Use bounded partial directory pages with a global metadata limit and explicit listing/export warnings. Always inspect the configured entry directly so it remains readable beyond the first page.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Keep active viewer leases and retired runner process proof, while removing expired or disconnected viewer records from the host ledger.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Hold a confined per-project flock across clone, repository validation, checkout, and worktree creation so another agent cannot observe partially created Git state.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Bind generated instructions and skills to fresh attempt-owned snapshot paths, retaining old immutable snapshots without touching persistent user files or provider HOME. Record possible process dispatch only at the actual launch RPC boundary so preparation failures can retire their exact owner safely.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Keep the immutable cache suite and Boat secret configuration acceptance assertion in the combined feature PR while preserving the standalone core review size.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Reserve exact computer generations for graceful suspension, keep provider checkpoints on their persistent remote authority, and fence failed prelaunch attempts before retry. Recover previously retired quiescent Codex checkpoints only with exact ownership and unchanged-byte evidence.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Preserve the two existing additive runtime acceptance suites in the stacked feature PR while keeping browser synchronization fixes in the independently checked core branch.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
* origin/master:
fix(pi-local): avoid embedding model catalogue in errors (#13628)
fix(opencode-local): run in the realized workspace (#11438)
fix(ui): align chat connection and recovery cards (#15771)
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Fence admission and ordinary commands at warm expiry, reserve exact-generation process control for at most thirty seconds of shutdown, and always retire the owned slice after graceful close or timeout.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Persist exact upload ownership before staging, renew a five-minute inactivity lease per chunk, and reclaim verified expired uploads on seed or home admission. Preserve active uploads and unrelated directories, and fence delayed writes and aborts after replacement.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Bound each physical Boat to eight SSH operations with six ordinary slots and four bulk transfers. Preserve command deadlines while queued and always release admission after transport completion or failure.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Preserve historical PRP workspace coordinates and require the recorded lease run plus exact retired owner before rotating authority.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Stream initial personal files through bounded chunks into private staging and atomically publish without replacing an existing home. Keep the home-level runtime directory out of instruction enumeration and seeding while preserving nested user content.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
The combined feature branch retains the complete execution-target tests; this runtime branch preserves the production fix with its existing baseline suite.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
