Repository navigation
Testnew - #36
Closed
Superagentsys wants to merge 55 commits into
Closed
Testnew#36Superagentsys wants to merge 55 commits into
Superagentsys wants to merge 55 commits into
Conversation
…context-security-hardening
Enable OS-level desktop control behind approvals, default allowed_apps to *, and keep chat toolbar menus from being clipped. Co-authored-by: Cursor <cursoragent@cursor.com>
Keep native desktop control on top of the browser runtime and web tooling updates. Co-authored-by: Cursor <cursoragent@cursor.com>
Desktop automation stalled a few actions into a task because four independent gates cut the run short: - Action budgets were tiny and the per-run counter never reset, so one task got at most 15 mouse/keyboard actions, while the hourly cap was a process-global 40 that froze every session for an hour. Both budgets now treat 0 as unlimited and default to it, and an action rejected by a later check is no longer charged to the run counter. - Hard thrash detection returned through the same path as a pending approval, which ended the whole run. It now steers the model back to snapshot and lets the task continue. - Screenshot feedback keyed off multimodal.vision_enabled instead of desktop_vision_enabled, so the agent drove the desktop blind. Provider image support is checked through provider_accepts_openai_images, now shared with the gateway instead of duplicated. - Saving Setup force-added computer_use to approvals.require_approval, contradicting the auto-approve list and making every click wait for a human. Also fixes a Windows-only E0716 in windows_sendkeys, which kept a borrow of the temporary lowercased key part past its scope, and registers OmniRun as a keyless OpenAI-compatible local provider on port 28090. Co-authored-by: Cursor <cursoragent@cursor.com>
A 1280px desktop frame is roughly 250KB of base64. C1 measured the serialized request body character by character, so a single screenshot was billed as about 310K tokens and every request carrying one was blocked locally before it was ever sent. The candidate estimator charged the same image 1024 tokens, so proactive maintenance saw a healthy context and did nothing while C1 killed the identical request. Both paths now charge IMAGE_BUDGET_TOKENS per image: a vision model bills an image by tiles, and the base64 that carries it over the wire is never tokenized. Also bound what a long desktop run accumulates and what one frame costs on the wire, and stop reporting the failure as a content block: the preflight error names safety_reserve_tokens, which the UI classifier matched on a bare "safety". - charge inline data: image payloads a fixed budget cost in both estimate_request and estimate_messages_with_tools - keep only the newest desktop frame model-visible; older observations keep their text and drop their pixels, leaving user attachments alone - cap one encoded frame at 320KB, stepping dimension and quality down - classify context overflow before the safety branch in the UI Co-authored-by: Cursor <cursoragent@cursor.com>
The build scripts already had linux:arm64 wired through platforms.mjs, build-platform.mjs and build-all-desktop.mjs; only the release matrix was missing an entry for it. Runs on a native ARM64 runner instead of cross-compiling from x86_64. prepare-browser-runtime.mjs resolves the agent-browser binary from the host architecture and then executes it to probe --version, so a cross build would stage the x64 browser into an ARM64 bundle and fail that probe. agent-browser publishes a linux-arm64 asset and every arm64-gnu native npm binding is already in package-lock.json, so npm ci resolves on the ARM runner without changes. Bundles are limited to deb/rpm for this target because Tauri's AppImage tooling is unreliable on aarch64. The matrix bundles field is optional, so the other four platforms keep building every bundle. Co-authored-by: Cursor <cursoragent@cursor.com>
Reuse agent-browser named-profile copies with OmniNova integrity validation and owned snapshot cleanup, without writing the source Chrome profile. Co-authored-by: Cursor <cursoragent@cursor.com>
Add ownership markers, list/get/ensure, and trash-based delete for OmniNova managed persistent profiles without exposing profile APIs to the Browser Tool schema. Co-authored-by: Cursor <cursoragent@cursor.com>
…f PowerShell Replace the console-shelling desktop driver with direct user32 calls for cursor, key and clipboard input, and pick the foreground target from the real app rather than the console host that issues the input, so an allowlist entry like `Excel` still matches when the window identity comes back as a full exe path or a document title. Also teach build.rs to locate the omninova CLI under the active target triple so cross builds stop bundling the host binary, and surface computer_use in the run timeline labels. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
