[lihongguang-0014]

Scope

Malformed quoted text and long file references could hold the Python GIL during full-history coverage extraction after the model returned a summary, preventing compaction from reaching its durable commit. Use monotonic scans with compact indexes and incremental path consumption while preserving exact references and manifest completeness semantics.

• Cover quoted/code paths, extensionless and adjacent paths, artifact names, and command/code-span lookups without truncating source history. Compact token and delimiter arrays avoid retaining regex objects and large Python object graphs.
• Observe raw provider terminal events before usage-ledger finalization. Record content-free timings across settlement, actual iterator exhaustion/transport cleanup, coverage extraction, validation, admission, replanning, mutation-lock waiting, and both durable commit paths. Diagnostic sink failures cannot alter work outcomes or accounting/commit cancellation barriers.
• Record the Desktop-owned Gateway's actual exit separately from delayed stdio closure, with PID, shared public instance UUID, uptime, exit code/signal, Windows status, and stop/termination intent. Add CLI runtime-boundary records and retain the metadata through private-log formatting and bundles.
• Remove the vulnerable deepmerge chain from Desktop download-proxy tooling by overriding only roarr's private fast-json-stringify serializer to 5.16.1 and its version-scoped URI resolver to 3.1.9. Preserve the existing global-agent/roarr interfaces and reviewed TLS behavior; verify real proxy logging, routing, and checksum rejection.

Scope boundary: historical reference extraction, compaction/process observability, and the minimal download-proxy dependency fix required by the unchanged security gate.

Non-goals: image request-body limits, summary quality/admission policy, or determining the exact cause of a private user incident.

Branch

Base branch: main

Target exception: N/A

Development baseline: freshly fetched origin/main@2bca6f54e4ed82301a25f12d29f9021f46243566; checked again before the review update.

Issue

Linked issue: None

If None, reason: Maintainer-requested fix, independent review improvements, and remediation of the existing dependency-audit blocker.

Release Note

Release note: CHANGELOG.md Unreleased covers the scan fix, phase/process diagnostics, and removal of the vulnerable proxy dependency. Operator interpretation is documented in docs/diagnostics-and-replay.md.

Tests

Ruff: All changed Python source/test files passed; git diff --check passed.

Pytest on the reviewed implementation:

• Complete session suite: 2393 passed, 4 skipped.
• Focused engine/accounting, application and Gateway compaction group: 102 passed.
• Desktop startup and dependency-security contracts: 136 passed.
• CLI Gateway: 129 passed.
• Bundle/privacy: 88 passed.
• CI sharding and collection contracts: 152 passed, 3 skipped locally.

Build and dependencies:

• Full mypy passed for 1,643 source files.
• Clean Electron npm ci --ignore-scripts, build, gateway lifecycle, process-cleanup lifecycle, and quit tests passed.
• 19 proxy/checksum/TLS tests passed, including actual global-agent request/response log serialization and installed URI/schema resolution with invalid-input rejection.
• Complete unchanged pinned dependency audit: 0 errors, 0 vulnerable records, covering all locked Python variants and both npm trees.

Regression tests: added

Notes:

