newos4/modules/test, branch v4.6.156

fix(newos4): second review round — identity for every stock node, load dedup, sweep race, a11y

2026-11-07T18:03:38+00:00

Four models (kimi-k2.7-code, deepseek-v4-pro, minimax-m3, glm-5.3) reviewed the shipped change set. Review log with every accepted and rejected finding: .hermes/plans/2026-11-07_163420-newos4-six-ui-modes.review-log.md - identity guard now covers every snapshot node, not just #terminal-container: terminal.js also binds #output, #command-input, #input-area and #status-bar, so a cloned one leaves the terminal writing into a detached node while the page looks perfect - _restoreStock anchors on the next stock node already home, then on the recorded trailing sibling; a raw child index was measured wrong (terminal,input,status-bar,quick-actions) - _loading map: a double-clicked card or a repeated 'ui easy' loads the mode once - _sweepPending returns while that id is in flight instead of declaring failure at 6 s and overwriting the stored preference - _syncChrome() on every switch (quick-actions was left in the tab order behind the mode root) - picker: role=dialog/aria-modal/labelledby/focus, shown after 600 ms instead of waiting for a registration that never happens with lazy modes, and suppressed when ?ui= already applied - ?ui= must be one of the six; _loadMode only accepts packages['ui-']; hasOwnProperty on modes - VFS names are shell-quoted before reaching api.exec (cat/edit) - refresh generation no longer bumps per tick (slow captures left later panes at '...') - easy: padding shorthand reset the 34 px footer reserve (footer overlapped the composer) - cockpit panes get tabIndex and focus; F1/F12 left to the browser; nothing swallowed in inputs - api.el lost its unused innerHTML sink; the test lost its _parseArgs stub (it hid the regression) - v4.6.155

fix(newos4): four-model review — lazy-load race, restore order, a11y, key handling

2026-11-07T17:56:04+00:00

Reviewed the shipped change set with kimi-k2.7-code, deepseek-v4-pro, glm-5.3 and minimax-m3. Findings below are the ones that survived verification against file:line; the rest are in .hermes/plans/2026-11-07_163420-newos4-six-ui-modes.review-log.md Accepted and fixed: - apply() had no generation token: a lazy mode load that finished after the user switched to another mode force-applied the abandoned one (`apply(want,{force:true})` in the .then). Every apply() now bumps `_loadSeq` and the callback acts only while its token is newest. Same token also removes a double mount: registerMode() already applies the mode as it registers, so the callback was mounting every lazy mode twice (teardown+cleanup twice). - _restoreStock() used the recorded `nextSibling` as insert anchor. Every real mode moves SEVERAL stock nodes (terminal, input, status bar), so the recorded sibling is inside the mode container and every insert fell through to append. Now anchors on the next stock node that is already back home. A raw child index also fails (elements removed shift the indices) — measured order terminal,input,status-bar,quick-actions. - _abortToClassic() left the broken mode persisted and `_pending` set, so the next reload retried the same failure with no way out. It now clears both and stores 'classic'. - ?ui= reached classList.add('wx11-ui-' + id) unvalidated: a space or colon throws a DOMException and boot dies. Validated against /^[a-z][a-z0-9-]{0,15}$/ and no longer persisted (the comment always claimed it was a request, not a preference). - Modes hide .prompt-label, so #command-input had no accessible name at all. The shell sets aria-label once when a mode reparents it. - cockpit: preventDefault on all F1-F8 killed help, the address bar and devtools. F1/F12 are left to the browser and nothing is swallowed when focus is in a text field. - commander: Ctrl/Cmd+K opened the palette even while typing in the composer. Ignored from inside editable elements now. - picker: role=dialog + aria-modal + aria-labelledby + focus on the first card. - api.capture(): strip the quoting characters from argv (capturePipeOutput takes argv). - stale `wx11-ui-*` body class removed on switch instead of accumulating. Rejected with evidence: - "loadModuleFromURL may not return a boolean" — modules/core/module-manager.js:56 returns true on success and :60 false in the catch. Verified by reading the function. - "_abortToClassic does not clear _pending" — it did not; that one is accepted above. The sibling claim that it "leaves the broken mode persisted" was verified by reading the function: it never touched localStorage, so also accepted. - "mm.LATEST_VER / webx11_cache_ver are never set, so the mode URL falls back to ?v=0" — modules/core/module-loader.js:12 sets window.webx11.moduleManager.LATEST_VER and :14-15 writes webx11_cache_ver. Verified live: the mode fetch carries ?v=v4.6.152. - "moduleManager.modules may be a Map" — it is a plain object (terminal.moduleManager.modules .CryptoGzipModule is the documented access path), so ui-commander's Object.keys works. Verified: node modules/test/test-ui-shell.js -> 25/25 (the test now moves TWO stock nodes; a raw-index restore fails it with "terminal-container,input-area,status-bar,quick-actions"); probe-ui-modes.py --cycle against production -> ALL PASS, 13 checks.

