CRC cpio checksum work shares one byte allowance across a firmware scan and stops when the scan is cancelled; checksum fields must be eight hex digits, and skipped verification is reported (R3.12). Replays #676.
Co-authored-by: Afloat <132809511+Afloat16@users.noreply.github.com>
GitHub Copilot CLI can be a coding agent over ACP, with its models chosen through the shared agent model catalogue; options that could bypass the app's tool restrictions are refused, and agents share investigation findings safely.
OpenCode Go can be added as a backend: offered when OPENCODEGO_API_KEY (or OPENCODE_GO_API_KEY) is set, on its documented base URL, with a stable per-installation x-opencode-session header kept in the AI settings. Not run against the service.
Auto mode's delete check compares paths as written and reads quoted or escaped paths with spaces as one argument, so it neither refuses deletes inside a project with capitals in its path nor lets a delete of the folder beside the project through. Replays #357.
Co-authored-by: samurai <samuraideng@gmail.com>
Older stand-in recordings keep their empty query pairs when current credential rules are reapplied, so replay matches the right page (follow-up to #648).
Local chat discovery reads a generic GGUF file name by its model folder and treats task names with version numbers as specialised, so an embedding or reranking model isn't picked for chat (follow-up to #653).
A Google AI Studio (Gemini API) key is its own choice in Settings → AI and first run, through Gemini's OpenAI-compatible endpoint, read from GEMINI_API_KEY like the other providers (fixes#646).
On Linux the window is drawn on the GPU that drives the screen (the built-in panel's, or the only one with displays), so laptops with two GPUs open fast and don't lag; WGPU_ADAPTER_NAME and WGPU_POWER_PREF still decide (fixes#571). Replays #578.
Co-authored-by: Thân Minh Nghĩa <thanminhnghia3@gmail.com>
Replays #576, #577, #581, #589, #624, #625 and #628. Builder steps stop after 25 failed builds in a row, OpenRouter tool requests ask for a provider that supports tools, a start that never opened a window draws in software next time, spinners stop redrawing every frame, local builders get a lean tool list, lldb call observation works and reports failures, and LM Studio is found on other ports.
Co-authored-by: Fábio Soares <fabiodev1123@gmail.com>
Detect offers Kimi K3.1 Pro (moonshotai/kimi-k3.1-pro) on OpenRouter instead of the older Kimi K3, with OpenRouter's list price ($2 / $10 per Mtok, $0.20 cached).
The command palette follows its selection only when the arrow keys or typing move it, so the wheel's scroll isn't pulled back to the top on the next frame (fixes#584).
Pictures can be pasted into the prompt box with Ctrl+V (Cmd+V, Shift+Insert): a copied image is saved as a PNG in the person's own cache folder and attached, copied picture files are attached as they are, and attachments show as picture tiles.
Replays #616, #617, #619, #620 and #621. Aider isn't offered until it has an adapter, Antigravity is found under a redirected LOCALAPPDATA, servers with only specialised models aren't set up for chat, an SSE event's data is capped, and a retry keeps the original request when the agent's session can't be restored. Program lookup adds lower-case extensions on Windows.
Co-authored-by: Afloat <132809511+Afloat16@users.noreply.github.com>
"Always for this project" on a consent card is remembered in the project, and a tool allowed that way isn't asked about again (fixes#563). Replays #575.
Co-authored-by: Fábio Soares <fabiodev1123@gmail.com>
When the website check finds no built site, it names every place a site is accepted (dist/, build/, out/, or a plain index.html without package.json) and where the app really is (fixes#494).
In Clean room, a chat or question refuses the agent's own file, shell and web tools outright, so it works only through our tool server; this no longer rests on the agent's defaults (fixes#564).
Replays #606–#615. Binary plists, base64, OIDs, string offsets, tar, cpio and source maps refuse or flag input they used to half-read.
Co-authored-by: Afloat <132809511+Afloat16@users.noreply.github.com>
Replays #602–#605. HAR reports redact percent-encoded credential names and declared secrets in every kept field, count decoded body bytes, and template only real dates in API paths; the stand-in backend matches older recordings with the current query rules.
Co-authored-by: Afloat <132809511+Afloat16@users.noreply.github.com>
A program that is on disk but can't start (an npm script whose node is missing) says where it is and what to check, instead of "isn't installed"; on Windows an .exe is started by the path it was found at (refs #152, #95).
Replays #597, #598, #600 and #601. The preview server answers only requests addressed to this computer, streams files, sends no body for HEAD on a missing file, caps open connections and gives a request head one deadline.
Co-authored-by: Afloat <132809511+Afloat16@users.noreply.github.com>
Replays #591–#596. The HTML scanner reads rel token lists, decodes asset URLs once, keeps script and title text through lookalike closing tags, and skips raw-text elements, markup inside attribute values and custom tag names.
