Repository navigation
Conversation
…t-AI#179) * fix: distinguish retryable ledger contention from scope denials * fix: preserve error classification through marker discovery and relay * test: exercise classified denials through gateway configuration * fix: honor bounded gateway retry hints during object downloads
…ic (LibreChat-AI#180) * perf: reuse authorized input versions and make egress accounting atomic * perf: resolve authorized input manifests once per execution * test: preserve fetch signature in revocation fixture * fix: isolate shared-grant failures and prevent ledger replay
* fix: evict stale file-object index entries Forget cached locators after successful deletion and missing-object downloads so replacement keys resolve immediately. Reuse exact resolver matching in the delete route to avoid prefix collisions. Fixes LibreChat-AI#181 * fix: keep file-object deletion storage-authoritative * fix: retire superseded upload objects * fix: canonicalize replacement object keys * fix: collapse legacy object-key siblings * fix: recover reads from stale locators * fix: namespace canonical object identities
* fix: helm egress deployment getting stuck on install * only wait for redis if the ledger is required * Update helm/codeapi/templates/egress-gateway-deployment.yaml Co-authored-by: Danny Avila <danacordially@gmail.com> --------- Co-authored-by: Danny Avila <danacordially@gmail.com>
* 🛰️ feat: Add trusted VM command policy * docs: clarify trusted VM socket boundary
…Chat-AI#188) A clean atomic workspace mutation rejection was settled with retries cut off at the original execution deadline. When Stop arrived near that deadline, process-tree termination finished after it, so the first settlement attempt was aborted immediately while Code API was still draining the cancellation. The client received ASSIGNMENT_EXPIRED and the durable mutation guard stayed armed. Route clean workspace mutation rejections through the known-clean rejection recovery path: a transient-retrying heartbeat and settlement retries through the rejection acknowledgement grace, floored at the bridge cancellation settlement grace. Worker shutdown still fails closed. Share the grace constant from the protocol module so the bridge and worker stay aligned. Closes LibreChat-AI#173
…Chat-AI#191) * fix: Exit Cleanly When Native Executor Shuts Down Concurrently A native BYOM worker under systemd KillMode=control-group receives SIGTERM at the same time as its forked SRT executor. The child ignores IPC once it is shutting down, so the parent's close handshake is left pending until the child exits, which rejects it with 'Native executor is unavailable'. That rejection escaped the CLI finally block and turned an idle administrative stop into exit status 1. Treat the close handshake as best-effort: the executor is terminated in finally regardless, and the active command has already drained, so a lost or stalled reply carries no mutation risk. Also make the child report exit status 0 when its own SRT teardown succeeded. Closes LibreChat-AI#190 * fix: Surface Explicit Executor Cleanup Failures During Close Only a lost, refused, or stalled close handshake is benign at shutdown. A negative close reply from the executor is a real cleanup failure and still rejects so pool shutdown can aggregate it.
