| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
S1 (reported by agent-os4-maint-01, wrongly refuted by the chat auto-reply):
wget existed but was unusable and dishonest.
- Cause 1: _cmdWget used the page's own fetch(url), so every cross-origin URL
died on CORS ("Failed to fetch"). Measured in the served v4.6.150 page:
fetch(cgit README) threw, /api/fetch returned 200/1954 bytes.
- Cause 2: _vfsWriteBytes ignored writeFile()'s boolean, so the command printed
a green tick when the target directory did not exist. Measured:
fs.writeFile('nosuchdir/x.txt') === false.
- Cause 3: bytes were round-tripped through String.fromCharCode, mangling UTF-8.
- Fix: fetch through /api/fetch (raw source), mkdir -p, writeFile + read-back
verification, error instead of a tick on failure. Register curl with
-s/-o parsing delegating to the same writer so the two cannot drift.
S2 (same reporter): web_fetch could not page and said it could.
- Cause: the handler honoured max_chars up to 50 000, then _clipToolResult kept
toolResultChars-200 = 11 800, so 38 200 chars vanished silently; offset was
not in the schema and was never read, so next_offset pointed at a page the
caller could not request again.
- Fix: offset/next_offset/total_chars/source_bytes in the contract; the page is
built, measured against the clip budget and shrunk until the envelope fits,
so next_offset - returned_chars is always 0.
- Also fixed: _clipToolResult appended "0 of N chars withheld" when the content
already fitted, claiming a loss that did not happen.
C1: fetch <url> --save=FILE — the only terminal path from a remote URL to the
VFS, so a 90 KB source page no longer has to be read through 3 000-char
scrollback.
Proxy: /api/extract now returns source_bytes (raw page size) and
content_chars_utf16. Python len() counts code points while JS String.length
counts UTF-16 units; 7 astral characters in the changelog left a 7-char gap at
the end of a 90 KB page (measured). _html_ok declares charset=utf-8.
Verified: node --check on all four modules; py_compile; bundles rebuilt;
served bytes identical to disk for all five assets at ?v=v4.6.151; live in the
browser: curl -s -o review/main.md <cross-origin> saved 1954 chars with the
correct head, a 404 wrote no file, fetch --save wrote 91 518 chars,
web_fetch p1 returned 11 754 with next_offset 11 754 (gap 0), page 2 started at
a different offset with next 23 496.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Operator commit-approve, 2026-11-06. These changes have been served since
2026-11-02/03 while git HEAD still stamped v4.6.146, so the mirror published a
tree four builds behind the running instance and the release tag named the
wrong build.
module-orchestrator.js — orchestrate-parallel reported success it could not
prove. Results are now recorded by sub-task id through a resultSink handed to
delegateTask (harvest matched by currentTask/lastTask strings, which a later
delegation on the same agent overwrote, losing finished work as "agent not
found"); the tally counts summaries with status ok instead of
Promise.allSettled resolutions (a spawn refusal fulfils with undefined and used
to print green); and a busy agent is no longer reused at pool cap, where two
siblings erased each other's lease. Guard:
modules/test/test-orchestrator-parallel-harvest.js (16 cases, reproduces the
one-agent three-sub-task cap case that printed 3/3 succeeded).
module-billing.js — the balance said "not signed in — newOS4 sends no session
token", which was already false: the browser sends the HttpOnly cookie and
parse_bearer_token() falls back to it. `cost` is on by default (the flag was
opt-in and nobody knew the command existed; `cost off` opts out) and the
command now prints today's platform spend from GET /api/billing/usage?days=1
alongside the session estimate.
modules/ext/webdav.js — the inline WebView detector missed "Version/4.0"
Android WebViews, including the operator's own phone, so the login offered a
Telegram widget that cannot complete there. It now delegates to
modules/wx11-tg-webview.js when the page loaded it and keeps a matching
fallback (wv token, Version/4.0-Android, Telegram, FBAN/Instagram/Line).
modules/ext/media.js — text analysis model renamed deepseek-v4-flash ->
deepseek-v4.1-flash in both the field and the printed label.
main.html + module-loader.js — v4.6.146 -> v4.6.150 in LATEST_VER and the three
asset queries; core-bundle.js rebuilt (rebuild-bundles.py reports it already
in sync, 1,250,569 bytes).
Verified: node --check on all six scripts and the new test; the 16-case
orchestrator guard passes against the deployed bundle (ORCH_SRC=...); bundle
rebuild is a no-op; core-bundle.js?v=v4.6.150 answers 200.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Two dashboards existed and had drifted apart: root /dashboard.html (118 KB single file with
Subscription & Usage + API Keys) and /spaces/dashboard.html (34 KB shell + assets/js/dashboard-*.js).
The nginx log settles which one is real: 77.211.5.129 requests /spaces/dashboard.html and never
the root page. Tonight's fixes landed on the root page twice before that was noticed.
Neither page was a superset, so deleting outright would have lost features:
root only -> Subscription & Usage card, API Keys card (create/revoke/reveal)
spaces only -> 2FA/TOTP, change password, delete space, email change, files, logs
assets/js/dashboard-billing.js + assets/css/dashboard-billing.css (new)
loadSubscription / loadApiKeys / cancelSubscription / createApiKey / revokeApiKey /
copyNewApiKey / dismissNewKey + isProPlusPlan / capPlan, lifted verbatim from the root page,
wrapped in an IIFE that re-exports the onclick handlers on window; getAuthHeaders() reads the
modular app's localStorage.webx11_session_id; PRO_PLUS_PLANS carried over (its absence threw
"PRO_PLUS_PLANS is not defined" and silently hid both cards on the first attempt)
spaces/dashboard.html
the two cards inserted after the Activity Logs card, plus the css/js includes
dashboard-auth.js showDashboard() calls loadSubscription() once the view is up
retirement
root dashboard.html deleted (git rm); `location = /dashboard.html { return 301
/spaces/dashboard.html$is_args$args; }` so bookmarks keep working and ?next= survives
links repointed in ai-api.html (6), ai-course.html (3), models.html (1), newOS4 hint string
(v4.6.146 + rebuilt bundles so the cached bundle cannot serve the old URL)
Measured (playwright, 390x844 WebView UA, agando's real session):
subscriptionCard display block, height 315px, plan "Free", price "EUR0/mo", badge "Free",
usage "$0.00 / inf", API-keys card hidden for a free plan, 0 console warnings
/dashboard.html?next=/skills.html -> 301 -> /spaces/dashboard.html?next=/skills.html, 200,
login card + Telegram button present
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Third occurrence of the same class of bug, and the first fix is why: commit e95b7be
(2026-11-01, "multi-session .newsession v3") touched exactly ONE hunk of
auth-file-api.py — handle_login. handle_device_poll, handle_telegram_login and
handle_register kept overwriting the whole .newsession with a single-session v2
payload, so a phone sign-in logged the desktop out and the loser held a session id
no store knew: permanent `401 Invalid session or API key` (newOS4 asked for a login
it could never complete). Measured: agando's store held 1 entry (sha8 45cb7819) while
the phone sent 9ac607f1 for 3 h; 26 device-polls in 2 s from one page minted 26
cookies and only the last write survived, which also drained the shared nginx
`webx11` zone (11x 503 on /admin/api/*).
api/webx11_auth.py
- add_session() is now THE writer: v3 `sessions[]` (cap 5) under a per-user
`flock` (LOCK_DIR outside the spaces), plus the legacy `.session` mirror
- module-level import so no handler has to reach for it lazily
api/auth-file-api.py
- device-poll / telegram-login / register / recover-by-backup-code all call
add_session(); a bare write_newsession_file() is now only the admin-gated
handle_create_session
- handle_device_poll runs its approved branch under a per-code `flock` and mints
exactly one session per approved code (idempotent under a poll storm), with a
cheap pre-lock reject so unvalidated codes cannot mint lock files
- handle_me_cookie expires an unknown session cookie (Set-Cookie Max-Age=0,
code SESSION_DEAD): the cookie is HttpOnly, so no page could ever clear a dead
credential and every load re-sent it
api/newcrypto.py
- write_newsession_file() is atomic (tmp + fsync + os.replace); the temp name
carries pid+tid because a fixed `<file>.tmp` lets two concurrent writers of one
store steal each other's temp file (reproduced: FileNotFoundError)
admin-login.html single-flight poll (polling/finished guards) — 26 calls -> 1
dashboard.html device-code fallback when the Telegram popup has no opener
spaces/newos4/* 401 -> session-repair notice + endpoint normalisation, v4.6.144
nginx /api/auth/ + /api/security/ on zone wx11auth (120r/m, burst 60)
admin/scripts/verify-session-writers.py NEW static guard, wired into smoke-auth.sh
Proof (live, after restart): 5 concurrent polls on one approved code -> 5x approved,
1 distinct session id, store v3 with 2 entries, pre-fix session still valid; dead
cookie -> 401 + Set-Cookie expiry, valid cookie -> 200; 200-call auth burst -> 503s
only on /api/auth/, /admin/ stayed 302; smoke-auth.sh PASS. Guard RED (3 offenders)
-> GREEN. Backups: /home/darkbot/backups/authfix-20261102_214424
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
invents "completed"
Two defects found by re-deriving a report that claimed both were still open.
read_file paging (module-aiassist.js)
- A page larger than the result clip was clipped AFTER read_file had computed
next_offset. On the last page next_offset is null, so the model was told
truncated:false while its tail had been removed: measured 11 890 of 19 999
chars delivered, returned:19999, no pointer to the rest - 8 109 chars lost
with no way to ask for them.
