist reminders go through the reminder bus.
Impact: Tool output limits count characters. A subagent result over 32000 characters is stored as an artifact and the parent sees the path. fs_write_file rejects an existing file that was not read in this run.
Refs: feature/context-engineering
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The direct path never retried provider timeouts, so a single 429 failed the run.
Evidence: go test ./internal/settings/ ./internal/runtime/ passed. Default runtime.llmRetries is 2.
Impact: Retries happen only when the stream has not forwarded a delta. Injected test streams are not wrapped.
Refs: feature/llm-robustness
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Refreshing or switching back only knew the latest event cursor, so process that had already happened was missing until the run finished.
Evidence: GOWORK=off go test -count=1 -run TestConversationResumeSeq ./internal/server passed. While a hitl run waits, resumeSeq is the run's first seq minus one and is less than lastSeq; after the run completes the two cursors match.
Impact: Conversation detail gains resumeSeq beside lastSeq. No core contract change. Clients that ignore the field keep the old cursor.
Refs: Dev fix/live-run-visibility
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: A hard kill left runs in pending, running, or waiting_hitl, a busy send stored a message before the 409, finishRun could mark a run completed without an assistant message, and a full SSE buffer dropped events without closing the stream.
Evidence: GOWORK=off go vet ./... and GOWORK=off go test -count=1 ./... passed, including store, runmgr, bus, and server recovery tests.
Impact: Migration v14 adds runs.instance_id and messages.request_id. Startup reconciliation and shutdown share one seal. Turn and workflow sends claim a slot before writing. Duplicate request ids return the existing message. SettleRun updates the run and appends the assistant message in one transaction. A full subscriber buffer closes the channel so SSE can replay from the cursor.
Refs: Dev feature/pi-durable-borrow
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Backend has to keep the same squad runs after the core stopped importing agent-native. The adapter module owns the concrete client.
Evidence: GOWORK=off go test -count=1 ./internal/... passed.
Impact: AgentNativeOptions now returns the adapter config. Default roles still use the agent-system backend.
Refs: D1
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The composed reply copied the registered artifact id and file size out of the tool summary.
Evidence: go test ./internal/runtime/ -run 'TestComposeUserPromptOmitsArtifactIDs|TestComposeReplyDropsInternalRefs'
Impact: Those tokens are removed from the compose input and from the reply before it is shown.
Refs: feature/final-reply-compose
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The first live run wrote its deliberation, including a think block and the quality score, as the reply the user sees.
Evidence: go test ./internal/runtime/ -run TestCompose
Impact: Think blocks are stripped before the reply is stored or shown. The compose prompt forbids paths, scores, and step-by-step reasoning.
Refs: feature/final-reply-compose
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: End-of-turn checks were injected as user messages, so the model answered the checker instead of the user, and the last draft was treated as the reply.
Evidence: go test ./internal/runtime/ ./internal/prompts/ ./internal/settings/ ./internal/ctxasm/
Impact: Rejections are system reminders. A main-model compose step writes the user-facing reply when tools were used. Deliverable cards stay after that reply.
Refs: feature/final-reply-compose
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Tool calls stayed invisible until execution finished, and turn, tool, timeout, and output caps stopped long tasks early.
Evidence: go test ./internal/runtime/ ./internal/tools/ ./internal/prompts/ ./internal/squadadapter/ ./internal/runmgr/ ./internal/app/ ./internal/settings/
Impact: tool.call.delta and tool.output reach the client; default profile, subagents, and squad no longer cap turns or tool calls; exec timeout defaults to 600s with no hard ceiling. A profile or subagent maxTurns above 0 still applies.
Refs: feature/stream-display-overhaul
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: A conversation run has no launch of its own, so a script step looked up an empty copy and refused to run.
Evidence: go test ./internal/runtime/ -run TestRegisteredWorkflowUsesItsOwnScriptCopy passed. The body is taken from the launch passed into the runner.
Impact: Intent-started runs still use the copy made at start.
Refs: feature/agent-harness-p4
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The planner treated the goal as work to do, and the critic accepted a draft that missed the required line.
Evidence: go test ./internal/runtime/ ./internal/prompts/ passed. The planner task now says to output JSON and not perform the goal.
Impact: A missing required sentence is a failed check. The planner still cannot add script steps.
Refs: feature/agent-harness-p4
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The critic asked the provider for a model named verify, so every check failed before it could read the step output.