feat(newos4): six interface modes (easy -> cockpit) over one terminal

2026-11-07T17:19:47+00:00

Symptom: newOS4 had exactly one layout. A first-time user had no way in that did not require learning commands, and an operator had no surface showing live runtime state; the only way to see heap/VFS/tool-call telemetry was to type cat /sys/... Root cause: no UI layer existed. main.html hard-codes one flex column, and terminal.js binds the stock nodes by id at construction, so an alternative layout had to either duplicate the output stream or reparent the real nodes. Fix: - modules/core/module-uishell.js (new): mode registry, #ui-root, stock-node snapshot/restore, identity check that reverts to classic when a mode removes or clones #terminal-container, shell-docked #ui-foot (the AI stop button exists in every mode), ui command, gated first-run picker, ?ui= honoured only if the mode actually registers, lazy mode loading via the same loader ext modules use. - modules/ext/ui-{easy,chat,studio,workspace,commander,cockpit}.js (new): six reparenting skins with scoped CSS. Workspace/commander/cockpit read real /sys/* mounts and captured command output; no value on screen is invented. - modules/test/test-ui-shell.js (new): 25 assertions - teardown, clone rejection, failed-mount fallback, footer docking, destructive-mode rejection. - terminal.js: register the shell; make one failing ext module stop aborting the rest of the serial load loop (it did, silently, which is why six ui-* files at the end of extKeys never loaded). - module-loader.js: LATEST_VER v4.6.152. The six ui-* keys are deliberately NOT in extKeys - see the rate-limit note below. - admin/scripts/probe-ui-modes.py (new): 6 modes x 2 viewports plus a --cycle pass that switches all seven states on ONE page and asserts the output node keeps its identity. Also fixed, found while testing (pre-existing, production-affecting): - nginx limit_req zone=webx11 burst 50 -> 200. One newOS4 boot fans out ~40 assets; the bucket emptied mid-boot and every later module got 503. Measured in webx11.error.log: "limiting requests, excess: 50.696 by zone webx11" against modules/ext/ui-chat.js. A reload within ~50 s silently broke modules. Sustained rate unchanged at 60r/m. Verified: node modules/test/test-ui-shell.js -> 25/25; removing both _restoreStock() calls measures 20/25 with five FAILs; probe-ui-modes.py --cycle against production -> ALL PASS, 13 checks; served bytes: v4.6.152 x3 in main.html, class UIShellModule x1 in core-bundle.js, six ui-* packages in packages.json.