* the clip now sets truncated=true and next_offset=offset+keep when it removes
the tail of a page that had no continuation (and never splits a surrogate pair)
* read_file caps a page at the result budget (min(pageCap, toolResultChars-200)),
so a page is always delivered whole and next_offset is exactly contiguous
Live v4.6.143: 19 999-char file -> page 11 800 (next_offset 11 800), page 2
8 199 (next_offset null): 11 800 + 8 199 = 19 999, nothing withheld. A model
asking for limit:32000 is clamped to 11 800 and told truncated:true.
The ~500-char symptom was the 500-char floor: a caller passing limit:200 gets
500, which is why targeted sed -n reads looked better than the tool.
Delegation reporting (module-orchestrator.js, module-aiassist.js)
- chat() returning {content} was already fixed in 8a9333b, but three other places
still substituted the word "completed" for an absent answer, so the symptom
survived: delegateTask's outbox wrote status:'completed' even when the worker
returned nothing; the delegate_task tool returned {success:true, result:"completed"};
orchestrate-parallel summarised an unmatched agent as {status:'ok',
result:'completed (agent recycled)'} and a missing outbox as "completed (no outbox)".
- Now: an empty/undefined answer is status 'failed' with error 'agent produced no
answer' / 'no result in outbox' / 'agent not found — result unverifiable', and
the tool returns success:false with result:null.
Tests: test-delegation-reporting.js 6 (RED 3/6 against HEAD: D3/D4 success:true,
D5 the literal "completed"), test-tool-context-bound 26 with E6-E8 (RED 24/2:
truncated:false, next_offset null). maintain 27/27.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
unknown
Three follow-ups from the merge review, each with the assertion that pins it.
module-memory-graph.js
- _normalizeEdges no longer mutates stored weights. It capped legacy 'failed' edges
from 0.8 to 0.2 in memory, and the next debounced save made that permanent - an
irreversible migration of the user's graph with no schema version. The cap moved to
_effectiveWeight(), which ranking (showStats "Strongest relationships"), the session
view and prune() now use; the stored record is left exactly as written.
- config.json is stamped version: 2 so a future format change can migrate deliberately.
ext/webdav.js
- the two fallback parsers emit size: null instead of 0. They cannot see the size
column, and 0 rendered as "0 B" - the same "every file looks empty" symptom as the
parseInt bug fixed in e639c2d, one regex miss away.
- _formatSize(null) renders '—' (unknown) rather than '0 B'; 0 still renders '0 B'.
module-aiassist.js
- the lock timeout now says what to do: "AI is still busy with another turn (waited Ns).
Wait for it to finish, or run 'ai-stop' and retry - the running turn's lock is left
alone." It used to be a dead-end string.
Tests: test-memory-graph 39 (T6.4 rewritten to the read-time contract: stored weight
stays 0.8, effective 0.2, success unaffected), test-webdav-sizes 28 (A14d null -> '—').
maintain 26/26, live v4.6.141: _effectiveWeight 0.2 with the edge object unchanged,
_formatSize(null) '—', '0 B' still '0 B'.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Closes STEER-20261102-205416-facd and STEER-20261102-204031-f82a.
WebDAV (modules/ext/webdav.js):
- listings showed "21 B" for a 21 KB file: nginx emits humanised sizes
(autoindex_exact_size off, vhost :412) and _parseAutoindex did parseInt("21K").
_parseAutoindexSize() handles K/M/G, decimals, lowercase and "-"; PROPFIND's
exact getcontentlength path is untouched.
- webdav-pull into a missing local directory printed "Pulled: ... (N bytes)" and
wrote nothing: it ignored fs.writeFile's false return (virtual-fs.js:561).
It now creates the parent chain, checks the write, and only reports success
after a confirmed write. The byte count uses TextEncoder, not .length
(a Cyrillic file under-reported ~2x).
- _formatSize gained the GB branch the parser already accepted (3 GB printed
"3072.0 MB") and no longer prints "NaN MB" for a missing size.
MemoryGraph (modules/core/module-memory-graph.js):
- addEdge averages weights, so every repeat pulled a strong edge toward the
call site's constant (0.9 -> 0.7 -> 0.6). Now Math.max, with decay left to
applyDecay(); prune() untouched.
- task ids were `task-${Date.now()}`, so re-submitting a task never deduped:
now a hash of agent + normalised text.
- recordFileAccess no longer records the graph's own /.memory_graph/ store.
- failed tool calls were weighted 0.8 vs success 0.5, so showStats ranked
failures as strongest: now 0.2. Legacy 0.8 failures are capped on load.
- concept ids keep punctuation ("concept:(v2!),"): slugged, and the slug uses
\p{L}\p{N} so Cyrillic/CJK/accented text still yields nodes -- an a-z0-9 slug
silently produced none.
Review findings folded in from the regression pass: the non-Latin regression
(a-z0-9 slug), the GB formatter asymmetry, and the pull byte count were all
found by review, not by the patch authors, and each now has a test.
Tests: test-webdav-sizes.js 27 (was RED 15/24 before the fix), test-memory-graph.js
37 (RED 17/32), both auto-discovered by newos4-maintain -- 26/26 node tests.
Live on v4.6.140: _parseAutoindexSize('21K') 21504, _formatSize -> "21.0 KB",
_formatSize(2GiB) "2.0 GB", slug Cyrillic "исправить-парсер-ошибок", 0 console errors.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
a lock
Closes the second half of STEER-20261102-201045-ab08.
- chat() gated the main-turn lock on nothing, so orchestrate-parallel's fan-out
(each sub-task calling chat() on the same instance with its own agentTag) ran
strictly one at a time. Measured 2x300ms delegated runs: 617ms before, 306ms
now; the two 200ms user turns still take 400ms (main path stays serialised).
- the 10s lock timeout called this._chatLock = false and printed "force
released", which cleared a lock the waiter did not own - that released the
main turn's lock while it was still running. A waiter now throws and the owner
is the only writer.
- delegated runs no longer clear the user's cancel flag on entry (an agent start
used to reset this._cancelled, disarming a Stop the user had pressed).
- tool-log entries carry the run they belong to and _recentToolLog(tag, n) is
what feeds the run log line and _postRunReview, so concurrent runs no longer
consume each other's entries.
Known limit, unchanged: _currentTag is a single field, so under true concurrency
an entry can be attributed to the wrong run (telemetry only - the answers are
per-session). Namespacing it properly needs per-call state threading.
Test: modules/test/test-chat-concurrency.js, 7 assertions, RED before
(H1 617ms, H3 force-released, H5 no tags) and GREEN now; maintain 24/24.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Regression from 32608bc, caught by the .chat() caller sweep before it aged:
- `recent` was referenced in chat()'s finally block but never declared, so any
turn with toolTurns > 0 threw ReferenceError there and chat() REJECTED.
delegateTask's catch turned that into "agent failed"; the 'completed'
fallback was only ever reachable on tool-free turns.
- chat() still had no return at all, so a tool-free turn resolved undefined and
module-orchestrator.js:1250 fell through to `|| 'completed'`.
Both fixed: `const recent` is now built from _toolCallLog, and chat() returns
{ content: finalAnswer, toolTurns } before the archive block (a return at the
end of the method would let _archiveSession swallow the answer).
Verified with /tmp/probe-chat-hotfix.js, 6/6: tool-using turn resolves
{content:'WORKER ANSWER', toolTurns:2}, tool-free turn resolves the answer,
the orchestrator's own projection returns the answer instead of 'completed',
and _chatLock is released. Run against 32608bc the same probe says
"recent is not defined" - i.e. it reproduces the shipped defect.
Not included: the _chatLock serialisation (orchestrate-parallel still runs
sub-tasks one at a time and the 10s force-release can clear the main turn's
lock). That stays open in STEER-20261102-201045-ab08.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Closes STEER-20261102-201234-7200 (read_file capped at 6000 while the schema
promised 32000).
Budgets (module-aiassist.js + new modules/core/model-profiles.js):
- one resolver, precedence: call arg -> loop profile -> model profile ->
ai-config -> code default. Keys: read-page-chars, read-result-chars,
tool-context-budget, fetch-chars.
- model classes tiny/small/mid/large keyed by id then by size token; `mid`
reproduces the old numbers so nothing moves for a mid model.
- _clipToolResult now clips the `content` field, never the serialised JSON
envelope: clipping the envelope deleted truncated/next_offset, so a 16k page
lost its continuation pointer (the reported symptom).
- read_file's schema no longer promises a number the model class may not give.
Telemetry:
- _recordToolCall keeps sizes, duration, ok and a 120-char arg preview instead
of the whole payload; ai-stats prints calls / ok% / avg ms / KB / truncation
from localStorage webx11_tool_stats.
Server (api/proxy-api.py):
- /api/extract honours max_chars (default 12000, cap 100000) and returns
content_chars + truncated; the bs4 branch is no longer uncapped while the
regex fallback was silently cut at 10 000.
BEHAVIOUR CHANGE: num_ctx for a model with no explicit setting now follows the
class default (16384 -> 65536 for cloud/large, 8192 for tiny). Cloud models bill
on tokens used, so cost is unchanged; local models get a bigger KV cache.
Two build traps, both now documented in AGENTS.md:
- model-profiles.js must be the FIRST entry in CORE_FILES and must export the
MODEL_PROFILES global (a TDZ typeof throws; without the global every budget
silently falls back to the code default).
- a budget key needs the setter branch AND the constructor loader at
module-aiassist.js:49 - persisting without restoring looks fine until reload.