Evidence: go test ./internal/runtime/ -run TestJudgeUsesConfiguredModel passed. The request model is MiniMax-test when that is the configured chat model.
Impact: A missing lightweight route still falls back to the chat model. Unparseable output still counts as a fail.
Refs: feature/agent-harness-p4
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Mock mode needs a path that drives the real step runner, and the example plugin should fail the host test if its workflow or slot question is wrong.
Evidence: go test ./internal/plugins/ -run TestRepoExamplePluginLoads passed. The brief intent asks 主题是什么？ and keeps the topic slot.
Impact: #workflow is only the mock runner. The example plugin itself is in the Dev repo.
Refs: feature/agent-harness-p4
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Plugin scripts and model-written scripts need the same step runner, without giving the script a way to call interpreters or start another workflow.
Evidence: go test ./... passed. Callbacks, denied tools, the 50-call cap, a 1MB line, and cancel-kills-the-process are covered. A model script does not run until the switch is on and the user confirms.
Impact: runtime.workflowScripts stays off by default. Plugin script bodies are copied into the launch. Squad entry still has no run_workflow.
Refs: feature/agent-harness-p4
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: A goal should become steps only after the same limits as a declarative workflow, and only after the user accepts the plan.
Evidence: go test ./internal/runtime/ ./internal/prompts/ passed. Over-limit and script steps are rejected before confirmation. A no choice does not execute.
Impact: The planner profile is agent.sub.workflow-plan. run_workflow stays off subagent tool lists.
Refs: feature/agent-harness-p4
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: A matched intent needs to run the copied definition, ask for missing slots, and stop when a step or the whole workflow exceeds its retry cap.
Evidence: go test ./internal/runtime/ ./internal/runmgr/ ./internal/server/ ./internal/prompts/ passed. The five step kinds update the plan, an unparseable critic counts as a failure, and run_workflow by id runs the registered definition.
Impact: Squad entry does not declare run_workflow. Script steps still return an error until the script host lands. Goal and script arguments are rejected for now.
Refs: feature/agent-harness-p4
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: A hit intent should start the bound workflow, and a command that shares the same id still has to win.
Evidence: go test ./internal/intentgate/ ./internal/runmgr/ ./internal/server/ passed. Recognize keeps slots and the missing-slot question. StartWorkflowRun copies the definition and selects the workflow runner even when mock is on.
Impact: Ordinary turns are unchanged. The workflow runner body is still a stub until the executor lands.
Refs: feature/agent-harness-p4
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Intent routing needs a registry of workflow definitions, and uninstall was leaving intents and workflows in place.
Evidence: go test ./internal/workflow/ ./internal/plugins/ ./internal/app/ passed. Validation rejects duplicate ids, unknown kinds, denied tools, and both step caps. Unregister clears the registry and the intent gate.
Impact: Script steps must stay inside the plugin directory. The server holds the registry for later routing.
Refs: feature/agent-harness-p4
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: A parent turn should be able to finish while children keep working, and a review should keep only findings that a second pass confirms. Users also need to override a profile's tools, model, and turn cap without adding dispatch tools.
Evidence: go test ./... passed. New cases cover overlay rejection, role mapping, queued notices, and dropping FAIL or unparsed findings.
Impact: Notices live only in memory, and each conversation allows three background children. Squad writer steps now use the writer profile.
Refs: feature/agent-harness-p3b
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Subagents were a single lightweight call that dropped the hint and wrote their messages into the parent history. Profiles now decide tools, model, and turn cap, and the parent only keeps the summary plus confirmed artifacts.
Evidence: go test ./... passed. New tests cover the six builtin specs, tool execution and whitelist, explore versus writer models, maxTurns, artifact parts, hint text, SpawnAgent pinning, depth-1 refusal, summary artifact lines, and history isolation.
Impact: Squad steps share the general profile (up to 12 lightweight turns, no exec tools). Child runs do not attach the final-turn verifier. Profile fields stay in builtin files, so core.PromptModule is unchanged. The agent-native pin stays a34689c.
Refs: feature/agent-harness-p3
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: A direct run could stop on a missing file, a failed lint, or an unverified claim. The final turn now checks registered artifacts and asks a tool-less verifier, and nudges stale plans and todos.
Evidence: go test ./... passed. New runtime tests cover missing and empty artifacts, docx lint errors, verifier reject-then-pass, unparseable and failed verifier calls, nil verifier tools, todo reminders, and the false-deliverable fixture.
