c06dc2d356f6bfb2f00aec33b295c41fe53f9e16
4
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
|
02e049744f |
feat(environment): build agent environments from a prompt (#6946)
* feat(environment): report what an environment serves with an environment-coverage view A new inspect_analysis_view kind over capture Evidence. It projects the state an environment derives with the given template rules and reports each tool as answered from state, replayed with its view reason, a served write, or a withheld write with its reason, the records behind it and a hint about what to record next. The hints cover every write reason, so a new reason without one fails to compile. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(environment): build an environment bundle in one command rea environment-build <capture> [directory] inspects a HAR (or reads capture Evidence), projects the environment manifest from the in-memory Evidence, authenticates the pair, prepares the state and writes the bundle environment-export writes. Every bundle file is byte-identical to the three-step path for the same capture and options. The report adds the capture and manifest identities, the coverage summary, warnings (a loopback capture named after its file, credential-named body members by pointer) and the next command. --dry-run writes nothing. The default template rules are the four the published environments use. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(environment): cover environment-build and the coverage view Domain tests check the hint table against the state view's reasons, the summary, and the view against the environment-state view it summarizes. Service tests build the fixture capture and compare every file with the three-step path, a dry run, loopback naming and the refusals. A CLI test compares a HAR built in one step with the three CLI steps byte for byte, and an MCP test projects the view from every source kind. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(environment): build the real-agentenv lane's bundle with environment-build The lane now runs the command users run: it builds the Grafana-shaped HAR with environment-build and the packed checkout, checks the report, then runs the bundle with agent-env as before. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(environment): document environment-build and the coverage view The agent environments guide opens with the one-step build: the report, the hint for each withheld write reason, and what a bundle ships. The CLI guide, the capture guide and the skill reference name the command and the environment-coverage view. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(environment): harden environment-build after review - The credential scan walks with its own stack, so a deeply nested body cannot crash the build, and it also reports credential-named header names, query names, form body members and string arrays. - The build checks SIGINT between stages: cancelled before the bundle stage it writes nothing, during the write it names the written bundle. - A dry run opens the package tarball, so it refuses what a build refuses. - Repeated template rules are refused, a HAR saved as .json gets a hint, file-derived names follow the bundle name rules, `localhost.` counts as a loopback origin, and the next command is shell-quoted. - --capture-timeout-ms passes through to the HAR inspection, and a missing directory is refused before inspection. - The no-observation hint covers updates and deletes of entities the state never held; the coverage view states that it does not apply the serve-time admission checks; the inspect_analysis_view description names the view. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(environment): state the build's conditions and record its verification The guides now state when the one-step bundle equals the three-step one, which headers inspection excludes, what the credential warning scans, how cancellation behaves, and that the coverage view does not apply the serve-time admission checks. The spec folder records the census, the end to end runs, the gates and the review. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(environment): dispatch a pending interrupt before each build stage check The manifest, state and coverage stages run synchronously, so a SIGINT that arrived during them was only dispatched once the bundle write had begun. Each check now yields first, so an interrupt before the bundle stage cancels the build with nothing written. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(browser): send declared requests from a scenario page with a request step A capture_browser_scenario step `request` sends one declared HTTP request through the page's own fetch, with its cookies and session, the way the application's frontend would, and reads the whole response so the capture records the transaction like any other. The path must resolve to the start URL's origin, and the page must be on that origin when the step runs. Query values and header values may be literals or declared secrets, and a header may read its value from a cookie or a local storage entry, which is then redacted from later records like a declared secret. `expected_status` fails the step on any other status. Scenarios without a request step are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(browser): verify request steps in a real browser through to a built environment verify:browser:request records a write session against a fixture item API that refuses writes without its CSRF cookie header and stored bearer token. It checks that every request lands in its own step, that the page values authenticated each write and appear in no record, header or body, that an unexpected status fails the step and cancels the rest, and that environment-build serves the recorded create, update and delete. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(environment): export environment bundles over MCP export_environment_bundle writes the bundle environment-build writes, from capture Evidence retained in the session or one capture Evidence file, into an absolute output directory that must not exist and whose parent must exist, as extract_firmware and export_web_scripts require; it never creates the parent or reuses a directory. It returns the same report, whose schema now lives in the domain so the CLI and the tool share it, and dry_run reports without writing. A loopback capture without a file needs a name. The build's refusal messages no longer name CLI flags. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(environment): scan scenario credentials, own the dry-run tarball and serialize Evidence once A browser scenario's retained header values and the query parameters of its recorded URLs are scanned for credential names as a HAR's are, through a review projection of its records. A dry run admits and releases the package tarball through the export's regular-file scope, so a close it cannot confirm keeps its owner, and checks for cancellation after that last await. Evidence is written into one exactly sized buffer instead of chunks joined by a copy. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(environment): record the review round's checks Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(skill): build agent environments from a prompt with request steps and the bundle tool Add the environments reference to the skill and install it with setup: record against a disposable instance, sign in through the UI, write with request steps and read each write back, check coverage, re-record by withheld reason and export the bundle. Route it from SKILL.md, name agent environments in the skill description, and document the request step, the export tool and recording writes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor(browser): split the request lane and header resolution into smaller functions Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * style(environment): format the build spec Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(environment): say when an untimed capture learns no write clock Coverage of a capture whose records are not all timed, which includes every browser scenario capture, now states that the state learns no clock, so an update stamped with a server-set modification time stays unexplained-change however often it is recorded. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(skill): give agents a whole scenario shape with step timeouts Agents guessed the scenario schema field by field and two hung on steps without timeout_ms. The reference now starts from a complete scenario with a timeout on every step, and says a scenario capture cannot serve updates the application stamps with a modification time. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(browser): keep request steps on their origin and their page values redacted - Follow no redirects: a redirect fails the step and nothing reaches the location it names (checked in real Chrome), and check the page's origin again in the page as the request is sent. - Send nothing once the step's time has run out or it was cancelled while header values were read; the in-page deadline is what remains of the step's. - Keep every page value redacted under a repeated or colliding label, keep a value's first marker when it is read again, and leave values shorter than 8 characters unredacted rather than rewriting ids, ports and hosts. - Refuse a header name given twice, User-Agent (Chrome drops it) and line breaks in literal values and prefixes; fail before sending when a secret or page value holds them. - Append query entries after the path's literal query without re-encoding it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(environment): document request step limits and word bundle refusals for both surfaces Document redirects, timeouts, page value redaction, HttpOnly cookie sources and header refusals for request steps. Refusals shared by environment-build and export_environment_bundle no longer name CLI flags, and the retained loopback refusal no longer prints an empty file name. The skill reference asks for read-backs after each write, shows the coverage view's source, names package_tarball for unreleased builds and the browser path a scenario ships. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(environment): scan every form occurrence and MIME-less scenario bodies The build's credential scan collapsed form bodies with Object.fromEntries, so a repeated field kept only its last occurrence: `api_key=secret&api_key=` warned about nothing although the Evidence ships the value, and repeated values were undercounted. Form fields are now scanned as ordered name/value pairs, as headers and query strings already are. The review projection of a capture_browser_scenario dropped a request body recorded without a media type, so the scan never saw it. Review keeps such a body's text with an empty media type; the manifest projection still reads only bodies it can classify. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(browser): close request step edge cases from the second review - Append query entries correctly after a path ending in "?", "&" or "#". - Refuse 3xx expected statuses, which an unfollowed redirect can never report, and say a redirected write may already have been applied. - Redact a page value also as fetch sends it, without surrounding spaces and tabs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(environment): document page value body costs, redirects and MCP dry runs Document that reading a page value shrinks the bodies a capture keeps under the default allocation limit, that redirected writes may have landed, that the MCP dry_run still checks its output directory and which refusals name the tool, and keep the .har hint in the HAR-as-JSON refusal for both surfaces. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(environment): record the prompt-to-environment verification Gates, the real-browser lanes, five environments built from prompts by an agent on disposable VMs and evaluated with two models, and the two reviews. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(skill): count rollback failures from the managed skill files The environments reference made the skill eight files, so the recovery tests now derive the counts they expect from MANAGED_SKILL_FILES instead of fixing them at six and seven. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(adb): restore the portable Java float pattern a merge rewrote A lint autofix during a merge unescaped the hyphens in javaFloatValuePattern, which is invalid in a v-mode character class, so the advertised start_adb_activity schema failed to compile in every JS regex mode. The file now matches main. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(browser): show the request step inside a whole scenario Every JSON example in the browser scenario guide is a capture_browser_scenario input the catalog test parses, so the request step example now sits in a launch scenario instead of standing alone. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(environment): scan structured HAR form params and the request side of unattributed scenario transactions A HAR request recorded with postData.params and no text is scanned by those parameters, each occurrence counting, and the review projection keeps the request side of a scenario transaction whose response cannot be attributed, so the credential warning covers what evidence.json ships in both cases. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(environment): validate build paths and read dry-run tarballs * fix(environment): report bodies too large for the credential scan Text bodies over the scan's 4 MiB limit, including a response decoded only as a prefix, are reported as a credential-scan-incomplete warning by record and side, never by content, so an absent credential-named-members warning no longer reads as a complete check. The spec and agent-environments guide also state the path validation and dry-run tarball read that e52ae1cd added. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(verification): release cold source transform services * fix(javascript): retain capture context along covered mutation paths * fix(environment): guard request dispatch and report export limits * fix(environment): admit serialized exports and scan HAR form fallbacks * fix(environment): admit in-memory build inputs against heap headroom and scan SaveHar null-text forms The inspected HAR's Evidence and the projected manifest are checked against live heap headroom before they are serialized, with the same check the file route uses, so a capture too large to parse and seal is refused as resource_constraint before anything is written. A request whose postData text is SaveHar's null is scanned by its structured params. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(environment): measure the credential scan limit in UTF-8 bytes A body counts against the 4 MiB limit by its UTF-8 length, not its UTF-16 code units, so multibyte text over the limit is reported as unscanned instead of parsed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(browser): send request steps only before their deadline and keep page reads on the start origin The page receives the step's absolute deadline and a one-second start window, so a busy page that runs the request late, or after the step is cancelled, sends nothing; local storage is read only on the start origin; the response is drained without keeping its body; an unparseable path is a field issue; retained Evidence is refused for heap headroom before it is serialized; and the skill says how to reach server-assigned ids. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * style: format integrated export admission * fix(javascript): erase inline type imports before binding values * fix(browser): run the request lane under the shared verifier command owner The browser request lane runs each CLI call through createPackageVerifierCommands on a private runtime root, so a timeout, output overflow or failure stops the CLI and the browser it launched before the root is removed, and a failed stop is reported with the root retained. The verification record states the lane's current counts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(environment): scan scenario content by event and read bodies by their media type A browser scenario's credential scan reads every retained network-content event, including a response attached mid-flight and a transaction no record represents, with event pointers, and each transaction URL's query once; the review record projection it replaces is removed. A body is parsed as a form or as JSON by its recorded media type, falling back to its shape, so valid forms such as `password=x&` are scanned and sentences are not read as forms. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com> Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> |
||
|
morluto
|
d9660eb032 |
fix(verifiers): share package command and workspace ownership
Join canonical owned command cleanup before releasing package verifier workspaces. Replace raw package command wrappers, the updater supervisor, WASM cleanup composite, and boolean-only retention with explicit capability ownership. Preserve selected environments, npm arguments, no-deadline calls, clean exit status, and distinct aggregate/per-stream output budgets. Exercise actual timeout descendants, cancellation, retained cleanup retry, and workspace admission. |
||
|
|
166fb0820f |
feat(environment)!: serve the environment state by default (#5351)
* feat(environment): extract the initial state a capture's reads observed Add the environment-state analysis view. From the parents the environment manifest accepts, it extracts the data the capture's reads observed before the first related write: entity types with an identity field (proved by a path parameter or inferred from an identity name), entities with their recorded values and provenance, documents for written non-entity paths, and a render plan per read tool that is kept only when it reproduces the tool's latest initial recordings from the state; every other read tool is a recorded view with the reason. The Evidence is always inferred. Response-body decoding moves to a domain owner shared with replay, exact JSON parsing moves to the owner of the exact-number policy, the manifest and state views share parent admission and record grouping, and projectAnalysisView takes its accumulators as one object. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(environment): bound state at redacted writes; infer identity only from items A scenario write whose URL was redacted has no request line, so it was dropped and reads after it counted as initial state. Such a successful write now joins the timeline with an empty path, whose root relates to every type, so it ends every type's state; a limitation counts them. A list whose recordings were all empty passed the "every listed item carries it" check vacuously and published an identity field nothing showed; it now needs at least one item, else the view stays recorded as no-identity. A value that differed between two request lines of one item tool, such as a query variant, was called volatile, and the gate then substituted each recording's own value; only repeats of one request line now show volatility, so differing lines go through fields-differ. List membership is compared only while a list can still be the whole collection, and merged entities are indexed by type and collection once, so paged captures no longer cost pages times entities (8,000 pages of 40,000 entities: 5.7 s to 0.23 s). Docs and the tool contract say scenario state keeps the capture's redaction markers and how redacted writes bound it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(environment): keep first sightings, one list pointer and linear field unions Entities took the order of the first plan observed, and item plans run before list plans, so a complete list read before its detail reads came out reordered and lost "all" membership; each entity now keeps its earliest recorded sighting. A list plan reused the first recording's pointer for later recordings, so a later response that was itself an entity wrapping a list was read as that list; every recording must now locate the same list. The field union scanned its ordered list for every key, quadratic in an object's width; a set now answers membership. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(environment): keep post-write values and partial lists out of the initial state A value that changed between repeats of one request line was named volatile whenever no write under the type's own root lay between, so a write under another root (for example POST /api/dashboards/db before a second GET /api/search) left its effect in the initial state. Any recorded write between the two observations now leaves every tool of the type recorded with reason fields-differ instead. A list was published with membership "all" even when a total or count envelope member exceeded the number it listed. Such a counter now makes the membership "recorded". Also drop a stale doc comment on ObservedEntity.order. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(environment): scope item-shaped and deleted written paths out of documents State documents are held only for list-shaped paths a POST, PUT or PATCH tool writes. Reads of item-shaped written paths and of paths that are only deleted stay recorded views; the guide now says so and the spec defers them to a later increment of #4933. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(environment): count writes in flight when a value changes between reads The volatility check compared write start positions with the two reads, so a write already in flight when the earlier read started was missed and its effect was named volatile. A write now counts when its interval overlaps the span from the earlier read's start to the later read's end. The check also ran once per changed field and scanned every write. It now runs once per pair of observations, answered by a binary search over the writes in timeline order and the latest end among each prefix. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(environment): catch cross-tool changes across writes; read only item totals A value that changed across a write was caught only between repeats of one tool's request line, so a list read before a write and an item read after it put the post-write value into the initial state. Changes are now classified per entity in timeline order after observation: across any recorded write, a change between repeats of a line or between two lines of the type rewrites the type (every tool recorded as fields-differ); with no write between, a repeat's change is volatile. The classification lives in environmentStateMerge.ts. Any numeric member whose name contained "total" or "count" counted as an item total, so total_pages, account_id or page_count made complete lists partial. Item totals are now members whose name tokens include total or count and none of page, pages or per; a string of digits counts as a number; and a set has_more, next or next-page token member also marks the list partial. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(environment): keep post-write observations out of initial state * fix(environment): retain field provenance and bound state inference work * feat(environment): serve tool calls from the environment state `environment-serve --state <state.json>` serves an environment from the initial state an environment-state view extracted. Read tools whose views are state-backed answer from a live state store: item views render the held entity into the recorded envelope, list views render the collection or the recorded members, and document views return the held value; a missing entity or one lacking a required field is refused, and requests the state cannot answer fall back to their recordings with the reason. The /agentenv data plane implements data/reset, data/add (a rea-state/v1 document as a data part, base64 bytes, a file:// path or an https URL, validated and replaced atomically) and data/get, and the card advertises those operations and an intake declaration. Stage 1 is read-only: write tools are not served in state mode. Without --state nothing changes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(environment): record verification after merging the state view's review fixes Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(environment)!: serve the environment state by default environment-serve derives the environment state at startup by running the environment-state view in-process on the capture with the manifest's template rules, so an environment comes with its state and a user supplies nothing extra. The derived Evidence is the same one inspect-analysis-view produces by hand. --state is removed; --replay-only serves exactly the stateless replay of main. When the state cannot be derived, or its catalog does not fit the discovery budget, the server starts in replay mode, logs the reason and reports it in the stop summary's `state`. Exported bundles serve the state by default too: export derives it the same way, so the verifier's tool count and checked answer match what is served, and the README describes the served mode. BREAKING CHANGE: environment-serve answers read tools from the derived state and does not serve write tools unless --replay-only is given; the stop summary reports `state` instead of `state_evidence_id`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(environment): bound data-plane replies, keep batch order, cancel intake on stop - One /agentenv response is held to 64 MiB: replies are measured as they are produced and one past the budget becomes a -32000 error stating it. - Every message of a batch enters the arrival-order queue on arrival, so another request's reset never lands between them. - Stopping the server, or a caller leaving, cancels the active download and answers queued calls `cancelled` without running them. - file:// URIs name only this host: another host or a network share is refused before anything is opened. - A loaded view value may not give an entity another identity. - List answers refuse a member lacking a field every recording carried, as item answers do. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(environment): keep bodies too deep for the state's nesting out of the state A recorded body at the JSON depth limit was accepted by extraction, then nested a few levels deeper as a document or entity value, so sealing the state Evidence threw and environment-serve and environment-export stopped instead of falling back. stateBodyJson, the one rule extraction and serving share, now treats a body nesting deeper than the limit minus 16 levels as unusable, so its tool stays a recorded view. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(environment): measure data-plane replies before building them 83fcc739 bounded one /agentenv response to 64 MiB, but it still serialized each reply whole before measuring it, so a batch of data/get calls on a large state built every refused reply in full only to drop it. Each reply is now measured in bounded JSON parts (the shared jsonParts encoder), its parts kept only while it fits; a reply past the budget is counted for its exact reply_bytes but never assembled. A test checks that a refused read is never handed to JSON.stringify whole and that its reply_bytes is exact. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(environment): release batch replies as they are encoded; judge exact numbers by value answerBatch kept every settled reply in its pending array until the batch ended, so a batch alternating data/add and data/get held each loaded state alive; each reply now leaves the queue as it is encoded. The exact-number policy judged a number by its recorded spelling, so a state loaded with 1e20 came back from data/get as 100000000000000000000, which data/add refused, breaking the promise that data/get output loads back unchanged. A number is exact only when both its recorded spelling and the one serialization writes are safe, so integers from 2^53 below 1e21 are refused in any spelling; replay keeps such bodies as recorded text. A domain test checks that every accepted number is accepted again once written back. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(environment): keep room for refusals and framing in the reply budget The response budget counted accepted replies only: a budget error that replaced a reply, and a batch's brackets and commas, were not charged, so near 64 MiB later refusals pushed the body past the advertised limit. Every reply still to come now keeps room for its own budget error, and a batch keeps room for its framing, so a refusal always fits and the body never passes the budget. Reply ids and which messages are answered come from one place shared by the replies and the reserve. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(environment): refuse a loaded state that data/get would write past the intake limit data/add measured only the document it was given, while data/get writes the state back with the members a document may omit (types, the state Evidence id, view fields and record citations). A document just under 32 MiB could therefore load and be reported larger than any intake accepts, breaking the data/get then data/add round trip. replace now measures the state as data/get writes it, part by part, and refuses it past the limit, leaving the state unchanged. The limit moves to the state document module, so the application store can read it; the intake re-exports it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(environment): keep merged export checks on the shared test graph Main's export tests installed module mocks for the whole services project, which reuses one module graph. A tarball read failure then missed its importer, and a one-shot heap mock could be taken by another file. Read those through bindings the tests replace for one case. Co-authored-by: morluto <morluto@users.noreply.github.com> * fix(environment): keep a state file whose close failed owned until it closes A file:// data/add that could not close its descriptor dropped the handle, and an admission failure whose cleanup close failed dropped its owner, so nothing could retry the close or report it. The read now runs through withOwnedRegularFile, and a failed close is retained in a server-lifetime ArtifactResourceScope. The next file read retries it first and answers -32000 while it is still open; inline and https documents still load. Closing the served environment retries it again and rejects with the unfinished close. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com> Co-authored-by: gensokyo-dev <gensokyo-dev@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: morluto <morluto@users.noreply.github.com> Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> |
||
|
|
7a0c47bfa4 |
feat(environment): export an environment manifest as an agent environment bundle (#4999)
Export an authenticated capture and environment manifest as a pinned agentenv bundle with provenance, a replay verifier and smoke task. Followups preserve immutable input ownership, bounded discovery, caller paths and numeric values; bind bundle writes and package copying to retained filesystem owners; verify POSIX modes; retain cleanup authority; and verify framework/npm executable selection. Default MCP remains stdio. Validation: pinned Linux toolchain, typecheck/build/lint/format/docs/knip, 452 focused tests, ten product-catalog cases, real GitHub response replay in the generated non-root Docker image, and the real pinned agentenv framework smoke workflow. Platform and resource-measurement limits are recorded in the feature verification document. Co-authored-by: gensokyo-dev <gensokyo-dev@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com> |