Verified: test-tool-context-bound 23/23 (RED before: E1-E4 + TypeError on
_toolLimit); live bundle read_page 32000 / result 12000 / budget 48000 /
fetch 12000 and _ctxTokens 65536 for gemma4:31b-cloud; /api/extract 28970 ->
500 chars with truncated true; ai-config write+restore probe 6/6.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Operator policy 2026-11-01: every subscription may call any model, and the free tier resets daily.
Model gate removed (api/ai-gateway.py)
`plan == 'free' and model_weight > 1 -> 403 "Advanced models require Pro"` ran before any money
logic, so a free-plan account holding $1086 of purchased credit was refused and told to upgrade.
A model tier is not something we sell: the allowance and the USD balance bound spend. A caller who
cannot pay now gets the honest 429 (with period + needed amount). model_weight survives only for
track_usage() analytics.
Free allowance: $0.50/month -> $0.10/day
~$3/month retail = $2.14/month of provider cost at 1.4x markup, ~6x the previous giveaway and
still bounded per member (the 50-slot invite cap bounds the total; at full occupancy ~$107/mo or
$2.14/user at 100% utilisation).
The window is policy, not code:
- admin/data/pricing-policy.json: free_tier_usd=0.1, free_tier_period="day"
- wx11_billing: FREE_TIER_PERIOD, allowance_window(plan) (day for free, month for paid),
period_start(window), spend_usd(session, window) — one definition used by BOTH the gateway and
the billing API (the old month_spend_usd duplicate is what let them drift before)
- gateway + /api/billing/subscription now report the same window; plan_allowance gains `period`
- dashboard.html, newOS4 module-billing, chatstudio account panel say "today" when period=day
- published copy: index.html, pricing.html (card + compare table + how-usage-works), i18n planFree1,
admin/docs/ai-gateway.html
- verify-public-claims.py asserts the number AND the period per plan: a right number on the wrong
window is the same defect as a wrong number
newOS4 bundle rebuilt (module-billing), LATEST_VER v4.6.135 -> v4.6.136, main.html cache keys bumped.
Proof:
- verify-public-claims.py rc=0 (copy == policy == live billing API, including periods)
- /api/billing/subscription: limit_usd 0.1, period "day", remaining 0.1
- gateway: gemma4 200, kimi-k2-thinking 502 (gate gone; fake model => upstream 404)
- smoke-auth PASS, smoke-gateway PASS (limit=$0.1 in the payload check)
- live pages serve "$0.10 of AI usage / day", zero $0.50 left on index/pricing/subscriptions
- allowance math: free cap_cost $0.0714/day, pro $7.7779/mo, team $23.35/mo, ent $77.85/mo
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
asking a model (v4.6.135)
`[ -f "/qt.txt" ] && echo exists` — the probe that closed the v4.6.132 batch — was not a shell test
at all: both commands were unregistered, so the line fell through to the AI fallback and a model was
asked whether a file exists. `_evalTest()` has implemented `-f -d -e -z -n ! = !=` for the if/while
parser since the script runner was written; only the command was missing.
* `test` and `[` registered in ShellModule. Success resolves silently; false rejects with a
`silent` error so `&&`/`||` skip it — POSIX prints nothing on exit 1.
* `[` requires the closing bracket (`[ : missing ']'`), and that message is NOT silent.
* `test` already names the on-demand regression-suite runner ("test auto" / "test list" in
help.html). A argv that does not look like a test expression (`-f`/`-d`/`-e`/`-z`/`-n`/`!`,
or `a = b` / `a != b`) is delegated to the handler registered before us, so `test auto`
still runs the suite and the two meanings cannot collide.
* terminal.dispatchCommand() now honours `err.silent` — without it a top-level `test -f /nope`
printed `Error in ShellModule.test:` (measured on v4.6.134, fixed in v4.6.135).
* help.html documents the bracket form next to the existing `test` row.
Three tags were minted minutes apart — v4.6.133 (commands), v4.6.134 (suite delegation),
v4.6.135 (silent top-level) — each a real cache-bust for a fix that superseded the previous build;
the net change is this commit.
Verification
node modules/test/test-shell-test-cmd.js -> 24/24 pass (RED against HEAD: "test command
registered" fails, "m.commands.test is not a function")
node modules/test/test-pipe-guard.js -> all seven flags true
node modules/test/test-parse-args.js -> 28/28 · daily job -> node tests 22/22 pass
newos4-maintain.py -> atlas 355 commands (was 354), modules-index 349, help 364/364
live v4.6.135, read from the terminal DOM:
[ -f /qt.txt ] && echo F135 -> F135
test -f /nope || echo M135 -> M135
[ -d /nope ] && echo BAD || echo N134-> N134 (false branch skipped, nothing printed)
test -> no output (suite not loaded; POSIX false)
test -f /nope -> no output
js "a b".length | wc -c -> 1 (v4.6.132 pipe fix still intact)
The AI fallback is no longer reachable for a bracketed file test.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
status (v4.6.131)
Four items closed in one batch; three ran as parallel subagents on disjoint files, the bundle was
rebuilt once by the parent (rebuild-bundles.py serialises the working tree, which carries other
sessions' work — see 161372f).
1. PIPE STAGES KEEP THEIR QUOTES. `js "a b".length | wc -c` reached eval as `a b.length` and printed
a ReferenceError. terminal.js executePipeChain() now keeps `stages[i]` aligned 1:1 with
`pipeParts[i]` (the `.filter(argv => argv.length > 0)` shifted the index; replaced by a lastStage
scan + `if (argv.length === 0) continue`) and forwards the stage's own text to the dispatcher.
The core path alone was dead code: ShellModule.init() replaces terminal.executePipeChain
(shell.js:144), and that override is what runs in the browser (`executePipeChain.toString()`
contained `cmdText.split`, not `lastStage`). Both now pass `cmdText`/`pipeParts[i]`.
test-pipe-guard.js was rewritten for the new shape and now also asserts the shell override
forwards raw text — the assertion that would have caught the shadowing. RED on HEAD: both flags
false; GREEN now.
2. MAINTENANCE --fix CAN CLEAR ITS OWN WARN. check_index() ran before check_atlas(), which is what
regenerates course/atlas.json, so --fix rebuilt modules-index.json from the stale atlas and the
same WARN reappeared every run. check_atlas() now runs immediately before check_index().
modules-index.json regenerated: cost/usage present, 349 commands, version 2026-10-29-atlas.
3. `cost` DOCUMENTED. modules/core/module-billing.js registers `cost [on|off]` (an alias of `usage`);
help.html had no row. Added above the `usage` row. help coverage 362/363 -> 363/363.
4. SHIPPED PLANS STOP ASKING FOR A DECISION. The applier only flips review<->safe, so every executed
review-gated plan kept counting as an open decision (5 of 5). newos4-feedback-collect.py now reads
the body: a `## Status` / `## Implementation` heading followed by shipped|executed plus a version,
commit or date is `status: done`; those stay in `plans` (visible as shipped) but leave
plans_review and awaiting_decision. Counts: plans_review 5 -> 0, awaiting_decision 4 -> 1
(the remaining one is a real open report, RPT-20261027-160751).
admin/feedback.html read `it.status[0]`, which would render `d` for a string status; it now
prefers `status_lines[0]`.
Also carried, authored by earlier uncommitted sessions and already live in the bundle (attributed,
not silently absorbed): modules/core/module-billing.js (new, BillingModule: cost/usage),
its CORE_FILES entry in scripts/rebuild-bundles.py, and the BillingModule registry entry in
terminal.js. The bundle was rebuilt from HEAD + this batch with ollama-manager.js taken from HEAD,
so another session's in-flight `_httpError` refactor is deliberately NOT in the shipped bundle
(grep -c _httpError core-bundle.js = 0).
Verification
node modules/test/test-pipe-guard.js -> {"empty":[],"blank":[],"classifyGuarded":true,"pipeGuarded":true,"shellForwardsRaw":true}
node modules/test/test-parse-args.js -> 28/28 pass
maintained job -> node tests 21/21 pass
scripts/newos4-maintain.py -> maintenance result: OK (modules-index 349, help 363/363,
changelog current v4.6.131)
live v4.6.131 (real DOM, no print monkey-patch):
js "a b".length | wc -c -> 1 (js printed 3, one byte)
js "a b".length -> 3
js "abc".toUpperCase() -> ABC
echo "two words" -> two words
node -e "import('fs')" -> red error + Node-builtin hint
js 6*7 -> 42
unhandledrejection -> 0
livePipeImpl: shell-override, livePipeForwardsRaw: true, costRegistered: true
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
command line (v4.6.130)
_parseArgs() treats quote characters as delimiters and drops them, so every string literal in a
js expression died before eval: `js "abc".toUpperCase()` reached the module as
`abc.toUpperCase()` → ReferenceError: abc is not defined. Same for `js import('fs')` →
`import(fs)`. Found while verifying the v4.6.128 console fix
(plan 2026-10-29_112000-newos4-parseargs-strips-js-string-literals.md).
- terminal.js: checkAndRun() records the untokenised line (`_currentRaw`), _dispatch() forwards it,
dispatchCommand(cmd, args, rawText) passes it to the module. Security classification still runs
on the tokenised form, and pipes/AI/script-runner calls pass nothing, so they behave as before.
- console.js: `js` evaluates _expr(args, rawText) — the raw remainder. `node -e` deliberately does
NOT: the tokenizer already keeps `'…'` inside `"…"`, and the raw form would hand eval the string
literal `"import('fs')"` instead of the import (caught by the live probe, not by review).
js-run keeps tokenised paths.