* feat: run PTC in selected BYOM workspaces * fix: harden native workspace PTC replay * fix: preserve replay isolation and bridge limits * test: tolerate hosts without filesystem cloning * test: surface copy-on-write clone faults * fix: harden native workspace PTC admission * fix: close native replay effect and finalization boundaries
* feat: report truncated output artifacts * fix: classify omitted artifacts precisely * fix: preserve artifact scan invariants * fix: bound depth truncation probes * fix: bound capped directory enumeration * fix: constrain truncation probes across the job * fix: stop exhausted artifact probes
* fix: cancel replay jobs across API and worker processes * fix: drain worker cancellation watches promptly * fix: close programmatic cancellation races * fix: preserve cancellation response ordering * fix: close distributed cancellation races * fix: harden cancellation under concurrent load * fix: make cancellation ownership durable through completion * fix: recover durable replay outcomes across lost replies * fix: return atomic cancellation outcomes with aligned retention * fix: commit native results inside the workspace mutation fence * fix: claim programmatic execution before stalled-job redelivery
* fix: report deleted persisted files * fix: reconcile deletions across code runtimes * fix: preserve protected session inputs * fix: classify reserved runtime paths
* feat: declare named worker project environments * fix: preserve environment trust and negotiated action boundaries * Harden environment loading and executor identity * Protect environment root traversal and exact config bytes * Reject self-controlled environment root aliases * Check filesystem identities at environment trust boundaries * Validate environment containment across Linux mount aliases * Handle stacked mounts conservatively without blocking unrelated paths
* fix: Allow Trusted Own-Root Environment Symlinks * fix: Check Alias Parent Ownership by Filesystem Identity * fix: Enforce Parent Ownership Across Every Environment Path
* fix: Retain Quarantine After Failed Environment Setup * test: Run Native Environment Setup Lifecycle in CI * fix: Document and Verify Local Setup Quarantine Recovery
* fix: decouple repository release versions * ci: automate releases after successful main builds
…ibreChat-AI#300) * 📍 feat: Quote the Current Text Where a Missing Workspace Edit Belongs A missing edit's diagnosis now ends with a bounded excerpt of the region old_text most likely meant: the alignment where most of its distinctive lines fall into place (found in one pass with bounded votes), else its unique first line or closest line. Each of at most 8 rows is `<line>|<mark><text>`, with a space for identical lines, `~` for whitespace-only differences and `!` for changed text; lines are shortened to 160 characters and the excerpt to 1,600. The excerpt is a final `; the current text at lines A-B (...) is "<json>"` hint, so hosts that parse the existing grammar drop it and keep every other hint. Excerpts are the first detail dropped to fit the 3,000-character message bound and never shorten another edit's reason. * 🧭 fix: Bound Every Alignment Offset and Anchor Excerpts Where old_text Starts - Count every inspected anchor offset against the region vote budget, and stop at the first offset that would start before the file (offsets ascend), so a repetitive old_text cannot escape the bound. - Start a first-line or closest-line excerpt at the line where old_text starts, not at its first non-blank line. - Escape U+2028/U+2029 in quoted text, which JSON.stringify leaves raw, so each batch edit stays on one line for hosts that read the message line by line. * 📏 fix: Bound Edit Excerpts by Their Encoded Error-Body Size Code API returns the diagnostic inside a JSON error body, and LibreChat reads that body through a 4,096-byte buffer, discarding a truncated one. A 3,000-character message with multibyte or escape-heavy excerpts could exceed it. Excerpts are now limited to 1,600 bytes and granted only while the whole message stays within 3,800 bytes, both measured as UTF-8 once JSON-encoded. * 📐 fix: Shorten Edit Diagnostics by Encoded Size as Well as Length Batch reasons that still exceed the bound after excerpts are declined are now shortened against both the 3,000-character limit and the 3,800-byte encoded budget, and a single edit's reason is shortened the same way instead of being cut by character count. Multibyte closest-line quotes can no longer push the Code API's error body past the 4,096 bytes hosts read.
* 🧾 feat: Persist Workspace Admission Across API Restarts * 🧾 fix: Fence Durable Admission Recovery Across Replicas * 🧾 fix: Fence Durable Capacity Acquisition Before Dispatch * 🧾 fix: Retain Durable Quarantine Outcomes Across Restarts * 🧾 fix: Preserve Durable Admission and Read Cancellation --------- Co-authored-by: Lia <lia@librechat.ai>
* 📖 feat: Stream Bounded Workspace File Reads * 🧹 fix: Settle Interrupted Reads Before Pending I/O Cleanup * ⏱️ fix: Track Workspace Read Interruption Through Cleanup * 🧪 test: Queue Descriptor I/O Consistently on Node 20 --------- Co-authored-by: Lia <lia@librechat.ai>
* 🗂️ fix: Guard Lane Worktree Registration * test: Cover Linked Lane Worktree Registration Denials --------- Co-authored-by: Lia <lia@librechat.ai>