Impact: Direct runs with runtime.verify (default on for new runs) spend one extra lightweight call on every final turn. Setting it off keeps the previous stop behavior. Squad and SubLLMRunner are unchanged. The agent-native pin stays a34689c.
Refs: feature/agent-harness-p2
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: deliverable checks, truncation continuation, and tool budgets should live in one loop instead of a second copy inside LLMRunner.
Evidence: go test ./... in backend passed. Existing runtime assertions were unchanged; new tests cover whole-batch tool-cap rejection with parts saved, and length continuation.
Impact: the direct path enables repeat guard and length continuation. Squad still uses the one-shot deliverable predicate and does not set the new kernel switches.
Refs: feature/agent-harness-p1
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Flattened "[调用工具 …]" history taught the model to imitate calls and invent artifact ids. A single regex correction then accepted the second false claim.
Evidence: ctxasm replay tests cover native tool messages, missing-result pairing, argument compaction, demoted text, and forged-marker stripping. Runtime tests cover forged markers, extension-less claims, two corrections, and the fallback notice.
Impact: Assistant history sent to the model no longer contains flattened tool calls. The direct runner corrects a false deliverable twice, then appends a notice instead of accepting the claim. The squad entry still fails closed on the same predicate. base.deliverables is now v5.
Refs: feature/agent-harness-p0
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Downstream products must extend the base through a public package and host API instead of editing internal code.
Evidence: go test ./... passed, including plugin v2 assets, sidecar startup, migration v13, pending confirms, HITL timeout, hash embedder, command pairs, and the extension surface snapshot.
Impact: apiVersion 2.0-experimental rejects empty network allowlists for declarative HTTP. Hash embeddings stay opt-in via models.embedding.provider=hash. Plugin secrets resolve per owner at execution time.
Refs: docs/proposals/2026-10-01-plugin-contract-v2.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Squad steps previously ran without tools, and the product had no way to make the squad the conversation entry without losing streaming, cards, or the deliverable guard.
Evidence: go test ./... -count=1 passed, including streaming, cardflow, false-deliverable rejection, tool allowlist, model routing, usage, cancel, and turn and tool budgets.
Impact: runtime.entry defaults to direct. squad uses one kernel step for simple work and the leader for the rest. squad_orchestrate is hidden in that mode. The default is not switched.
Refs: deliverable-quality-system B3-B5
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Layout rules alone do not produce conclusion-first documents, extra views, or infographics, and nothing scored a deliverable before it was returned.
Evidence: go test ./internal/prompts/ ./internal/quality/ ./internal/tools/ ./internal/squadadapter/ ./eval/ -count=1 and the house-style unittest passed in the previous session.
Impact: Every task inherits content rules. Meetings, reports, and comparisons can name a view family. Long documents without a visual summary warn. quality_review and the squad checker share one scorecard.
Refs: deliverable-quality-system A1-A5
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The first commit picked up __pycache__ created while running the
house-style suite. Bytecode is not part of the skill and should not be
seeded or reviewed.
Evidence: git rm of the cached pyc files; .gitignore now ignores
__pycache__ and *.pyc.
Impact: The skill tree contains only source. Seed already skips
__pycache__ directories.
Refs: feature/agent-professional-deliverables
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Generated files kept Word's default theme, US Letter pages,
hand-typed bullets and empty sections. Recipes only showed library
calls, the prompt had no craft standard, and seeded skills could not
be upgraded once written.
Evidence: go test ./... passed. The house-style suite covers three
themes across docx, pptx and xlsx, and rejects a document that repeats
the diagnosed layout failures. lint on the sample minutes exits 1.
Impact: Every run gets a resident quality standard. Office files use
house-style (switchable themes, templates, imitation) and must pass
lint. Skill seeding upgrades untouched builtins and keeps user edits.
Uploads land in inputs/, and the default style is a setting.
Refs: feature/agent-professional-deliverables
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Main moved the deliverable recipes into skills after this branch
recorded the false-file rule, so the prompt has to keep both.
Evidence: go test ./internal/prompts/ ./internal/runtime/ passed.
The resolved prompt is version 2 and points at the skill library.
Impact: This branch contains the B10 assembly and still rejects a final
reply that claims a file it did not create.