- modules/test/test-parse-args.js: tokenizer table (records the deletion as the current contract),
dispatcher plumbing asserts, _expr cases, and the user-visible paths. 27 assertions.
- module-loader.js + main.html + bundle: v4.6.130 (129 was minted, then console.js changed again —
re-minting so no cached client keeps the intermediate).
Verification
node modules/test/test-parse-args.js -> 27/27 pass
same file against HEAD sources (git show HEAD:...) -> TypeError: _expr is not a function (RED)
scripts/lint-no-undef.py terminal.js console.js -> clean, 122 cross-file globals
core-bundle.js rebuilt from HEAD sources + this patch in /tmp/iso (the working tree carries
another session's uncommitted ollama-manager.js `_httpError`); diff vs HEAD bundle = 14 lines,
all mine. critical-ext-bundle.js byte-identical.
Live page v4.6.130 (real executeCommand, output captured):
js "abc".toUpperCase() -> ABC
js 'a b'.split(' ').length -> 2
js JSON.stringify({a:1}) -> {"a":1}
js 6*7 -> 42
js import('fs') -> red "Failed to resolve module specifier 'fs'" + Node-builtin hint
node -e "import('fs')" -> same error + hint (was printing the expression as a string)
echo "two words" -> two words
js-run /nope.js -> js-run: /nope.js: No such file
unhandledrejection count -> 0
The sibling's parked terminal.js hunk (BillingModule registry entry) was stashed for this commit and
is restored in the working tree afterwards; it is not part of this change.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
as one line
Two things I had flagged as "worth your attention" and one leftover nit.
- num_ctx was never sent. Ollama's server-side default context is 2k-4k depending on the build, so
a system prompt + 20 messages + up to 24k chars of tool results could be truncated server-side,
which is exactly the "it forgot what it just read" class of report. Every Ollama request now
carries options.num_ctx (default 16384, overridable via webx11_ollama_numctx, floor 512); the
OpenAI-compatible branch is untouched because num_ctx is not one of its parameters.
- Automatic connect prints one outcome instead of one line per endpoint tried (7 -> 3 on a dead
endpoint). Interactive `ollamaconnect` keeps the per-endpoint detail.
- write_file's failure message no longer echoes a trailing slash.
Verification:
- test-ollama-numctx.js (7 asserts): generate and chat payloads carry num_ctx=16384, a stored
override is used, junk/too-small values fall back, and the /v1/chat/completions branch does not
receive it. RED on HEAD: TypeError reading 'num_ctx' of undefined. Suite 20/20.
- Live v4.6.117, capturing the real request: {"num_ctx":16384} on /api/generate with
model gemma4:31b-cloud, reply "OK".
- Live v4.6.118, dead endpoint (127.0.0.1:9, fallback disabled): automatic -> 3 lines
("connecting on first use…", "Connecting to dead…", "Auto-connect failed — …"); manual
connect() -> 4 lines including "endpoint http://127.0.0.1:9 failed", so the suppression is
conditional, not blanket.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The stdin work in 5cf5010 fixed wc/head/tail but left grep alone, and grep's no-operand branch
sweeps the cwd. Measured on v4.6.115: `cat /gdir/in.txt | grep zzz` answered
`other.txt:1: zzz in a cwd file` — a file that was never piped, and `cat in.txt | grep bbb`
reported the match twice (`in.txt` from the cwd sweep plus `__pipebuf__` from the injected file).
- module-fs.js: when terminal._pipeInput is set and no file operand was given, grep searches the
staged text and prints `<line>: <text>` (stdin has no filename, as in GNU). The cwd sweep stays
for a bare interactive `grep x`.
- shell.js: _isPipeAware now covers only sort/cut/uniq/expand. grep/head/tail/wc read _pipeInput
themselves, so injecting the __pipebuf__ file produced duplicate hits and named stdin results.
Verification:
- test-shell-stdin.js 20 asserts (+4 for grep: no cwd match, non-match reports none, match prints
no filename, -c counts stdin). RED on HEAD: G1/G2/G3 fail with `other.txt:1: zzz in a cwd file`.
- Suite 18/18 files; maintain --fix "node tests 18/18 pass".
- Live v4.6.116 after `cd /gdir` (where other.txt contains zzz):
`cat /gdir/in.txt | grep zzz` -> (no matches) · `| grep bbb` -> `2: bbb` · `| grep -c b` -> 1 ·
`| head -n 2` -> aaa,bbb · `| tail -n 1` -> ccc · `| wc -l` -> 3.
Credit: the false-positive grep was reported by the stdin subagent as an aside; re-derived here
against the live terminal before fixing.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
globs, redirects, stdin
MAINT-021 and MAINT-017, executed from .hermes/plans/2026-10-27_145500-newos4-script-runner.md.
- shell.js: new block parser (_parseBlocks) and executor (_runInstructions/_runSimple/_runCommand/
_dispatchOne). `for`/`while`/`if` bodies now run, including one-line `if [ -f x ]; then y; fi`.
Variables expand through _expandVars ($VAR, ${VAR}, $?, single quotes literal), globs expand
through _expandGlobs (unquoted args only, per-command), and `>`/`>>` capture the command's output
into the VFS instead of being passed to the command as text.
- shell.js: a script never answers an unknown command by calling the AI any more. It prints
`script:<path>:<line>: <cmd>: command not found` and sets $? — the AI fallback stays for typing.
- shell.js: unclosed blocks and bad `for` headers surface as `Script <path> failed: …` (the parse
used to sit outside the try, so a bad script crashed the runner).
- shell.js: interactive path gets the same treatment — prompt globbing and `echo hi > /f` now work.
Cause of the asymmetry: the two code paths had separate dispatch.
- shell.js: `_isPipeAware` no longer injects the __pipebuf__ file into wc (it reads _pipeInput), and
the module registers itself with a versioned URL and calls its own init() — registerModule() does
not call init(), so the executeCommand wrapper was never installed from the boot bundle.
- module-fs.js: wc/head/tail/grep read piped stdin when no file operand is given; `cat` accepts
several operands (`cat *.txt`); `ls <file>` names the file instead of printing "(empty)".
- main.html: shell.js removed from the extension list — it is already inside
critical-ext-bundle.js, and loading it twice produced two ShellModule instances that could
disagree about their version.
Verification:
- test-shell-script.js 27 asserts (parser, variables, globs, executor, redirect, command-not-found,
one-line if, parse error). RED on HEAD: `TypeError: shell._parseBlocks is not a function`.
- test-shell-stdin.js 16 asserts (added by a subagent): wc -l/-c, head -n, tail -n over stdin, and
the file-argument path unchanged.
- Suite 18/18 files; maintain --fix "node tests 18/18 pass".
- Live on v4.6.115, through the real executeCommand:
`ls /n*.txt` -> /n1.txt · `cat /n*.txt` -> one|two · `echo hi > /r.txt` then `cat /r.txt` -> hi ·
`cat /probe.txt | wc -l` -> 3 (bare, no __pipebuf__) ·
`script /run.sh` -> item 1 / item 2 / item 3 / exists / command not found, exit 1, no AI routing.
|
| |
|
|
|
|
|
|
|
|
|
| |
MAINT-004. The guard read warnAt/blockAt/hardStopAt while one config path wrote `threshold`, and
`enabled` was never consulted anywhere — writing {"enabled": false} into webx11_ai_config changed
nothing at all. One resolver, _loopPolicy(), now normalises both spellings, guarantees
warnAt <= blockAt < hardStopAt, and both the block and the warning are gated on enabled.
Live on v4.6.110 (_loopPolicy called in the page): defaults {warn 3, block 6, hardstop 9};
{threshold: 4} -> {warn 2, block 4, hardstop 7}; {enabled: false, threshold: 3} -> enabled false.
test-loop-policy.js: 17 asserts, RED on HEAD ("_loopPolicy is not a function"), suite 16/16.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Three of the four agent-cluster items, each with a test that is red on HEAD.
- MAINT-008 (module-agent-registry.js + module-orchestrator.js): registerAgent took args[0] as the
agent id and only args[1] as the capability list, while both orchestrator callers passed the
command word first — so the boot log read "Agent 'register' registered with 1 capabilities" and
four capabilities were stored as one. The command word is now stripped, args[1..] are joined and
split on commas (both "a,b" and "a b c" work), and the callers pass [id, ...caps].
- MAINT-007 (registry + aiassist): mkdir/rm used relative paths, so a registration made from /docs
created /docs/agents/<id> and an unregister from any other cwd removed nothing — the leaked
directories the report suspected. Every path in the registry (and the four /_sessions writes in
module-aiassist.js) is absolute now.
- MAINT-009 (listAgents): a directory alone counted as a registered agent, so a hand-made
/agents/foo appeared as "foo — unknown (0 capabilities)". Only a readable status.json with an id
counts now; the rest are reported as unregistered directories.
Verification: test-agent-registry.js (11 asserts). RED on HEAD: 9 of 11 fail, including the exact
`✅ Agent 'register' registered with 1 capabilities` line and `hand-made — unknown (0
capabilities)`. Suite 15/15 files green; maintain --fix "node tests 15/15 pass".
Live on v4.6.109: boot prints "✅ Agent 'orchestrator-0' registered with 4 capabilities";
`agent-list` warns "1 directory(ies) in /agents have no status.json (not registered): hand-made";
register from / with a comma list stores 3; unregister from /docs removes the directory and leaves
no /docs/agents.