* 🐳 ci: Publish Code API Images to GHCR Build one linux/amd64 image per Compose build on pushes to main that touch an image input, tag it sha-<commit>, and move the main tags together once every image has built. Pull requests build without pushing. Each image keeps a registry build cache so the KVM sandbox runner does not recompile its runtime packages on every push. README documents the tags and a Compose override for pulling instead of building. * 🏷️ fix: Build Every Main Commit and Promote the Newest Complete One Give each main commit its own concurrency group so a queued run can no longer be replaced and lose its sha tags. The promote job now serializes, resolves the newest main commit that has every image, retries each retag, and finishes a partial move on the next run. Report each pushed digest in the job summary and document per-image digest pinning. Drop the disk cleanup step: a cold KVM runner build peaked at about 17 GB of builder state with over 95 GB free. * 🔒 fix: Write Commit Tags Once and Never Move main Backwards Skip building any image whose sha tag for the commit already exists, so a re-run that fails part-way cannot mix two builds under one commit. Promotion retries tag inspections and refuses to move an image's main to an older commit than it names, so a transient registry error can delay a promotion but not reverse one. Note that the macOS override keeps building its own sandbox target. * 🧯 fix: Fail Closed When the Registry Cannot Answer Read image revisions through one script that tells a missing tag (or one this token may not read, and so may not write) apart from a registry that does not answer. The write-once check and the promotion now fail on the latter instead of treating it as a missing tag, so neither can rebuild over an existing tag or move main backwards. Restore the disk cleanup on the KVM runner leg, since the hosted runner only guarantees 14 GB free.
* feat: replace job-visible tool-call sockets with anonymous pipes * test: Observe Broker Cancellation Through TCP Peer * fix: Align Bun 1.4.2 and Verify Packaged Pipe Runtime * chore: Drop Node 20 Support * fix: Bound Pipe Failure Paths and Package Launcher Runtime
…#312) * fix: deny socketpairs with pipe-only Python runtime IPC * test: document and verify Bun socketpair spawn denial * fix: refresh mutable package-init images during runtime rollout * test: render runtime rollout chart without optional dependencies * fix: preserve offline package-init image policy
…-AI#311) * feat: Report Lane Git Branch And Head On Command Results The worker reads the checked-out branch and HEAD of the lane a command ran in and attaches them to execute_command results as laneGit. Code API validates the value and forwards it only when CODEAPI_BRIDGE_LANE_GIT is enabled and the worker advertised lane_git. * fix: Address Review Findings on Lane Git Reporting Compare a retried settlement with the stored one before replica-local lane Git sanitization, and skip the Git probe until lane_git is negotiated at registration. * fix: Bound Lane Git Probe and Pass Flag Through Compose Cap the post-command Git probe to the budget the command left, reserving settlement time, and pass CODEAPI_BRIDGE_LANE_GIT to the api and service-worker compose services. * fix: Harden Lane Git Probe Bounds and Reported Values Bound root resolution with the probe limit, enable the probe from the worker's active registration, require HEAD to peel to a commit, and reject Unicode control and format characters in branch names. * fix: Trust Only Probed Lane Git and Use the Worker Deadline Assign the lane Git worker on the normal startup path, budget the probe from the worker's assignment deadline, and drop any laneGit supplied by the command executor. * fix: Reuse Settlement Reads and Preserve Branch Whitespace Fold lane Git sanitization into the settle path's existing reads instead of a separate pre-pass, and strip only Git's trailing newline from probe output. * fix: Report Null for Non-UTF-8 Branch Names Read the lane branch as bytes and decode it strictly, so a ref name that is not valid UTF-8 is reported as null instead of a lossy copy. * fix: Revalidate Source Git Metadata Before Probing Probe a source or conversation checkout only while its .git is its own plain directory, so a command that rewrites .git to point at another repository cannot make the host-side probe report that repository's branch and head. * fix: Reject Linked Refs Before Probing Source Git Walk refs/ and require every entry to be a plain file or directory before the host-side probe runs, so a ref symlinked to another checkout cannot be followed. * fix: Guard Linked Lane Refs and Report Full Branch Names Check a linked lane's metadata HEAD and the shared refs before probing, read the branch from the full symbolic ref instead of --short, and avoid Dirent.parentPath so the refs walk works on Node 20.11. * fix: Stop the Git Refs Walk When the Probe Aborts Pass the probe signal into the source and linked worktree metadata checks and check it between directory operations, so an abandoned walk does not keep running after the command result is returned. * fix: Report Lane Git Only From a Stable Branch Read Read the branch before and after the head and omit laneGit when it changed in between, so a concurrent checkout cannot pair one branch with another branch's commit. * fix: Own Object Storage and Pin the Head Before Probing Require a link-free refs tree and object store with no alternates or reftable before the host-side probe, ignore replacement refs, and read the head from the branch ref the first read named. * fix: Disable Transports and Lazy Fetch in the Lane Git Probe Run the probe with no allowed protocols and lazy fetch disabled, so a rewritten .git/config cannot make a missing object trigger a fetch or a transport command on the host.
