The sandbox Service Definition adds SandboxEscalationError with
SANDBOX_ESCALATION_INVALID_ARGUMENT, _UNAVAILABLE, _REJECTED, and
_CANCELLED, thrown by validateEscalationArgs() and approveEscalation()
with their existing messages. A cancelled approval for an aborted call
rethrows the call's cancellation instead.
It also adds SandboxPreparationError. sandbox-local wraps Windows ACL
SID, grant, temp-directory, and path-resolution failures as
SANDBOX_PREPARATION_FAILED with the Win32Error or Node error (or an
AggregateError with cleanup failures) as cause, and reports a temp root
inside the workspace as SANDBOX_INVALID_TEMP_ROOT. sandbox-windows-acl
exports isTempRootInsideWorkspace() for that check.
Refs #7869
Type the approval denial helper with a closed ApprovalErrorCode, state
that a cancellation is recognized by the signal reason or an Error named
AbortError, note that ApprovalError names a denial rather than a thrown
class, and separate JOB_CONTROLLER_UNAVAILABLE from a missing jobs
service. The jobs README describes JobError as the seam's export rather
than as current caller behavior, and the terminal test asserts one
concurrent send failure.
Refs #7869
Tool bodies that lack a calling Agent, an injected service, or an open
turn get one shared HarnessError with the TOOL_CONTEXT_UNAVAILABLE
code, instead of each tool throwing a plain Error. The stacked
per-area refactors adopt it at their call sites.
Refs #7869
A ToolGuard may return a ToolGuardDenial with optional ToolErrorInfo,
and a post-execute block may supply info; the registry records it on
the failed result. checkGuards now returns the normalized denial.
String guards and blocks without info keep their existing results.
Refs #7869
An ask that approval does not grant now denies with ApprovalError and
APPROVAL_REJECTED, APPROVAL_CANCELLED, or APPROVAL_UNAVAILABLE, so a
user rejection is routable on tool/result like other structured
failures. Model-facing reasons are unchanged.
Refs #7869
A started tool body that throws the signal's reason or an AbortError
without HarnessError identity now keeps its message and carries
AbortError / ABORTED, so the cancellation is routable like the
registry's own cancellation results. HarnessErrors and distinct
failures that settle during cancellation stay unchanged.
Refs #7869
MarkdownDelegate gains renderCode for fences whose language is final; ChatView
declares conversation.chat.markdown.fence and registers math and diff/patch
layers. Hoc slots accept an optional dispatch key, render children at most
once, share compiled chains per key, and contain layer crashes to the failing
occurrence.
Refs #7926
The worktree service now records each checkout it creates as a
`plugin:worktree/created` record, folds them in its own `worktree`
projection with fork-aware ownership, and reclaims a clean, unreferenced
checkout when the Session that created it is archived. The Forge panel
reads the service's record and forwards its cleanup state; it no longer
writes a `created` record, owns a retention projection, or gates every
Session's directory access.
Admission registers the attempt inside the Workspace write queue and
returns; inspection runs afterwards, reading cold Sessions through the
projection cache when mounted and from their log otherwise, with subagent
children of an archived ancestor counted as archived. Only a path being
removed holds `working-directory/access`, whose request now carries the
access's `signal`, and listeners withdraw before the drain. Ignored files
no longer retain a checkout, matching Git's non-force removal; processes
and terminals are not consulted.
The Forge bundle mounts one `worktree` service: the `forge-worktree` row
and the `optional-forge-panel` group that isolated a second service are
gone, and `forge-panel` is a top-level row. `canRemove`, `remove`, the
`forgeWorktreeRetention` projection, and `ForgeWorktreeCleanup` are
removed; `WorktreeService.cleanupOf`, `WorktreeCleanup`, and the
`worktree/cleanup` Host event replace them. The upgrade guide moves to
the current version directory and covers the id removals.
Discover offers Update for a plugin installed from a pinned Git commit
when the plugin index lists a newer commit of the same repository
directory. The Plugins page update removes the installed copy, installs
the target with an expected-package check that undoes a wrong install
with its modules, and reinstalls the removed commit when the target
fails. A network failure reaching the target's host stops the update
before anything is removed.
List registry cancellation results and tools/execute wrapper results
as structured error sources, name cancellation errors AbortError with
the ABORTED code, state that approval rejections and guard denials carry
no code yet, and allow per-failure classes with their own fields.
Refs #7869
Coded error classes extend HarnessError, foreign failures convert at their
owner, and every expected tool failure throws a HarnessError so tool/result
keeps error.name and error.code. Document when the registry records
ToolErrorInfo and point tool authors and reviewers at the rule.
Refs #7869
maxAgentTerminals now counts only running Agent-controlled terminals and
pending Agent allocations, each id once; exited terminals and failed
allocations awaiting cleanup still count toward maxTerminals. openForAgent
applies rename's 1-120 character title rule and trims the title.
readScreen reports a terminal closed while its read drains as
RemoteError terminal/unavailable, like a missing terminal.
sjw1231