Retry the normal Agents link within a bounded deadline and use the ordinary dismissal control if the asynchronously loaded announcement covers it. Preserve the company-isolation and history assertions.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Reproduce the page/sidebar mismatch after a real manual switch and browser history navigation. Dismiss covering announcements through the normal UI. Preserve dense ZIP bytes with a CRC table and bound cold CLI health inside the existing setup budget.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Co-Authored-By: Paperclip <noreply@paperclip.ing>
* codex/hermes-routines:
fix(ui): scope canonical agents to their authorized company
test(server): drain runtime writes and load routes in setup
Keep alias caches and redirects on the agent company. Defer remembered UUID paths until canonical resolution and verify organization switching with a delayed public alias response.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Restore directory write access inside the private worker home before removal, without following external directory symlinks.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Refresh both source-owned native parent pins for the sandbox payload change. Retain the prior reviewed interpreter and dependency entries; only tool_process.py changes.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Provide the minimal bubblewrap device mount for native shell redirects and atomic writes, probe it before credential staging, and cover concurrent writes plus protected paths.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Count serialized message, attachments, and metadata before turn admission. Keep TypeScript and Rust on a 7 MiB encoded content allowance within the existing encrypted frame bound. Validate before active-turn state changes, and prove accepted images and escaped documents traverse the secure PRP command frame.
Validation: 28 attachment/permission tests, two encrypted-frame regressions, the Rust encoded-admission regression, and Runner TypeScript compilation passed.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Qualification exposed denied plan workflows, missing structured tool output, and cancellation replay in subsequent turns. Admit assigned control-plane operations through their existing semantic authority, project denied native calls by identity, and keep managed history restoration separate from transcript replay.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Require the caller-verified target lock checksum instead of an incompatible checked-in default. Document lock-bot ownership and the companion browser qualification PR.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Keep history reconstruction without publishing restored text and tools as live output. Version the changed Cursor contract as profile 16 and retain replay compatibility.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Reject replaced learned-state parents, include authenticated run attachment and the advertised native transport fixtures in this candidate. Keep paid browser campaign definitions in the qualification PR.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Keep owned-routine lock acquisition nonblocking after run authority locks. A scheduled firing can finish, and the same mutation may retry without a saved partial receipt. The real concurrency regression is added; local PostgreSQL bootstrap failed before assertions, so its execution still requires CI. Server typecheck passes.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Apply the reviewed change for fix: retain the original repository for reused task workspaces.
Validation: required local typecheck and tests, passing CI, Greptile 5/5, and independent review of the exact source head.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Apply the reviewed change for Isolate ACPX admission deadline tests from lease ports.
Validation: required local typecheck and tests, passing CI, Greptile 5/5, and independent review of the exact source head.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Apply the reviewed change for Distinguish failed Git inspection from missing worktree registration.
Validation: required local typecheck and tests, passing CI, Greptile 5/5, and independent review of the exact source head.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Apply the reviewed change for Explain refused local Hermes gateway connections.
Validation: required local typecheck and tests, passing CI, Greptile 5/5, and independent review of the exact source head.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Apply the reviewed change for Keep proven local workspace configuration conflicts out of Sentry.
Validation: required local typecheck and tests, passing CI, Greptile 5/5, and independent review of the exact source head.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Auto-generated lockfile refresh after dependencies changed on master.
This PR only updates pnpm-lock.yaml.
Co-authored-by: lockfile-bot <lockfile-bot@users.noreply.github.com>