* 🧭 fix: Relay Loopback Resolvers Into KVM Guests The KVM launcher forwards the runner's /etc/resolv.conf into the libkrun guest. Under Docker Compose that names the embedded resolver 127.0.0.11, but the TSI guest kernel keeps loopback traffic on its own loopback device, so every service-name lookup in the guest failed. Generated-file uploads and session marker reads to egress_gateway were dropped with ConnectionRefused or FailedToOpenSocket, while connections by IP worked. When the runner has a loopback nameserver, relay it over UDP and TCP port 53 from the runner's own IPv4 address with socat and hand the guest that address instead. Further loopback nameservers are dropped, routable resolvers such as Kubernetes cluster DNS are forwarded unchanged, and startup fails if the relay cannot listen or the runner has no routable address. * 🧭 fix: Bound the Guest DNS Relay and Relay IPv6 Loopback Give both relays an idle timeout and cap concurrent TCP children. socat 1.8 fails every UDP-RECVFROM child given max-children, so the UDP relay relies on its short idle timeout. Treat a `::1` nameserver as loopback too, relaying it over IPv6 from the same runner address instead of forwarding an address the guest would only answer locally. * 🧭 fix: Recognize Every Loopback Resolver Spelling Classify nameservers as loopback by value rather than by the canonical `::1` string: zero-padded or compressed IPv6 loopback and IPv4-mapped 127.0.0.0/8 are relayed too, forwarding over IPv6 to the address exactly as written. Routable IPv6 resolvers stay untouched. * 🧭 fix: Parse Nameserver Addresses Before Loopback Detection Replace string matching with real parsing. IPv6 addresses are expanded to their eight groups (compressed zeros, dotted IPv4 tails), and IPv4 addresses are read in the inet_aton(3) forms glibc accepts in resolv.conf. Then ::1 and IPv4-mapped or plain 127.0.0.0/8 are relayed in any spelling. Mapped addresses are relayed over IPv4 to their canonical form. Spellings of the same resolver collapse into one relayed entry, and addresses glibc rejects are forwarded unchanged.
* Harden runner supervisors with anonymous pipes and inherited seccomp * Load hosted-app netfilter modules in native CI and retain diagnostics * Keep relay idle on buffered pipe EOF and assert owned descriptor cleanup * Preserve supervisor DNS resolution without descriptor-send syscalls
* 🧭 feat: Add Guided Worker Setup And Saved Profiles * 🔒 fix: Keep Pairing Codes Out Of Terminal History * 🔒 fix: Isolate Secret Prompt Editing State --------- Co-authored-by: Lia <lia@librechat.ai>
…at-AI#342) * 🪪 feat: Add Key-Bound Browser Enrollment And Resumable Setup * 🛡️ fix: Protect Setup State And Legacy Enrollment Fences * 🔐 fix: Remove Completed Setup Secrets And Bind Pending State To Identity * 🛡️ fix: Bind Setup Recovery State Across Startup Modes * 🗝️ fix: Protect The Entire Setup Journal Namespace --------- Co-authored-by: Lia <lia@librechat.ai>
* 📑 feat: Add Standalone File Extraction Service * fix: Restrict Worker Control and Preserve Nested Document Text * fix: Preserve Parser Policy Failures and Startup Restrictions * fix: Reject Unsupported DOCX Content and Validate OPC XML Parts * fix: Enforce Complete DOCX Content Structure * fix: Extract Merged DOCX Cells Once * fix: Reject Unmappable PDF Font Text * fix: Normalize Optional PDF Font Encodings --------- Co-authored-by: Lia <lia@librechat.ai>
* fix: Diagnose Unavailable Worker Commands Without Logging Payloads * fix: Preserve Diagnostic Correlation And Isolate Async Log Sinks * fix: Preserve Failure Diagnostics Across Cleanup And Log Boundaries
…-AI#352) * test: handle descendant adoption races in orphan cleanup * test: bound asynchronous pipe descriptor cleanup wait