• Six fresh-interpreter CPU watchdog cases exercise the real coverage builder; three allocation-budget cases cover dense paths, quotes, and backticks. A GIL-holding regression cannot hang pytest.
• A synthetic baseline coverage scan exceeded a three-second watchdog; the fixed scan completed in approximately 0.14 ms locally. For 1 MB of dense paths, additional RSS fell from about 247 MB in the first implementation to about 18 MB with compact indexes. These are local measurements, not cross-platform throughput guarantees.
• Differential synthetic tests found no path, command, artifact, quote-span, or code-span extraction differences. Oversized references retain incomplete-manifest semantics and do not hide later goals/references.
• Bound UsageAccountingScope regressions hold ledger finalization, iterator exhaustion, and transport close after raw DoneEvent; diagnostics remain visible and preserve cancellation barriers and event identity/order.
• A real child/descendant regression proves exit is observed while inherited stdout/stderr remain open. Existing ownership-order source guards remain enforced. Profile-import, theme, and background-window acceptance cleanup use the existing confirmation-aware quit protocol, retaining the connection needed to accept a real unknown-activity confirmation within the same 15-second shutdown budget.
• Scanner logic is platform-neutral. Process tests cover Windows raw/hex status, macOS/Linux signals, wrapped-process identity, normal quit/update intent, and unchanged lifecycle ownership. Native packaged acceptance is verified by required CI.
• Native SQLite close cancellation uses the existing ci_serial phase. Both backends, the two internal concurrent closes, repeated cancellation, ownership assertions, and the original two-second watchdog remain unchanged. Collection verifies all 50 cases in the file are retained exactly once: 11 serial and 39 parallel.
• A directly launched CLI process forcibly killed without a supervisor cannot write its own final event; Desktop records exit from the parent.
• Full PR CI passed on 7f08a63c4; full merge-queue CI passed on the merged tree 787e3f9b5. Fresh dependency audits and native packaged acceptance passed under the existing protection rules. Earlier attempts remain available in Actions history.
• No persisted schema/config or public RPC changes. Existing transcripts and reference manifests retain their formats and completeness rules.

The default test path remains offline, deterministic, credential-free, and safe for forks.

Maintainer Live Check

Maintainer live check: no

Surface: gateway

Maintainer-only note: Synthetic reproduction, regression suites, real child-process observation, and Desktop wiring/proxy checks are complete. No provider credentials or private session content are required.

Safety

Diagnostics contain host classifications, timing and process metadata, never prompts, summaries, exception messages, launch arguments or ownership secrets. No private transcripts, local artifacts, machine-specific paths, credentials or tests/_private/ contents are committed. Existing accounting, shutdown/recovery ownership and atomic commit behavior remain intact. Security audit thresholds and coverage are unchanged.

Third-Party Origin

Third-party origin: direct dependency

The existing fast-json-stringify registry dependency is updated under its MIT license; no source is copied or vendored. Registry integrity metadata is retained in package-lock.json and the existing dependency packaging notice applies. This removes the dependency chain affected by GHSA-gcqx-w48m-w2h4.

Read-only agent-reference research informed behavior and test shape. All scanner, diagnostic and regression code and wording were written independently.

Documentation Changes

• Links point to existing repository files or stable external pages.
• Code fences and Markdown tables render correctly on GitHub.
• Examples avoid real secrets, local private paths and private transcripts.

[github-actions]

Merge queue CI: cancelled — run 40673831218, attempt 1.
Tested queue candidate: c3f567b24a582656e919dd258aa34dbbf7977549. This result belongs to that combined tree, not necessarily the PR's current head.