Co-authored-by: Afloat <132809511+Afloat16@users.noreply.github.com>
Refs #44, #110 and #481. A build stops after two builder turns in a row change no app files, counted across runs in a versioned inbox/build-progress.json; a new request or a real edit starts another attempt. File digests are cached by size and modification time, so unchanged files aren't read again.
Refs #377 and #142. Builder retries are decided by typed failures instead of English text: sign-in, billing, missing programs, configuration and failed required tools stop at once, while dropped connections, rate limits and plain crashes are retried up to three times with bounded waits. OpenCode's JSON output is read for errors, text, tools and usage.
Refs #498. A tool argument of the wrong type is answered with its JSON Pointer, the type error and how to correct the call, so a model can fix it; schema types stay strict.
Supersedes #216. A prompt brought back with Up keeps the pictures it was sent with. feed.json moves to version 3: a User item with pictures is saved as {text, pictures}, one without stays a plain string, so older files read as before. Picture paths are absolute, so they don't come back after the project is moved.
Co-authored-by: muraa-p <muraa-p@users.noreply.github.com>
Refs #417. A complete JSON tool call a model writes as its whole reply (bare or fenced, with name and arguments or parameters, or a function wrapper) runs as that tool when it was offered, including when native tool calling was offered; examples in prose, malformed or partial JSON stay text, and Action:/Action Input: steps still work.
#555 added "Pausing…" to every UI catalog and #486 added the Russian one without it, so the catalog parity test failed on main; this adds the Russian translation.
Fixes#505. The Flatpak grants home read-only, so new projects in the default folder (~/Documents/Craft Anything) failed with "Read-only file system". Both manifests now also grant xdg-documents/Craft Anything:create; the rest of home stays read-only.
Fixes#540. Codex's codex exec can't ask for approval, so setup and the builder approve rebuild_start (which asks the person itself) on Codex's side, keeping the person's other settings in the entry; a refused call explains the fix instead of showing null.
Fixes#522. On Windows the app draws with the DX12 shader compiler that ships with Windows (FXC) unless WGPU_DX12_COMPILER says otherwise, and a lost graphics device says how to draw without the graphics card (CRAFT_ANYTHING_RENDERER=software).
Over ACP, session/update notifications that session/load replays before it answers are kept out of the new turn, so a continued session no longer shows the earlier conversation again.
Fixes#506. Under a Flatpak, where ~/.claude is read-only, Claude Code is started with a writable CLAUDE_CONFIG_DIR in the app's data folder so its conversations are saved and --resume works; the sign-in message says how to sign in inside the sandbox. A CLAUDE_CONFIG_DIR the person sets wins, and SSH builds are unchanged.
Refs #374. A backend can set its own conversation budget (context_tokens in [[ai.backends]]); the conversation is fitted to it before each model attempt, including a fallback with a smaller window, counting history added since the last measured request.
Native tool calls keep a reported output-limit or refusal stop instead of being run as tool use, and calls left unrun after a pause or other stop get matching non-execution results so the next request stays valid.
A stand-in backend no longer replays a recorded 304 without its cached body: such samples are kept for diagnosis, skipped in replay, and a request with no usable answer gets cached_body_unavailable. Builds count them.
The rebuild releases its keep-awake helper before reporting Finished, and dropping the guard waits up to five seconds for the helper to stop (logging if it doesn't), so a CLI that exits right away no longer leaves it running.
Refs #369. API errors show the provider's own reason from error.metadata.raw (with the provider's name) instead of only "Provider returned error"; unknown or malformed payloads are not dumped, and the message is bounded.
* Record that #490 is settled on Windows and move its macOS run to the live checks
* Name R5.1's two failures, and say which checks read another worktree
* Claim: count a plain HTML site as built (R2.7)
* A plain HTML site passes the build check as it is, with nothing to build
* Note the keep-awake helper seen outliving a CLI run, and a search that found itself
* A blank page, or a game engine's project beside it, doesn't pass as a static site
* A static site with an assets folder isn't sent to Unity
Fixes#469. craft.json records which coding agent saved the session (agent_session_by). A build or a question continues the session only with that agent; after the builder changes, the new one starts from the brief. A follow-up to an agent with no saved session also gets the brief.
Fixes#451, fixes#452, closes#446. Claude Code's result for a --resume session it doesn't have is recognised (StreamParser::session_missing); the build forgets the stale id and starts a new session from the brief, what is in app/ and what the project kept of the old conversation, and questions answer from the project's files. After every builder turn the project keeps a private copy of the session, which is put back under Claude Code's folder on another computer when it isn't there (never over an existing one).
Aek