Replays #616, #617, #619, #620 and #621. Aider isn't offered until it has an adapter, Antigravity is found under a redirected LOCALAPPDATA, servers with only specialised models aren't set up for chat, an SSE event's data is capped, and a retry keeps the original request when the agent's session can't be restored. Program lookup adds lower-case extensions on Windows.
Co-authored-by: Afloat <132809511+Afloat16@users.noreply.github.com>
JavaScript analysis reads a source map comment from the last eight lines of the whole script and keeps its full URL, so originals are restored from large inline source maps.
"Always for this project" on a consent card is remembered in the project, and a tool allowed that way isn't asked about again (fixes#563). Replays #575.
Co-authored-by: Fábio Soares <fabiodev1123@gmail.com>
When the website check finds no built site, it names every place a site is accepted (dist/, build/, out/, or a plain index.html without package.json) and where the app really is (fixes#494).
In Clean room, a chat or question refuses the agent's own file, shell and web tools outright, so it works only through our tool server; this no longer rests on the agent's defaults (fixes#564).
Replays #606–#615. Binary plists, base64, OIDs, string offsets, tar, cpio and source maps refuse or flag input they used to half-read.
Co-authored-by: Afloat <132809511+Afloat16@users.noreply.github.com>
Replays #602–#605. HAR reports redact percent-encoded credential names and declared secrets in every kept field, count decoded body bytes, and template only real dates in API paths; the stand-in backend matches older recordings with the current query rules.
Co-authored-by: Afloat <132809511+Afloat16@users.noreply.github.com>
Builder file tools and the approval policy follow links the way the file system does, so a symlink or junction inside a project can't lead a builder's read or write outside it (CWE-59); build_files_list shows links without walking into them.
The Ghidra client refuses a reply line over 128 MiB and closes the connection, so a hostile binary can't make one reply exhaust memory; a long reply split across read ticks is still read whole.
web_scripts_save copies only the scripts that fit its max_scripts and max_bytes; scripts past them are listed by URL only, so a large or hostile capture costs no more than the export's own limits.
A program that is on disk but can't start (an npm script whose node is missing) says where it is and what to check, instead of "isn't installed"; on Windows an .exe is started by the path it was found at (refs #152, #95).
A native call graph lists at most 50,000 call edges and says when it stopped there, so one function with a huge number of call sites can't blow up the report.
Fixes a flaky platform test: on macOS an accepted socket inherits the listener's non-blocking mode, so the keep-awake stand-in helper dropped a stop that arrived after accept.
Replays #597, #598, #600 and #601. The preview server answers only requests addressed to this computer, streams files, sends no body for HEAD on a missing file, caps open connections and gives a request head one deadline.
Co-authored-by: Afloat <132809511+Afloat16@users.noreply.github.com>
Replays #591–#596. The HTML scanner reads rel token lists, decodes asset URLs once, keeps script and title text through lookalike closing tags, and skips raw-text elements, markup inside attribute values and custom tag names.
Co-authored-by: Afloat <132809511+Afloat16@users.noreply.github.com>
Refs #44, #110 and #481. A build stops after two builder turns in a row change no app files, counted across runs in a versioned inbox/build-progress.json; a new request or a real edit starts another attempt. File digests are cached by size and modification time, so unchanged files aren't read again.
Refs #377 and #142. Builder retries are decided by typed failures instead of English text: sign-in, billing, missing programs, configuration and failed required tools stop at once, while dropped connections, rate limits and plain crashes are retried up to three times with bounded waits. OpenCode's JSON output is read for errors, text, tools and usage.
Refs #498. A tool argument of the wrong type is answered with its JSON Pointer, the type error and how to correct the call, so a model can fix it; schema types stay strict.
Fixes#520. Supersedes #521. core_archive_extract skips ZIP symlink, device, FIFO and socket members and names each in skipped, instead of writing a symlink as a file holding its target.
Co-authored-by: NetterSilver <133535268+Silvertree2010@users.noreply.github.com>
Supersedes #216. A prompt brought back with Up keeps the pictures it was sent with. feed.json moves to version 3: a User item with pictures is saved as {text, pictures}, one without stays a plain string, so older files read as before. Picture paths are absolute, so they don't come back after the project is moved.
Co-authored-by: muraa-p <muraa-p@users.noreply.github.com>
Refs #417. A complete JSON tool call a model writes as its whole reply (bare or fenced, with name and arguments or parameters, or a function wrapper) runs as that tool when it was offered, including when native tool calling was offered; examples in prose, malformed or partial JSON stay text, and Action:/Action Input: steps still work.
#555 added "Pausing…" to every UI catalog and #486 added the Russian one without it, so the catalog parity test failed on main; this adds the Russian translation.
Fixes#549. Gemini CLI gets its message on stdin with an empty -p, so a long message no longer passes cmd.exe's 8,191-character limit through gemini.cmd.
Fixes#505. The Flatpak grants home read-only, so new projects in the default folder (~/Documents/Craft Anything) failed with "Read-only file system". Both manifests now also grant xdg-documents/Craft Anything:create; the rest of home stays read-only.
runtime_captures_compare's left and right parameters are declared as a string or an object instead of a boolean schema, which made Claude Code drop every tool from the MCP server; on the command line a JSON object passed to them stays an object.
Fixes#540. Codex's codex exec can't ask for approval, so setup and the builder approve rebuild_start (which asks the person itself) on Codex's side, keeping the person's other settings in the entry; a refused call explains the fix instead of showing null.
Fixes#522. On Windows the app draws with the DX12 shader compiler that ships with Windows (FXC) unless WGPU_DX12_COMPILER says otherwise, and a lost graphics device says how to draw without the graphics card (CRAFT_ANYTHING_RENDERER=software).
Over ACP, session/update notifications that session/load replays before it answers are kept out of the new turn, so a continued session no longer shows the earlier conversation again.
Fixes#506. Under a Flatpak, where ~/.claude is read-only, Claude Code is started with a writable CLAUDE_CONFIG_DIR in the app's data folder so its conversations are saved and --resume works; the sign-in message says how to sign in inside the sandbox. A CLAUDE_CONFIG_DIR the person sets wins, and SSH builds are unchanged.
Fixes#518. With if_tampered=continue, core_archive_extract writes a ZIP member whose CRC does not match (the mismatch stays in contradictions), as its remediation says.
Fixes#519. core_archive_show counts nested archives that a depth or size limit left unopened, reports a nested_not_opened limitation and marks coverage partial.
Fixes#516 and #517. Archive extraction refuses member names with a colon or a trailing dot or space, which Windows would change (merging two members, or hiding bytes in an alternate data stream).
Fixes#510. The built-in engine lists DNS answers like tshark does: each A/AAAA address keyed by the response's first question, so CNAME chains end at the name asked. Both engines report the dns_answer_attribution limitation.
Fixes#509. The TCP decoder keeps the ports (and the tcp protocol entry) when a frame is cut later in the TCP header; each later field is set only when its own bytes were captured.
Fixes#316. The C# declaration scanner records operators under their CLR names (op_Equality, op_Addition, op_Implicit…), so managed_reconstruction_check no longer reports declared operators as missing.
Refs #374. A backend can set its own conversation budget (context_tokens in [[ai.backends]]); the conversation is fitted to it before each model attempt, including a fallback with a smaller window, counting history added since the last measured request.
BFlat