release(v4.6.150): commit the module work that has been live but uncommitted

2026-11-06T10:45:21+00:00

Operator commit-approve, 2026-11-06. These changes have been served since 2026-11-02/03 while git HEAD still stamped v4.6.146, so the mirror published a tree four builds behind the running instance and the release tag named the wrong build. module-orchestrator.js — orchestrate-parallel reported success it could not prove. Results are now recorded by sub-task id through a resultSink handed to delegateTask (harvest matched by currentTask/lastTask strings, which a later delegation on the same agent overwrote, losing finished work as "agent not found"); the tally counts summaries with status ok instead of Promise.allSettled resolutions (a spawn refusal fulfils with undefined and used to print green); and a busy agent is no longer reused at pool cap, where two siblings erased each other's lease. Guard: modules/test/test-orchestrator-parallel-harvest.js (16 cases, reproduces the one-agent three-sub-task cap case that printed 3/3 succeeded). module-billing.js — the balance said "not signed in — newOS4 sends no session token", which was already false: the browser sends the HttpOnly cookie and parse_bearer_token() falls back to it. `cost` is on by default (the flag was opt-in and nobody knew the command existed; `cost off` opts out) and the command now prints today's platform spend from GET /api/billing/usage?days=1 alongside the session estimate. modules/ext/webdav.js — the inline WebView detector missed "Version/4.0" Android WebViews, including the operator's own phone, so the login offered a Telegram widget that cannot complete there. It now delegates to modules/wx11-tg-webview.js when the page loaded it and keeps a matching fallback (wv token, Version/4.0-Android, Telegram, FBAN/Instagram/Line). modules/ext/media.js — text analysis model renamed deepseek-v4-flash -> deepseek-v4.1-flash in both the field and the printed label. main.html + module-loader.js — v4.6.146 -> v4.6.150 in LATEST_VER and the three asset queries; core-bundle.js rebuilt (rebuild-bundles.py reports it already in sync, 1,250,569 bytes). Verified: node --check on all six scripts and the new test; the 16-case orchestrator guard passes against the deployed bundle (ORCH_SRC=...); bundle rebuild is a no-op; core-bundle.js?v=v4.6.150 answers 200.

fix(newos4): read_file pages were silently truncated; delegation no longer invents "completed"

2026-11-02T20:21:24+00:00

Two defects found by re-deriving a report that claimed both were still open. read_file paging (module-aiassist.js) - A page larger than the result clip was clipped AFTER read_file had computed next_offset. On the last page next_offset is null, so the model was told truncated:false while its tail had been removed: measured 11 890 of 19 999 chars delivered, returned:19999, no pointer to the rest - 8 109 chars lost with no way to ask for them. * the clip now sets truncated=true and next_offset=offset+keep when it removes the tail of a page that had no continuation (and never splits a surrogate pair) * read_file caps a page at the result budget (min(pageCap, toolResultChars-200)), so a page is always delivered whole and next_offset is exactly contiguous Live v4.6.143: 19 999-char file -> page 11 800 (next_offset 11 800), page 2 8 199 (next_offset null): 11 800 + 8 199 = 19 999, nothing withheld. A model asking for limit:32000 is clamped to 11 800 and told truncated:true. The ~500-char symptom was the 500-char floor: a caller passing limit:200 gets 500, which is why targeted sed -n reads looked better than the tool. Delegation reporting (module-orchestrator.js, module-aiassist.js) - chat() returning {content} was already fixed in 8a9333b, but three other places still substituted the word "completed" for an absent answer, so the symptom survived: delegateTask's outbox wrote status:'completed' even when the worker returned nothing; the delegate_task tool returned {success:true, result:"completed"}; orchestrate-parallel summarised an unmatched agent as {status:'ok', result:'completed (agent recycled)'} and a missing outbox as "completed (no outbox)". - Now: an empty/undefined answer is status 'failed' with error 'agent produced no answer' / 'no result in outbox' / 'agent not found — result unverifiable', and the tool returns success:false with result:null. Tests: test-delegation-reporting.js 6 (RED 3/6 against HEAD: D3/D4 success:true, D5 the literal "completed"), test-tool-context-bound 26 with E6-E8 (RED 24/2: truncated:false, next_offset null). maintain 27/27.

fix(newos4): memory-graph loads stop rewriting user data; unknown sizes say unknown

