integrate: merge five reviewed and repaired PRs - #192
Merged
Conversation
- SessionEnd: notification-only hook fired on every terminal path (complete / interrupted / error), so summaries can be persisted even when compaction never ran
…ompact context - SessionEnd fires exactly once at real session termination (AgentSession.submit(Shutdown)), never per turn; per-turn notifications belong to the Stop event. - SessionEnd honours its matcher: the session-exit reason (shutdown/interrupted/error) is the matcher input. - hooks_config.json (deepcode-hooks MCP list format) is accepted only from the user-mcp source, with explicit validation, priority ordering, timeout parsing, event aliases and optional matchers. - PreCompact checkpoint re-injection is bounded and provider-safe: per-context and total limits, only after a successful compaction. - Add e2e regression tests (tests/test_session_end_lifecycle.py).
…paths - execution._default_shell(): prefer a POSIX shell (Git Bash sh) on Windows so POSIX-syntax hook commands run; fall back to cmd.exe. - sandbox.build_exec_command(): resolve POSIX-style shell paths to a real executable on Windows (CreateProcessW cannot launch /bin/bash); job backend injects PYTHONPATH so the windows_sandbox wrapper can import core. - tools/shell.BashTool: pass wrapped.extra_env into the subprocess env so the injected PYTHONPATH reaches the sandbox wrapper. - tests/test_hooks.py: use capture.as_posix() in shell commands so WindowsPath backslashes are not escaped by sh. Local result: tests/test_hooks.py 53 passed; tests/test_agent_session.py 25 passed.
…th bare The Windows shell-path resolution in build_exec_command() was applied to all paths, including the sandbox-disabled one. That broke the upstream-locked contract (test_disabled_via_env_returns_bare expects the bare '/bin/bash -c' argv when sandboxing is disabled). Move the resolution after the disabled early return so only the Job Object sandbox path (CreateProcessW) gets a real executable path, while the disabled path keeps the bare argv untouched.
Resolve core/agent_runtime/runner.py conflicts: keep PreCompact checkpoint injection (PR) + upstream refused-compaction guard.
The merged upstream main renamed the prompt-size estimator (estimate_prompt_tokens_chain -> _estimate_prompt instance method) and added the dsh convergence rule that rejects summaries which do not shrink the history. Update the three _maybe_compact tests: - patch runner._estimate_prompt (returns a plain int) instead of the removed module-level function - enlarge the sample turns so the compacted history + summary prefix is genuinely smaller than the source, satisfying the shrink gate
Security CI's 'Audit locked App Server environment' step fails on every branch because the sidecar lock pins pip==26.1.2, which PYSEC-2026-3721 (healchecks pip < 26.2) now flags. pip publishes no wheels-only constraint here, so bump the universal lock entry to the fixed 26.2 release.
…it dangerous preset
借鉴 Claude Code 两处机制 (2026-08-19):
1. core/harness/memory.py — 指令文件排除模式
- DEEPCODE_INSTRUCTION_EXCLUDES env: 逗号分隔 glob (如 **/code/CLAUDE.md,**/vendor/**)
- 命中的 AGENTS.md/DEEPCODE.md/CLAUDE.md 跳过注入, 避免 monorepo 子目录/
第三方代码指令污染主提示词
- 自实现 glob→regex: ** 匹配任意层级(可选前缀 (?:.*/)?), * / ? 不跨路径
分隔符; vendorized ≠ vendor/ 前缀同名不误匹配
- 非法模式忽略不阻断加载
2. core/domain/execution_security.py — 显式危险预设
- ExecutionAccessPreset.DANGEROUS_SKIP="dangerous_skip", 对齐 Claude Code
--allow-dangerously-skip-permissions; 与 FULL_ACCESS 同强度但名字自带
危险警示, 供日志/UI 明确区分
3. tests/test_memory.py — 4 个新用例 (glob 正反例/集成/非法模式)
Addresses maintainer feedback on the earlier ACL PR (#148): re-running icacls on every open costs two subprocesses per call for no change. - open_private_file now restricts a file's ACL only when it was just created (target did not exist before os.open); opening an existing private file never re-runs _restrict_windows_acl. - harden_private_tree keeps forcing the restriction (it repairs legacy trees whose ACLs may be absent), so its semantics are unchanged. - new cross-platform tests (mock _restrict_windows_acl) assert: new file restricted exactly once, existing file never re-restricted, read-only open of an existing file never restricts.
Cross-platform call-count tests exposed two structural bugs: - elif created: hid the file restriction behind the POSIX fchmod branch, so the mocked ACL call never fired on non-Windows runners (0 calls). - _chmod restricted unconditionally on Windows, so ensure_private_directory re-ran icacls on the already-existing parent dir on every open (2-4 calls instead of 1). Now: directories restrict only when actually created (was_missing), files restrict only when created (independent if created), and _chmod honors force= (harden_private_tree/ensure_private_file still re-apply, regular callers do not churn existing paths).
Add McpServerDefinition.defer_loading (deferLoading). Servers marked deferred are skipped by ensure_started (status stays 'deferred', no connection, no tools) and are brought up on demand via McpSessionRuntime.activate_server, which starts the connection, registers the server's tools into the ToolRegistry, and publishes status/capabilities. Idempotent; startup failures mark the server 'failed' without raising. Derived from the MCP lifecycle study of Hmbown/CodeWhale.
core/mcp/test_runtime_lazy.py sat outside pytest testpaths (tests/ + quant_trading/tests), so CI never collected the 5 new cases. Move it to tests/test_mcp_runtime_lazy.py; now collected and run by CI.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Integrates five individually reviewed contributor PRs in dependency order, including maintainer-side fixes:
Why
These changes unblock the repository-wide dependency audit, reduce prompt/instruction contamination, lower MCP startup cost without making deferred servers unreachable, make hook teardown semantics reliable, and harden private Windows runtime state.
Verification
Closes #191
Closes #186
Closes #184
Closes #172
Closes #164