…profile-snapshot # Please enter a commit message to explain why this merge is necessary, # especially if it merges an updated upstream into a topic branch. # # Lines starting with '#' will be ignored, and an empty message aborts # the commit.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add a thin native-messaging host and authenticated named-pipe IPC so Desktop can talk to a Personal Chrome extension without implementing PersonalChromeBackend. Co-authored-by: Cursor <cursoragent@cursor.com>
…dget A mirrored marketplace of 11k skills was written into the system prompt in full, producing 3.2 MB (~4.1M estimated tokens) of catalog against a 935K input budget, so every request in that session was rejected before it was sent. Cap what gets inlined and let the model search for the rest: `use_skill` now takes a `query` that ranks the whole catalog, and a failed id comes back with candidates instead of only an error. Measured on the real 11,389-entry store, the catalog drops to 33 KB (~41K tokens). Cache the catalog while we are here. Building it walks ~89k directory entries and costs ~7s, almost all of it in the walk rather than the frontmatter parse, and it is rebuilt several times per turn. The cache keys on skills_generation(), which every install, removal, rollback, import and skills-config save already bumps, so in-app mutations are visible on the next read; the TTL only bounds edits made outside the app. Co-authored-by: Cursor <cursoragent@cursor.com>
Desktop capture existed twice: computer_use drives it through a cross-platform driver, while the Tauri command reimplemented it per platform and left Windows as a stub that only returned "暂未实现". Delegate the command to the same driver so the desktop-vision preview and the agent's own screenshots cannot differ by platform. Also stop discarding the primary capture error. It was dropped on the fallback path, so a Windows failure surfaced as "fallback unavailable" with the real cause gone, and the Windows fallback text now names what actually prevents capture: no interactive desktop session. Co-authored-by: Cursor <cursoragent@cursor.com>
onionfishfish
force-pushed
the
testnew
branch
from
September 6, 2026 06:20
96aa01d to
bf96421
Compare
Co-authored-by: Cursor <cursoragent@cursor.com>
The macos-intel bundle shipped an arm64 agent-browser and could not launch a browser at all. prepare-browser-runtime.mjs picked the binary from process.arch, and the Intel job runs on macos-latest, which is now an ARM runner cross-compiling x86_64-apple-darwin. The npm package already ships every platform binary, so only the selection was wrong. Resolve the target from build-platform.mjs, which owns the --target flag, ahead of Tauri's hook environment: if those variables were ever absent we would fall back to the host and silently stage the wrong architecture again. Then verify the staged binary by reading its Mach-O/ELF/PE machine type and fail the build on a mismatch, so this class of error stops being something a user discovers at runtime. --version now runs only when the target can execute on the host. Co-authored-by: Cursor <cursoragent@cursor.com>
denied_action_is_not_charged_to_the_run_budget failed in the full suite but passed alone. The E-Stop flag is process-global, so estop_blocks_mutating_actions pausing input denied the clicks of whatever ran beside it, and the budget assertions saw an E-Stop refusal instead of the run-budget refusal. Resetting the flag when a session is built was not enough: it only held until the next test started. Hand a guard out with the session instead, so the reset covers the whole test. Acquiring it in the builder rather than per test means a new test cannot forget it. Co-authored-by: Cursor <cursoragent@cursor.com>
ensure_session_executable only resolved an executable on Windows, or when a configured pin existed, so macOS and Linux never bound the browser the user actually has: agent-browser fell back to its own Chromium, without their logins or extensions. The two executable_is_bound_* tests asserted the bound source unconditionally and so failed everywhere but Windows. Dropping the platform gate alone would have broken every session off Windows, because the automatic scan had no candidates there at all: the system paths were behind cfg(windows) and the managed paths are Windows-shaped, so the resolver returned BrowserUnavailable on an empty list. Add the macOS and Linux system paths, keeping Chrome ahead of Brave as on Windows. Exhausting the automatic candidates now stays non-fatal off Windows. The scan is an attempt to bind the user's browser, not the only route to one, so a machine without Chrome keeps its sessions instead of losing them. A configured pin still fails closed everywhere, and Windows still fails closed because it has no second route. Verified against a real agent-browser: --executable-path on the macOS Chrome.app binary reports engine=chrome and browserLaunched, so the probe passes on a real machine rather than silently falling back. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.