2026-11-02T20:15:28+00:00

Three follow-ups from the merge review, each with the assertion that pins it. module-memory-graph.js - _normalizeEdges no longer mutates stored weights. It capped legacy 'failed' edges from 0.8 to 0.2 in memory, and the next debounced save made that permanent - an irreversible migration of the user's graph with no schema version. The cap moved to _effectiveWeight(), which ranking (showStats "Strongest relationships"), the session view and prune() now use; the stored record is left exactly as written. - config.json is stamped version: 2 so a future format change can migrate deliberately. ext/webdav.js - the two fallback parsers emit size: null instead of 0. They cannot see the size column, and 0 rendered as "0 B" - the same "every file looks empty" symptom as the parseInt bug fixed in e639c2d, one regex miss away. - _formatSize(null) renders '—' (unknown) rather than '0 B'; 0 still renders '0 B'. module-aiassist.js - the lock timeout now says what to do: "AI is still busy with another turn (waited Ns). Wait for it to finish, or run 'ai-stop' and retry - the running turn's lock is left alone." It used to be a dead-end string. Tests: test-memory-graph 39 (T6.4 rewritten to the read-time contract: stored weight stays 0.8, effective 0.2, success unaffected), test-webdav-sizes 28 (A14d null -> '—'). maintain 26/26, live v4.6.141: _effectiveWeight 0.2 with the edge object unchanged, _formatSize(null) '—', '0 B' still '0 B'.

fix(newos4): WebDAV listing sizes + pull, and five MemoryGraph defects

2026-11-02T20:05:58+00:00

Closes STEER-20261102-205416-facd and STEER-20261102-204031-f82a. WebDAV (modules/ext/webdav.js): - listings showed "21 B" for a 21 KB file: nginx emits humanised sizes (autoindex_exact_size off, vhost :412) and _parseAutoindex did parseInt("21K"). _parseAutoindexSize() handles K/M/G, decimals, lowercase and "-"; PROPFIND's exact getcontentlength path is untouched. - webdav-pull into a missing local directory printed "Pulled: ... (N bytes)" and wrote nothing: it ignored fs.writeFile's false return (virtual-fs.js:561). It now creates the parent chain, checks the write, and only reports success after a confirmed write. The byte count uses TextEncoder, not .length (a Cyrillic file under-reported ~2x). - _formatSize gained the GB branch the parser already accepted (3 GB printed "3072.0 MB") and no longer prints "NaN MB" for a missing size. MemoryGraph (modules/core/module-memory-graph.js): - addEdge averages weights, so every repeat pulled a strong edge toward the call site's constant (0.9 -> 0.7 -> 0.6). Now Math.max, with decay left to applyDecay(); prune() untouched. - task ids were `task-${Date.now()}`, so re-submitting a task never deduped: now a hash of agent + normalised text. - recordFileAccess no longer records the graph's own /.memory_graph/ store. - failed tool calls were weighted 0.8 vs success 0.5, so showStats ranked failures as strongest: now 0.2. Legacy 0.8 failures are capped on load. - concept ids keep punctuation ("concept:(v2!),"): slugged, and the slug uses \p{L}\p{N} so Cyrillic/CJK/accented text still yields nodes -- an a-z0-9 slug silently produced none. Review findings folded in from the regression pass: the non-Latin regression (a-z0-9 slug), the GB formatter asymmetry, and the pull byte count were all found by review, not by the patch authors, and each now has a test. Tests: test-webdav-sizes.js 27 (was RED 15/24 before the fix), test-memory-graph.js 37 (RED 17/32), both auto-discovered by newos4-maintain -- 26/26 node tests. Live on v4.6.140: _parseAutoindexSize('21K') 21504, _formatSize -> "21.0 KB", _formatSize(2GiB) "2.0 GB", slug Cyrillic "исправить-парсер-ошибок", 0 console errors.

perf(newos4): delegated agent runs no longer serialise; a waiter can't steal a lock