• macOS profile recovery and native no-replace (3.12): cancelled
• Windows high-risk (gateway-sqlite-4): cancelled
• Windows high-risk (gateway-sqlite-2): cancelled
• Windows high-risk (core-4): cancelled
• Windows high-risk (core-1): cancelled
• Windows high-risk (core-3): cancelled
• Windows high-risk (core-2): cancelled
• Windows high-risk (gateway-sqlite-7): cancelled
• Windows high-risk (desktop-installer-contracts-2): cancelled
• Windows high-risk (gateway-sqlite-8): cancelled
• Windows high-risk (recovery-migration-1): cancelled
• Windows high-risk (gateway-sqlite-6): cancelled
• Windows NSIS acceptance / Installed packaged gateway-smoke: cancelled
• Windows NSIS acceptance / Installed packaged dependency-audit: cancelled
• Windows NSIS acceptance / build: cancelled
• Desktop recovery E2E (ubuntu-latest, profiles): cancelled
• Desktop recovery E2E (windows-latest, profiles-profile-import-flow): failure
• Windows NSIS acceptance / Installed packaged first-interaction: cancelled
• Desktop recovery E2E (macos-latest, profiles): cancelled
• Windows NSIS acceptance / upgrade-and-start (0.5.3, default, baseline): cancelled
• Windows NSIS acceptance / upgrade-and-start (0.5.4, custom, baseline): cancelled
• Windows NSIS acceptance / upgrade-and-start (0.5.3, custom, longpath): cancelled
• Windows NSIS acceptance / upgrade-and-start (0.5.4, default, baseline): cancelled
• Windows NSIS acceptance / upgrade-and-start (fresh, default, fresh): cancelled
• Windows NSIS acceptance / upgrade-and-start (0.5.3, custom, baseline): cancelled
• Windows NSIS acceptance / upgrade-and-start (0.5.4, custom, longpath): cancelled
• Windows NSIS acceptance / upgrade-and-start (fresh, custom, fresh): cancelled
• Windows NSIS acceptance / upgrade-and-start (0.5.4, default, readlock): cancelled
• Windows NSIS acceptance / upgrade-and-start (0.5.4, default, longpath): cancelled
• Windows NSIS acceptance / upgrade-and-start (0.5.3, default, longpath): cancelled
• Windows NSIS acceptance / upgrade-and-start (0.5.3, custom, readlock): cancelled
• Desktop recovery E2E (windows-latest, profiles): cancelled
• Windows NSIS acceptance / upgrade-and-start (0.5.3, default, readlock): cancelled
• Windows NSIS acceptance / upgrade-and-start (0.5.4, custom, readlock): cancelled
• Windows NSIS acceptance / Windows NSIS acceptance result: failure
• Windows profiles exact-once coverage: cancelled
• CI result: failure

The run summary lists reused suites and executed checks. A green PR check alone does not mean queue validation has passed.

[github-actions]

Merge queue CI: failure — run 40674837903, attempt 1.
Tested queue candidate: 12cff17cd0f6bd9c279338b1562b4954fa1d8a42. This result belongs to that combined tree, not necessarily the PR's current head.

• Managed Toolchain Artifact E2E / macOS Apple Silicon real artifacts / media-ffmpeg: failure
• CI result: failure

The run summary lists reused suites and executed checks. A green PR check alone does not mean queue validation has passed.

[github-actions]

Merge queue CI: failure — run 40681084098, attempt 1.
Tested queue candidate: 69bd5d6fc8827f17056996bd68499976359bf657. This result belongs to that combined tree, not necessarily the PR's current head.

• macOS profile recovery and native no-replace (3.12): failure
• CI result: failure

The run summary lists reused suites and executed checks. A green PR check alone does not mean queue validation has passed.

[github-actions]

Merge queue CI: failure — run 40684007427, attempt 1.
Tested queue candidate: ce0764deb3b7e5bf39f1cf35c86b98f9548cf39b. This result belongs to that combined tree, not necessarily the PR's current head.

• Windows high-risk (core-1): failure
• CI result: failure

The run summary lists reused suites and executed checks. A green PR check alone does not mean queue validation has passed.

[github-actions]

Merge queue CI: failure — run 40686424288, attempt 1.
Tested queue candidate: 227812da9ed9de5f1c9a2db50838c0defe2e338f. This result belongs to that combined tree, not necessarily the PR's current head.

• Windows high-risk (gateway-sqlite-6): failure
• Desktop recovery E2E (macos-latest, ownership): failure
• CI result: failure

The run summary lists reused suites and executed checks. A green PR check alone does not mean queue validation has passed.

[github-actions]

Merge queue CI: success — run 40700049185, attempt 1.
Tested queue candidate: 787e3f9b533dcfbd3837b25d08944dd0ceb90ba2. This result belongs to that combined tree, not necessarily the PR's current head.

The run summary lists reused suites and executed checks. A green PR check alone does not mean queue validation has passed.