Refs: feature/chat-timeline-preview
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the full-agent batch left three B10 sub-items open - the
composition root lacked MCP server injection and a Subagent factory,
builtin squad roles carried no explicit Tools/Skills/BashPermission
declarations, and the three Python deliverable recipes still lived
inline in the base.deliverables prompt instead of the skills system.
Evidence: go vet ./... clean; go test ./... 21 packages ok. New cases:
skills seeding idempotency with user-edit preservation and sorted
builtin names; the SubagentFactory bridge mapping delegation fields
into SpawnSubagent task briefs and status/errors back; builtin-role
assertions (all four explicit bash permissions, researcher
search+fetch, reviewer grep+glob, writer ask + 3 skills +
run_python/load_skill); MCP manager cache reuse/rebuild/disable
behavior including invalid JSON and config races.
Impact: internal/skills embeds docx/xlsx/pptx-author SKILL.md and
seeds <data>/skills at startup; base.deliverables references the
skills and keeps only import one-liners; squadadapter.AgentNativeOptions
now receives rc and gains SubagentFactory(rc); app.go adds
tools.mcp.servers loading with a config-keyed manager cache (old
manager closed on rebuild).
Refs: Dev task feature/full-agent-b10-r2 (verifier follow-ups).
Why: the full-agent batch (Agent-Native PR #3, Agent-Squad PR #3) made
roles capable of declaring model/tools/skills/bash execution, but the
product composition root had no path to register the kernel backend or
inject search/exec/skills config.
Evidence: go vet ./... clean; go test ./... 19 packages ok. New cases:
buildBackends registers agent-native only when composition-root options
are enabled (default backend stays agent-system, per the parity
progressive-enablement clause) and resolves explicit
Backend:agent-native roles; InterpreterExecConfigForKernel validates
absolute interpreter paths and the env whitelist reused from the
product exec tools.
Impact: deps/agent-native pinned to f9ab2ef and deps/agent-squad to
9a402e4; app.go resolves settings.models.chat, tools.tavily.*,
runtime.exec, and <data>/skills into squad.AgentNativeConfig per run;
squadadapter exposes the AgentNativeOptions hook and buildBackends.
Refs: Dev task feature/full-agent-r1 batch B10.
Why: A turn with no tool call can still say a document was generated and invent an artifact id, and the chat then shows only that text.
Evidence: go test ./internal/runtime/ ./internal/prompts/ -count=1. The guard fires on an unknown art id or a generation claim with no deliverable, cites an existing artifact without firing, and corrects at most once.
Impact: One extra model turn when the reply falsely claims a file. base.deliverables is now version 2 and forbids claiming a file or printing artifact ids.
Refs: feature/chat-timeline-preview
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: After a refresh the timeline had no thinking duration and successful tool rows expanded to nothing, because only failures stored a summary.
Evidence: go test ./internal/runtime/ -count=1 -run 'TestLLMRunnerRecordsThinkingAndToolDuration|TestLLMRunnerToolTurnTextIsProcess|TestLLMRunnerDeliverablePinnedAfterText'
Impact: Thinking parts gain durationMs; tool calls gain durationMs; tool results keep a short success summary. Requires the core duration field.
Refs: feature/chat-timeline-preview
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: string writes of .docx/.xlsx/.pdf produce files that will not open,
and generated binary artifacts were skipped by search entirely.
Evidence: go test ./... 19 packages ok. Office extensions are refused
with a pointer to run_python plus register_artifact. A docgen docx is
searchable after WriteArtifact; unparseable bytes are not indexed.
Impact: write_artifact and fs_write_file no longer accept those
extensions. Text artifacts index as before. Merge after the interpreter
PR so the error text names tools that exist.
Refs: task feature/binary-doc-index; supersedes Dev #99 / Backend #27
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: deliverable prompts already tell the model to generate Office files
with run_python and register them, but the executors were never
registered, so calls missed the registry and fell back to text-only
write_artifact.
Evidence: go test ./... — 19 packages ok, including echo/script-retention,
empty-script and runtime.exec gate, process-group timeout, python ZIP
magic, and ExecuteTool backfill of register_artifact after run_python.
Scripts stay under the session .agent/ directory; bash/python3 are
resolved to absolute paths; timeout kills the process group.
Impact: models can execute workspace scripts and register binary
deliverables. runtime.exec=false still fail-closes the whole family.
Office extensions now get real MIME types so binary bytes are not
indexed as text.
Refs: task feature/exec-interpreters
Co-authored-by: Cursor <cursoragent@cursor.com>
weichen