2026-11-02T19:55:56+00:00

Closes the second half of STEER-20261102-201045-ab08. - chat() gated the main-turn lock on nothing, so orchestrate-parallel's fan-out (each sub-task calling chat() on the same instance with its own agentTag) ran strictly one at a time. Measured 2x300ms delegated runs: 617ms before, 306ms now; the two 200ms user turns still take 400ms (main path stays serialised). - the 10s lock timeout called this._chatLock = false and printed "force released", which cleared a lock the waiter did not own - that released the main turn's lock while it was still running. A waiter now throws and the owner is the only writer. - delegated runs no longer clear the user's cancel flag on entry (an agent start used to reset this._cancelled, disarming a Stop the user had pressed). - tool-log entries carry the run they belong to and _recentToolLog(tag, n) is what feeds the run log line and _postRunReview, so concurrent runs no longer consume each other's entries. Known limit, unchanged: _currentTag is a single field, so under true concurrency an entry can be attributed to the wrong run (telemetry only - the answers are per-session). Namespacing it properly needs per-call state threading. Test: modules/test/test-chat-concurrency.js, 7 assertions, RED before (H1 617ms, H3 force-released, H5 no tags) and GREEN now; maintain 24/24.

test(newos4): guard chat()'s return and tool-turn survival

2026-11-02T19:51:14+00:00

The regression in 32608bc shipped because nothing exercised chat() itself. test-chat-return.js runs 7 assertions against the real module: a tool-using turn must not throw, must return {content, toolTurns}, the orchestrator projection must keep the answer, a tool-free turn must return too, the lock must be released after a failed turn, and a second turn must return its own answer. Green 7/7 on 8a9333b; against 32608bc it exits 1 (ReferenceError: recent). Auto-discovered by newos4-maintain (23/23 node tests).

feat(newos4): configurable tool budgets, per-model defaults, real tool telemetry

2026-11-02T19:46:18+00:00

Closes STEER-20261102-201234-7200 (read_file capped at 6000 while the schema promised 32000). Budgets (module-aiassist.js + new modules/core/model-profiles.js): - one resolver, precedence: call arg -> loop profile -> model profile -> ai-config -> code default. Keys: read-page-chars, read-result-chars, tool-context-budget, fetch-chars. - model classes tiny/small/mid/large keyed by id then by size token; `mid` reproduces the old numbers so nothing moves for a mid model. - _clipToolResult now clips the `content` field, never the serialised JSON envelope: clipping the envelope deleted truncated/next_offset, so a 16k page lost its continuation pointer (the reported symptom). - read_file's schema no longer promises a number the model class may not give. Telemetry: - _recordToolCall keeps sizes, duration, ok and a 120-char arg preview instead of the whole payload; ai-stats prints calls / ok% / avg ms / KB / truncation from localStorage webx11_tool_stats. Server (api/proxy-api.py): - /api/extract honours max_chars (default 12000, cap 100000) and returns content_chars + truncated; the bs4 branch is no longer uncapped while the regex fallback was silently cut at 10 000. BEHAVIOUR CHANGE: num_ctx for a model with no explicit setting now follows the class default (16384 -> 65536 for cloud/large, 8192 for tiny). Cloud models bill on tokens used, so cost is unchanged; local models get a bigger KV cache. Two build traps, both now documented in AGENTS.md: - model-profiles.js must be the FIRST entry in CORE_FILES and must export the MODEL_PROFILES global (a TDZ typeof throws; without the global every budget silently falls back to the code default). - a budget key needs the setter branch AND the constructor loader at module-aiassist.js:49 - persisting without restoring looks fine until reload. Verified: test-tool-context-bound 23/23 (RED before: E1-E4 + TypeError on _toolLimit); live bundle read_page 32000 / result 12000 / budget 48000 / fetch 12000 and _ctxTokens 65536 for gemma4:31b-cloud; /api/extract 28970 -> 500 chars with truncated true; ai-config write+restore probe 6/6.