MAINT-006 stays open with a narrower note: the hard stop was only reachable when every call in a
batch was blocked, so a mixed batch (one repeated + one novel call) never ended. The same ceiling
now applies on the mixed path, but that branch lives inside agenticLoop and is not covered by a unit
test — it needs a live agent run that repeats a call.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
leave /skills
Two board items plus the context-window close-out.
- MAINT-019 (module-system.js): `help <cmd>` answered "No help available for X" for a command
that is registered but has no help line, which reads as if the command does not exist. It now
says "X — registered by <Module>, which publishes no help line for it. Try: help". A command
that genuinely does not exist still gets the old message.
- MAINT-020 (module-aiassist.js): auto-generated loop lessons were written into /skills with
their own index entries, so `skill list` filled up with system noise. Lessons now live in
/lessons with /lessons/index.json; the reader still falls back to legacy loop-lesson-* entries
in /skills for one release, and the one-time migration deletes them from the skills index.
Verification: test-help-and-lessons.js (10 asserts, includes a lint-style guard that no lesson is
written into /skills). Suite 14/14 files green; maintain --fix "node tests 14/14 pass",
"help coverage 362/362". Live on v4.6.108: `help agent-register` -> "registered by
AgentRegistryModule, which publishes no help line for it"; `help a2a-prune` unchanged;
`help nope-not-real` still "No help available".
MAINT-001 close-out (no code change here): history is capped at 20 messages with a "[context trim]"
marker (first trim at turn 11 in a 60-turn probe), token compression took 80 msgs/8080 tok to
17/2625, and since v4.6.107 one turn's tool bodies are clipped to 6 000 chars each and elided past
24 000 with the newest 4 kept verbatim. Residual, recorded on the board: maxContextTokens is never
sent to the server as num_ctx, so the real window is whatever the endpoint defaults to.
MAINT-018 close-out: not reproducible. Live probes on v4.6.107/108 — `sed -n '1,3p' /probe.txt`
prints lines 1-3, `sed -n "2,4p"` prints 2-4, `grep 'line4'` matches, and the same commands inside
`script /q.sh` print correctly. The "Command not found: for;" symptom belongs to the line-by-line
script runner, which is MAINT-021 and stays open.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
a corrupt memory graph
The three items the last review and probes left open, each with a test that is red on HEAD.
- MAINT-023 (module-aiassist.js): one agentic turn grew without limit — every role:'tool' body
was pushed verbatim and only this.context was trimmed BETWEEN turns (measured 6 -> 112 705
tokens across 8 model calls against maxContextTokens 12 000). Observations are now clipped to
maxToolResultChars (6 000) with a note saying how much was withheld and to re-read with
offset/limit, and _boundToolContext() elides the oldest tool bodies once the running total
passes toolContextBudgetChars (24 000), always keeping the newest 4 verbatim. The ceiling is
turn-independent: the same ~26 k chars at 8 turns and at 20.
- MAINT-024 (modules/ext/skill-pack-core.js): the command printed "✅ Skill created" with
fs.writeFile()'s boolean discarded (probe: fresh VFS, success printed, no file), stripped
invalid characters instead of rejecting the name (My-Skill -> y-kill, DevOps_Thing ->
evpshing), and treated an unreadable /path argument as the skill body. Now: kebab-case is
validated (uppercase normalises and the final name is reported; anything else is refused),
/skills is created on first use, the write and index results are checked, and an unreadable
body path is an error.
- MAINT-003 (module-memory-graph.js): a corrupt store looked exactly like a fresh install —
fsReadJSON returns null on a parse failure, so 85 nodes could vanish with no warning and no
copy. The probe confirmed the loss: seed 6 nodes, truncate nodes.json and export.json, reload
-> 1 node, no message, nothing in .trash. _quarantineCorrupt() now keeps the unreadable file
as <name>.corrupt, warns, and then loads from whatever remains.
Tests: test-tool-context-bound.js (11), test-skill-create.js (16), test-memory-graph-recovery.js
(8). RED on HEAD: tool-context crashes on _clipToolResult (exit 1), skill-create 16 assertions
fail on the missing file/index, memory-graph B1/B2/C1 fail (no warning, no .corrupt copy).
Suite now 13/13 files green; maintain --fix reports "node tests 13/13 pass".
Live on v4.6.107: skill-create My-Skill -> ✅ "my-skill"; DevOps_Thing -> Invalid skill name;
/does/not/exist.md -> Cannot read skill body; only my-skill in the index.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
review findings
Second pass over v4.6.105, driven by an independent review that reproduced each item.
- ollama-manager.js: chat() now reports the captured cause ("Ollama error: Failed to fetch",
"…: HTTP 500") instead of the generic "No provider responded"; _lastChatError is reset per
call so an old reason is never replayed. chatWithTools carries the reason in its error string.
- ollama-manager.js: _ensureConnected() bounds connect() with a deadline (connectTimeoutMs,
default 10 s). connect() uses a bare fetch(), so a blackholed endpoint previously left the
shared in-flight promise pending forever and hung every later message — the old code failed
fast. The attempt is now try/finally, so a throwing terminal.log() can no longer poison
_connecting and suppress the retry on the next message.
- ollama-manager.js: an automatic connect no longer silently rewrites the user's saved model;
the previous choice is restored in memory and in localStorage, and the user is told.
- ollama-manager.js: the DeepSeek empty-content branch returned top-level tool_calls with
content '', so the caller pushed an assistant message with no tool_calls and then a
role:'tool' reply — an orphan tool message, which is the HTTP 400 that branch exists to
prevent. tool_calls now live inside the message as well.
- module-aiassist.js: a no-argument list_files returned the ROOT instead of the cwd (readDir('/')
instead of ls()); it now means the current directory again. Error text keeps the path as the
caller wrote it, and write_file distinguishes a read-only virtual path (/sys/…) from a missing
parent instead of blaming the parent.
Tests: test-ollama-error-text.js (new, 14 asserts, RED 9/5 before the edit), test-ai-fs-tools.js
7 → 16 asserts (write onto a directory, /sys write, list a file, '/', no-arg cwd, relative path),
test-ollama-autoconnect.js 11 → 19 (blackholed endpoint settles + retries, saved model survives;
the old "connecting hint" assertion is now falsifiable — the reviewer showed it also matched
connect()'s pre-existing line). Suite: 10/10 files green. Live on v4.6.106: healthy auto-connect
42 ms with the hint; blackholed endpoint settles in 1242 ms with connectTimeoutMs=1200, prints
"timed out" and "unreachable", _connecting cleared.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
sees /sys
Three defects, each re-probed first and covered by a test that is red on HEAD.
- ollama-manager.js: nothing connects at boot; only the Ollama tab button called connect(),
so a user's first message died with "Ollama not connected. Use ollamaconnect first." even
when the endpoint was healthy. New _ensureConnected() runs from chat(), chatStream() and
chatWithTools(): one attempt, shared by concurrent callers, a "Connecting…" hint, and only
then the error — which now says the endpoint is unreachable instead of telling the user to
run a command they already expected to work.
- module-aiassist.js write_file tool: fs.writeFile()'s false return was dropped and the tool
answered "File written: …" anyway, sending the model on to a read that found nothing
(MAINT-012). It now returns "Write FAILED: … — parent directory missing or target is a
directory; nothing was written".
- module-aiassist.js list_files tool: the hand-rolled walk over root.content never resolved
the virtual mounts, so /sys — a directory the UI and `ls` both show — answered
"Directory not found" (MAINT-011). It now uses fs.readDir(), which resolves mounts and
returns null for a genuinely missing path.
Tests: modules/test/test-ai-fs-tools.js (7 asserts) and
modules/test/test-ollama-autoconnect.js (11 asserts). RED on HEAD: ai tools 4 passed/3 FAILED
(/sys → "Directory not found", write_file → "File written: …"), ollama 2 passed/9 FAILED
("Use ollamaconnect first"). GREEN now 7/7 and 11/11; maintain --fix reports "node tests 9/9 pass".
Live on v4.6.105: connectedBefore=false, _ensureConnected()=true in 41 ms, 37 models.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
MAINT-010 and MAINT-016, the two high items the review left open. Both were re-probed
before the change and the new test is red on HEAD (5 passed, 7 FAILED).
- virtual-fs.js rename()/copy(): they assigned dst.dir.content[dst.name] with no destination
type check, so `mv file /docs` replaced the /docs node and every child vanished while the
command printed "Moved: …". Refuse when the destination is a real directory node (the
virtual /sys entry is exempt). rename() also erased the file on `mv a a`, because assigning
and then deleting the same key removes it; that path is now an explicit no-op.
- module-fs.js mv/cp: a refusal used to surface as "No such file or directory", which sent
the operator looking for a missing source. The destination is now inspected first and the
message says "is a directory — refusing to overwrite it".
- module-fs.js ls: the path was only read from argv[0], so `ls -l /work` listed the cwd.
The first non-flag argument is now the target; the path-first form is unchanged.
Tests: modules/test/test-fs-mv-cp-guard.js (12 asserts) — RED on HEAD (A1-A3, B1, B2, C2, E1),
GREEN now; maintain --fix reports "node tests 7/7 pass". Browser on v4.6.104:
"mv: /vtest: is a directory — refusing to overwrite it", child and source intact,
"ls -l /vtest" lists /vtest (keep.txt), not the cwd.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
gate the build
Review of the 08:30 implementer run (v4.6.102, checkpoint name fix). The shipped fix was
correct; these are the defects it introduced or left behind, each measured first.
- virtual-fs.js rollback(): the snapshot strips _snapshots/_sessions/.trash for bloat. Restoring
it verbatim deleted every checkpoint, every agent session and the trash, made rollback
irreversible and unrepeatable. Re-attach the live copies after the root swap.
- checkpoint(): names are millisecond-resolution, so tight calls overwrote each other
(measured 6 calls -> 3 snapshots). Dedupe with a -N suffix, refuse names containing "/"
(written but unlistable), and prune by snapshot createdAt instead of filename sort, which
let a custom name ("aaa-oldest") evict newer auto-named checkpoints.
- module-predictor.js: legacy pre-v2 points have no `usable`, so a 0.079 s aborted run
re-entered similarity as evidence and floored every prediction at 1 s. Backfill `usable`
from the measurement on load, drop the ones it rejects, add a belt-and-braces guard in
_findSimilar and count only usable points as actual executions.
- newos4-maintain.py: run every node-runnable modules/test/test-*.js on each maintenance pass.
The v4.6.102 regression was written but no job ever executed it.
- newos4-steer.py: `done` now requires --commit <sha> that exists in the repo, and gains
`reopen`. A written plan was being closed as done at 06:17 while the predictor fix shipped
nowhere, so the implementer's pre-flight queue was empty.
- steering.json: predictor item reopened, checkpoint item stamped with f7249ff.
- maintenance board: MAINT-002/005/015 were fixed in v4.6.81-85 but still listed open/high;
closed with their commit ids, and MAINT-010/016 annotated with the probes that keep them open.
Tests: test-vfs-checkpoint 23/23 (RED 14/9 before), test-predictor-accuracy 38/38
(T1-T3 RED on HEAD), maintain --fix all PASS, browser round-trip
"Checkpoint created: <name>" -> "Rolled back to checkpoint: <name>" on v4.6.103.
Also carries the already-deployed 2026-10-26 syntax-gate hunk in newos4-maintain.py (syntax_failures + gated rebuild) that had never been committed.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Task 2 + ship of plan 2026-10-27_061724-newos4-checkpoint-name-mismatch.md.
module-system.js `checkpoint` read the clock a second time for the printed
name, so the name in "✅ Checkpoint created: <name>" differed from the name on
disk by >=1ms whenever no explicit name was given. It now prints the value
returned by fs.checkpoint(). try/catch and error strings unchanged.
Bundles rebuilt (rebuild-bundles.py); LATEST_VER in module-loader.js and all
three ?v= tags in main.html (core-bundle, module-loader, critical-ext-bundle)
bumped v4.6.101 -> v4.6.102.
Verification:
$ node --check modules/core/module-system.js
SYNTAX OK
$ node --check modules/core/core-bundle.js
BUNDLE SYNTAX OK
$ node modules/test/test-vfs-checkpoint.js (x5)
test-vfs-checkpoint: 10 passed, 0 failed
$ curl -s https://webx11.duckdns.org/spaces/newos4/main.html | grep -o 'core-bundle.js?v=[^"]*'
core-bundle.js?v=v4.6.102
$ python3 scripts/newos4-maintain.py
PASS: version v4.6.102 x3 in main.html (expect 3) ... maintenance result: OK
$ python3 scripts/newos4-skill-audit.py
skill audit: 7/7 pass
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Dashboard (/admin/feedback.html, admin-gated)
- User-feedback tab over the live :8908 API: list, filter, search, publish reply,
archive/reopen. Reply is what the reporter sees in /stear -> Your reports & replies.
- Agent-items tab: 3 plans parked at autonomy:review + 19 defect reports, one click each.
- Snapshot age line + stale warning (>30 min), and the last apply outcome with failures.
- Existing /admin/ tab relabelled "Client error log" (it renders feedback_log.json, not
the feedback store) and now links to the review dashboard.
Decision path
- admin/api/feedback-decide.php: exact-match nginx location + auth_request, Origin check,
item_id allowlist, append-only decisions.jsonl with fwrite+fsync verification.
- scripts/newos4-feedback-apply.py (darkbot): last decision per item wins, superseded rows
recorded, reject reverts safe->review, per-item try/except, ledger saved per mutation,
realpath containment, exact standalone-line marker flip, file mode preserved, queue
rotation at 1 MB. Steering directives now carry the report title.
- scripts/newos4-feedback-collect.py: snapshot for the dashboard, 40-line plan head,
steering shape assert (-1 = unknown), recent_apply outcomes.
- newos4-feedback-sync.sh: flock -n so overlapping runs cannot double-apply.
Guide + terminal
- feedback-guide.html: which channel (terminal feedback / /stear / automatic reports),
expectations, exact payload per channel, how to write a report that gets fixed.
Linked from /stear, index.html footer and help.html.
- newOS4: feedback list|read|reply|archive|reopen|stats|dashboard|help (+ feedback-admin
alias), admin-token derived per call, argument-validated dispatch so a sentence like
"feedback list is broken on mobile" is still a message, "feedback -- <text>" forces it.
- help.html: 8 rows, coverage 362/362.
Review: glm-5.3 REWORK -> 15 findings fixed, 5 refuted with evidence, 2 doc-only.
Guide corrected (invented "60 MB per batch" replaced by the real 512 KB/5-per-10-min limits).
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
(v4.6.91)
P0-5 asked what to do about a 422k-token session against a 400k threshold. There is no 400k
threshold in this tree — the budgets are maxContextTokens (12000) and maxContext*2 messages — so
rather than chase a number that does not exist, this applies the decision that is defensible
either way: warn before the cliff, never lose history without saying so.
- 80% of the token budget prints one warning per crossing (no per-turn nagging)
- the message-count trim unshifts a marker naming how many messages left the window and quoting
the earliest one, instead of splicing them away silently
- 'max-context-tokens (default: 2000)' now reports the real code default, 12000
Verified: 900/1000 tokens -> warns once, second call silent; 1500/1000 -> compresses to 17
messages with the summary head intact; 9-message window with maxContext=2 -> 4 messages, marker
'[context trim: 6 earlier message(s) ... earliest was: "turn 0 ..."]'.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
(v4.6.88-90)
One phantom entry, three symptoms:
- ls() injected 'sys' whenever it was called without a path, so 'cd _agents; ls' advertised a
sys directory that does not exist, and list_files('_agents/sys') answered 'Directory not
found' — the reported false negative. Injection is now gated on dir === root.
- tree() pushed the same virtual name into the walk and dereferenced it, throwing mid-output on
every root listing. Guarded.
- _gatherFileInfo() walked into /sys and counted a synthetic subtree: 146 files / 114 dirs for a
44-file / 15-dir store. Virtual entries are skipped.
Verified: root still lists sys; _agents and skills do not; tree('') completes; world model total
(44) equals an independent walk of fs.root (44), agree: true.
|
| |
|
|
|
|
|
|
|
|
|
|
| |
getStaleSkills() returned daysUnused=999 for a skill that had useCount 0 and no lastUsed — a
placeholder rendered by the audit as '999d unused', indistinguishable from a measurement. It told
the operator to archive procedural memory that had simply never been instrumented.
Now: daysUnused null + neverUsed true when there is no lastUsed; real day count otherwise; the
audit prints '(never used)'.
Verified: probe skill with no telemetry -> {daysUnused: null, neverUsed: true}; one last used
2026-08-01 -> 83; no 999 anywhere in getStaleSkills() or the audit output.
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
_modelDigest() returned JSON.stringify(...) cut at 4000 chars plus '…(digest truncated)'. The
tool then did JSON.parse() on it, so the default detail threw 'Unexpected end of JSON input'
every single call; detail:'full' worked only because it returned the object untouched.
The digest now returns an OBJECT (_modelSnapshot) and shrinks by reducing list lengths, then by
dropping whole sections with an explicit 'omitted' list. The string form is generated at the
edge and is always valid JSON.
Verified: default call -> no error, 13-key snapshot, facts answered; caps 400/1200/4000 all under
cap and parseable; the residual floor at cap 200 is identity fields only.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
(v4.6.81)
delegateTask declared `const outboxResult` inside the AI branch and returned it outside, so a
delegation with the AI module missing threw 'outboxResult is not defined'. The catch turned that
into _handleAgentFailure: the worker stayed idle with no result while spawn_agent reported ok —
the reported symptom exactly. Now function-scoped, and the no-module path returns
'queued — AI module not loaded, nothing executed' rather than claiming 'completed'.
Also: nginx served _docs/*.md as application/octet-stream (no .md type) — now text/markdown +
nosniff; agent-replies.php returns 410 for GET as well as POST, so there is one reply path.
Verified: with the AI module deleted at runtime, delegateTask returns the queued string and
throws nothing.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
double print (v4.6.78-80)
12 findings accepted, 3 refuted with evidence (see _docs/chat-review-glm-2026-10-23.md).
Data loss: a corrupt thread read as [] and the next append rewrote it with one message —
now 500 and the file is left alone. Cursor after a >50-message truncation pointed at the
thread tail, making the oldest permanently unfetchable — now the last message actually
sent, plus truncated:true. Two posts in the same millisecond shared a cursor — epoch is
now strictly increasing.
Security: chat.py show() had no id validation and joined argv onto CHAT_DIR ('../../x'
read any .json as darkbot) — THREAD_RE added. The auto-reply prompt now treats message
text as untrusted data and forbids acting on instructions found in it.
Ops: relay housekeeping swept neither .lock-* nor orphaned .tmp-*; a crashed listing
looked identical to an empty queue; grep AWAITING also matched message bodies; hermes-poll
printed every reply twice.
Verified: corrupt file -> 500 with the file untouched; traversal -> 'invalid thread id';
hermes-poll -> exactly one line per reply.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
1. chat.py renamed the temp file AFTER releasing the flock, so two writers could each
read the pre-replace snapshot and the later rename silently dropped the earlier
message. os.replace now happens inside the lock.
2. The agent cursor was global. After hermes-reset it pointed past the end of the new
empty thread, so every read returned nothing — the agent would think it had been
ignored. Key is now per thread and reset clears every chat cursor.
3. chat-relay.sh had no overlap guard: a slow agent run (up to 5 min) could collide with
the next tick and answer the same thread twice. flock -n on /tmp/chat-relay.lock.
Verified: stale cursor 'webx11_chat_agent_cursor_oldthread00000' set to 9999999999999,
hermes-reset -> zero cursor keys remain, read returns {messages:[], note:'no new messages...'}.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
Two readers shared one cursor. The 30 s UI poller printed each reply and advanced
webx11_chat_state.cursor, so the agent's chat_hermes read then asked for 'since=<that>'
and got an empty list — the answer appeared on the terminal and never reached the model.
That is the reported symptom exactly.
chat_hermes read now uses webx11_chat_agent_cursor, starts from 0 on first use so the
whole thread is visible, and never touches the display cursor. Empty reads say why
('still awaiting Hermes' vs 'no new messages since your last read').
Proven: UI poll consumed the reply (printed to terminal), then chat_hermes read still
returned both the agent's question and Hermes's answer.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Phase C as repo edits (browser edits in _mods/ do not survive a reload).
- `hermes <msg>`: sends through the chat endpoint and always prints an outcome —
'📨 Sending…' then either '✅ sent id=… epoch=…' or a coded error with a hint
(429 retry later, 503 host busy, 401 run hermes-reset). `feedback` stays as the alias.
- NOT named `chat`: ChatStudioModule already registers `chat` and dispatch walks modules
in order, so a second `chat` was silently unreachable. Found by test, not by reading.
- `hermes-poll` / `feedback-inbox`, `hermes-reset` (token rotation).
- Poller: 30 s, paused while the tab is hidden, polls on visibilitychange, first poll
adopts the cursor and prints nothing, cursor persisted in webx11_chat_state.
- `chat_hermes` tool: send + read from inside the agent loop.
- Contract/help updated for the rename.
Acceptance: 'hermes acceptance test' in the browser, reply written host-side with
scripts/chat.py, appeared in the terminal by itself 30 s later with no command typed
(cursor 1792776973800).
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
(v4.6.70)
Two decisions recorded by the operator on 2026-10-23, implemented.
6 — spawn-on-demand is the design, so stop reporting it as a defect:
- OrchestratorModule counts delegations inside delegateTask()
- status prints "Mode: on-demand — N/M worker(s) available, X delegation(s) this
session" and drops the "spawning is not dispatching" warning
- per-agent lines read "available, no delegations yet (spawned ...)" / "N
delegation(s), last ..."
10 — per-user, server file canonical, browser VFS a TTL'd read-through cache:
- store = the user's own WebDAV space (<space>/_data/predictor.json), so identity
comes from credentials the app already has; no new endpoint, no unauthenticated
write surface
- 5 min TTL: cache wins while fresh, server wins when it differs; a banner naming
both counts prints only on divergence
- write-through on save (debounced 5 s) with a MKCOL retry when the collection does
not exist yet; store mode is printed by predictor-status
- the cache write is guarded and verified — a missing /system/metrics made writeFile
fail silently, which is how the first version lost a pull
Verified live on v4.6.70 with a stubbed transport: pull applies 5 pts/5 paired and
writes a stamped cache, the divergence banner fires once and not on the second
(equal) pull, write-through PUT is issued, status reads "Store: server". A real
WebDAV round-trip still needs the user's WebDAV config in-app; the agando space has
no _data collection yet, so GET returns 404 -> "server (empty)".
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Packet 1's multi-path ask was only honoured by wc in v4.6.58 — grep read only
args[ai+1] and head/tail only positional[0], so `grep x a b` searched `a`, printed
one file's hits, and exited 0. Same silent drop, three more commands.
- grep: loops every path; multiple files print `file:line: text`, `-c` prints one
count per file, missing files are reported per file and excluded from the summary
count; single-file output unchanged
- head: every path, `==> file <==` header when more than one; `head f 40` still works
- tail: every path with headers; a numeric second positional is still the legacy
`tail <file> <count>`; `-f` warns and follows only the first file instead of
printing all of them and claiming otherwise
Verified live on v4.6.67:
grep "bug_id" a b -> a:2 + b:3 + "2 match(es) in 2 file(s)"
grep -c "alpha" a b -> one count per file
grep "alpha" a missing -> hits from a, per-file error, "in 1 file(s)"
head -n 1 a b -> header + first line for each
tail -n 1 a b -> header + last line for each
tail a 2 -> legacy count still honoured
tail -f a b -> warns, follows a only
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
(v4.6.64)
Packet 8. `new RegExp(pattern)` sat unguarded in the terminal grep handler and in
VFS find()/grep(), so a bad pattern threw out of the command handler into the error
ledger -- the same ledger packet 2 had to stop trusting.
- module-fs.js grep: compile in try/catch, print
"grep: invalid pattern: <pattern> (<engine message>)" as a warning and return
- virtual-fs.js find()/grep(): same guard, return [] and stash the message on
_lastPatternError instead of throwing into the module error wrapper
Verified live on v4.6.64 with the packet's own repro: `grep "/\bug_id\" file` prints
the message, the error counter stays 0 (was: one ledger entry per call), a valid
pattern still matches, and fs.grep('[') returns [] instead of throwing.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
(v4.6.63)
Packet 6 and 7.
6 — four agents showed `sleeping` and nothing distinguished "waiting for work" from
"never handed a task". Added tasksAssigned/lastTaskAt to the agent record (counted
where a task is actually assigned), and the status line now reads
idle — NEVER SCHEDULED (0 tasks since 2026-10-23 16:22)
idle — waiting for work (3 task(s), last 2026-10-23 16:22)
parked — NEVER SCHEDULED ...
plus "Dispatch: 0/3 agent(s) have ever been given a task" and a warning that
spawning is not dispatching.
7 — /guides/ was reachable by nobody. New `guides` command lists it newest-first
with sizes and the preview/cat hints; help.html gained a Guides nav entry and
section with links to the published guides.
Verified live on v4.6.63: `guides` → 2 entries after seeding two files;
orchestrator-status shows 3x NEVER SCHEDULED on a fresh session (the packet's own
observation), and "waiting for work (3 task(s) ...)" once a counter is set, with
"Dispatch: 1/3".
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Packet 4. The matcher tested the whole query as one substring against
name+description+tags: word order decided the outcome ("telemetry dashboard" = 0
while "telemetry" = 1), a sentence could never match, and skill bodies were never
searched at all.
- _skillTokens(): lowercase, split on non-word chars, drop <3-char words and a
stopword list; a query made only of stopwords keeps its literal form
- scoring: name 3, description 2, tags 2, body 1 + up to 1.0 for repeated hits,
multiplied by token coverage (0.5 + 0.5 * matched/total), +3 phrase bonus so word
order can never zero a real hit
- results carry score and matchedTokens ("2/3"); top 3 by score, name as tiebreak
- zero results now name the tokens searched and the closest skill names instead of
"No matching skills found"
Verified live on v4.6.62 via the real runTool entry point:
"telemetry dashboard" and "dashboard telemetry" both return the same 2 skills
(was 0 and 0); "how do I regenerate the skill index" returns skills-system-guide
first (8.96, 2/3) where a sentence previously matched nothing; "info" returns 3
body matches; a nonsense query returns 0 with the tokens and closest names.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Packet 2 (three surfaces, three answers). Measured first: `errors` scanned
/logs/current.log for [ERROR] lines, but that file only ever receives explicit
terminal.log('ERROR', ...) calls -- exactly one call site in the whole app -- so it
read 0. The dashboard added DebugSupervisor._errorDB plus failed tool calls (18),
and the world model read the debug DB alone (11).
- terminal.countErrors() / countLogErrors(): the single counter, exposed on the one
object all three surfaces already hold
- `errors` prints the canonical total with its breakdown, the entry list (hash,
count, severity, message), and reports the log scan separately as a mirror
- dashboard health.errors and health.errorBreakdown derive from it
- world model telemetry.recentErrors derives from it, plus errorsBySource
- terminal.log('ERROR', ...) now also records into DebugSupervisor, so the log is a
human-readable mirror of one store instead of a second store almost nobody wrote
Verified live on v4.6.61: with a seeded debug entry + failed tool call, all three
report 2; a single log('ERROR') call moves debug 1->2 and the total by exactly 1
(the mirror line is counted once, in the log, and reported separately).
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Packet 1 and 3 (silent wrong answers from a shell-less terminal).
- detectComposition() in the security gate refuses ; && || | before dispatch.
`;` used to fail loudly, but `&&`/`||` folded the right-hand side into the left
command's argv (wc -l f && grep -c x f returned "42 42"), and a `|` arriving from
the AI run_command tool bypassed splitPipe entirely and degraded the pattern to
empty -- which matches every line. Operators inside quotes are untouched.
- wc accepts multiple paths: one line per file plus a total, per-file errors for
missing paths. `wc -c a b` used to print only `a` and exit 0.
- help.html: "There is no shell" callout at the top of the command reference,
plus the v4.6.57/58 changelog entry.
Verified live on v4.6.58 by replaying the exact call sequence used by both paths:
interactive `wc -c a b` -> "14 a / 10 b / 24 total"; `&&` and `;` refused;
`echo "a && b"` still echoes; AI run_command semantics with `|` and `&&` refused;
single command and multi-file wc still return real output.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
(v4.6.57)
Acting on the "Request to the newOS4 team" packet (spaces/agando/guides/,
re-verified by its author on 4.6.56). Three verified defects fixed:
Packet 5 (predictor arithmetic) - module-predictor.js
- the persisted field named mape held a SUM while predictor-status divided by the
paired count: renamed to errorSum, older payloads read through
- errorPct is stored raw; the 500% clamp is now render-only, so a 475x miss stays
visible instead of being flattened to the ceiling
- predictions are floored at 1 s and marked floored; a floored prediction is
consumed but never scored as 100% error (a 0 s prediction is not a prediction)
- observations shorter than 1.5 s (aborted/instant runs) are marked unusable and
no longer train _findSimilar - one 0.079 s run was rounding the next prediction
to 0 s
- status prints an unpaired and an unscored count alongside the mean
Packet 10 (verification cannot see its own fixes) - module-aiassist.js
- view_module now returns the DEPLOYED source, prefixed with file and version,
and only falls back to the _mods copy with a "may be stale" banner. The
unversioned _mods/<Class>.js edit cache used to shadow the deployed file
forever, so the viewer showed pre-fix code while the bundle was new.
Proven by seeding a stale _mods/PredictorModule.js and calling the tool.
Packet 1b (ls exits clean with no output) - module-fs.js
- ls rendered only via printClickable(), which writes straight to the DOM, so any
capture (AI run_command, diagnostics) saw an empty result and reported "empty
directory". It now always prints a text line and keeps the clickable chips when
nothing is capturing.
Test: modules/test/test-predictor-accuracy.js 34/34 (new cases Q, R, S).
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The accuracy readout was structurally 0%: module-predictor.js:187 incremented the
denominator on every observed run while the numerator only moved when a stored
prediction existed, and predictions were stored only by the manual `predict`
command (the AI tool predict_task computed one and discarded it). Replaying the
AI loop's own call path with 6 tasks printed "Predictions made: 0, Accuracy: 0/6".
- pending predictions with a 15m TTL, consumed by threaded id -> task hash ->
cli-only similarity >= 0.5; unpaired runs never enter the denominator
- duration scored within 30% or 3s (integer predictions vs fractional observations)
- errorPct capped at 500% so one miss cannot poison the mean error
- schema v2: v1 correct/total counters dropped on load, observed runs and the
prediction counter kept; task text stored as an FNV-1a hash only
- tuning (confidence-threshold, min-data-points, pair-ttl) persists
- min-data-points now scales confidence (was declared, printed, settable, unread)
- AI loop registers a prediction per turn and threads its id; predict_task
returns predictionId; durations exclude chat-lock queue wait
- status/dashboard say "n/a" instead of "N/A%", and carry paired count, mean
error, turns error, pending and unpaired counts
- test: modules/test/test-predictor-accuracy.js (26 assertions)
Live on main.html v4.6.56: fresh session -> "Accuracy: n/a (0/0 paired)";
one paired run -> "100% (1/1 paired) - mean error 5% - turns +-0.0".
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
dashboard (v4.6.55)
Root cause: splitPipe() splits on every '|', so `help |`, `| wc -l`, `a || b` produced a stage with
no argv and executePipeChain() called parts[0].toLowerCase() on undefined — 989 occurrences, first
filed 2026-10-20, unfixable from the report because bug reports dropped the stack that named
executePipeChain:3955. Same unguarded read existed in _classify().
- terminal.js: _classify() returns an inert classification for empty argv; executePipeChain()
parses each stage once, filters stages with no argv (so the last real stage stays final), warns
only when the whole pipeline is empty. Last-stage test now compares against the filtered length.
- module-system.js: `bug` diagnostics include the stack (10 frames, 1200 chars); auto-filed reports
carry it too — they are the majority of the inbox and were previously message-only.
- report.php: per-stack 2 KB cap; fingerprint pinned to message/source/count so adding `stack`
cannot break dedupe against reports filed before today.
- ingest.php: first_frame() parsed once on ingest, stored as `frame` on each signature.
- newos4-triage.py: FRAME| line with the first application frame.
- dashboard.php: frame under each Top Errors row.
- modules/test/test-pipe-guard.js: ordering tripwire (guard must precede the parts[0] read).
Verified: test RED exit=1 -> GREEN exit=0; browser matrix on v4.6.55 (help |, | wc -l,
echo hi || echo bye, ls | | wc -l, |) -> 0 new error signatures, "|" warns;
auto-filed report now carries stack (RPT-...f3e31124, archived after the probe);
frame = modules/core/core-bundle.js:3955:42; maintain OK; skill audit 7/7.
|
| |
|
|
|
|
|
|
| |
2026-10-18
Report RPT-20261018-164646-89352963 ("this.fs.emptyTrash is not a function") was filed by the auto-filer and never fixed: terminal.js:1777 called a method VirtualFS never defined, so 'empty-trash --confirm' threw instead of emptying. Added emptyTrash() returning true only when it removed something.
Verified live on v4.6.54: put -> rm -> empty-trash --confirm => 'Trash emptied.'; second run => 'Trash is already empty.'; .trash entries 0.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
(v4.6.52-53)
Root cause: _syncToBackend() re-sent the whole error DB with cumulative counts every
300s, and ingest.php did count += client count per batch. 33 real signatures had
accumulated 116,696 "occurrences" (one self-referential row alone: 46,133).
Backend
- ingest.php: per-(session,hash) synced map, adds only the delta, resets prev when the
client count shrank (cleared localStorage), caps delta at 5000, bounds synced at 500
hashes and sessions at 200, normalises timestamps to +00:00, 30-day retention that
also purges dropped hashes from every synced map, returns `accepted` (entries) next
to `ingested` (occurrences).
- stats.php/dashboard.php: total_errors = occurrences, unique_errors = signatures,
last-ingest card. The two numbers were inconsistent by ~3,500x.
- health.php: reports self_referential count and status=degraded instead of ok.
- Pruned live data: 33 -> 23 records, 116,696 -> 58,759 occurrences, max cluster
110,226 -> 52,387 (archive kept in data/debug/archive/).
- nginx: stats/errors/clusters/dashboard/agent-replies now behind
auth_request /_wx11_admin_auth (302 without a session); ingest/report/health stay
public for telemetry. Verified: reads 302, ingest 200, report 400.
Client
- module-debug-supervisor.js: sends only hashes whose count changed (persisted
webx11_debug_synced), records synced counts only after success, stops auto-filing
aborts/timeouts and debug-pipeline requests as bug reports (2 of the last 5 reports
were "user aborted a request").
Verified with a scratch php -S copy: same batch POSTed 3x -> count stays 5;
count=99999 -> clamped to 1000; retention dropped 10 legacy rows.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
(v4.6.51)
Two defects, both verified live before/after:
1. The World Model panel always said "Not synthesized yet". The page had a
renderer for data.worldModel and _collectDashboardData() never set it -- the
model was right there in WorldModelModule._model. Now collected and mapped to
the renderer's exact keys (model has modules.loaded/skills.count/memory.nodes,
the page reads modules/skills/memoryNodes), plus changesSinceLastSnapshot and
the recent-error sample, with an honest "not synthesized" fallback.
2. The page discarded any payload older than 10 s and its own 5 s auto-refresh
then showed "Cannot connect to newOS4". Stale payloads are now rendered with
their age ("Data as of 1:20:14 AM - 3m ago"), labelled amber past 5 min.
Also: the Refresh button wrote a localStorage key nobody read -> the terminal now
listens for it and re-collects (page says "No terminal tab answered" when no
terminal tab is open); storage events repaint instantly; the dead /api/dashboard
fetch (404 on all three paths, 5 s stall) is gone; `dashboard --watch` / `--stop`
re-collects every 5 s; header says the data is this browser's instance.
Verified v4.6.51: panel rows "Synthesized 34s ago / v4.6.51 / 46-22 / 136-3 /
1 nodes 0 edges / OK / none recorded"; 130 s-old payload still renders with
"- 3m ago" and no banner (previously "Cannot connect"); storage event moves the
footer 13s -> 0s; watch timer advances the payload, --stop clears it; mobile
360/390 px all OK; 0 console errors.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
(v4.6.50)
`world-model-ask` was a 10-keyword lookup: any real question returned
"Unknown query. Try: modules, skills, ...". The documented example
("what changed since yesterday") compared nothing — it restated the current
snapshot.
- _modelDigest(): whitelisted snapshot (measured 942-965 chars on fixtures,
~3.3 KB live) + recent error sample + changesSinceLastSnapshot
- _buildAskPrompt(): "answer only from this JSON, never invent numbers, name the
command that would produce missing data"
- ask(): connects Ollama on demand, answers via chat(), falls back to the facts
path with a visible warning; --facts keeps the instant lookup
- _diffSincePrev(): keeps one previous snapshot in /system/world-model.prev.json
so "what changed" is a real diff (files 136 -> 140)
- world_model_query tool returns the snapshot (digest or detail:full) instead of
ten canned strings; no nested LLM call inside a tool call
- help text now says what it does; node test modules/test/test-world-model-ask.js
(11 assertions, runs the real class)
Verified live v4.6.50: facts "Loaded 46 modules" | LLM "The snapshot does not
contain information regarding the cause of memory growth ... use
world-model-refresh" | diff "files 136 -> 140" | tool snapshot 3,334 bytes.
|