* 📥 feat: Import Chat Uploads Into Attached Workspaces Add the additive `import_file` workspace operation so a chat's uploaded files, binaries included, land in an attached BYOM workspace. Code API verifies the caller owns the stored object with the download route's session rule, mints a one-object, read-only, short-lived egress grant, and relays opaque handles to the worker. The worker streams the object through its file relay upstream into a same-directory temporary file, enforces the declared size and SHA-256, refuses `.git` paths and symlinked parents, and installs it atomically as 0644. Identical bytes are an idempotent no-op; different bytes conflict unless `overwrite`. The operation is negotiated: Code API offers it only with an egress gateway, and workers advertise it only with writes enabled and a relay upstream configured. * 🛡️ fix: Harden Imports and Make Advertisement Opt-In - Verify size and SHA-256 on the synced staged file, not just the stream. - Set created parent directories to 0755 regardless of umask. - Install disconnect listeners before ownership and grant minting, and never dispatch for a caller that already left. - Authorize durable imports only for new request IDs so retries of an existing request stay idempotent after the upload expires. - Gate worker advertisement behind LIBRECHAT_CODE_ALLOW_WORKSPACE_IMPORTS, since older LibreChat releases reject unknown operations. * 🧹 fix: Tighten Import Cleanup, Stall Timing, and Durable Grants - Roll back a created parent only while it is still the inode the import created; otherwise report a possibly committed mutation. - Report an unremovable staging file as a possibly committed mutation. - Arm the stall timer only while waiting on the source, not during writes. - Revoke a durable import's grant when the queue does not adopt it. * 🔒 fix: Refuse NTFS Stream Aliases of .git in Import Paths Compare only the part of each segment before an NTFS stream separator, so `.git::$INDEX_ALLOCATION` and similar aliases are refused like `.git`. * ⚡ feat: Advertise Workspace Imports by Default With an Explicit Opt-Out The code bridge is experimental, so import_file is now on whenever a worker can perform it (writes enabled and a relay upstream configured). Operators opt out with LIBRECHAT_CODE_ALLOW_WORKSPACE_IMPORTS=false or --no-workspace-imports; any other value fails startup.
…AI#347) * 🔗 fix: Refresh Runtime Module Links After Upgrades * fix: Preserve Canonical User Module Links * test: Isolate Input-Cache Route Setup * fix: Complete Runtime Module Link Migration Paths * fix: Update Patched Node Runtimes And Align Rollout Defaults --------- Co-authored-by: Lia <lia@librechat.ai>
* fix(codeapi): pin proxy-addr to 2.0.8 (#4534) Source: ClickHouse/ai@4215c459945b0de73db0f99d6d86d8b470b96572 * ci(codeapi): mirror upstream node runtime versions Source: ClickHouse/ai@5f963906ee74d3247802b52ac2cdb8f85a9fcfda --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
…-AI#359) Co-authored-by: Lia <lia@librechat.ai>
…ibreChat-AI#360) A root registered by path alone (--worker-dir, --workspace, --environment) holds no descriptor, so write_file and import_file never created a missing parent there and reported NOT_FOUND. Yet the worker advertised import_file on every writable root, so LibreChat's first write of .librechat/attachments/.gitignore failed on such roots and no chat upload was ever copied. A write or import whose parent is missing now borrows a root descriptor for that one request and runs exactly as it does on a selected project root: mkdirat anchored to the held fd, root ancestry checked per level, rollback of directories an import created. A root the worker cannot hold by descriptor is no longer advertised import_file.
…at-AI#361) A pathname-only root replaced between its identity capture and its open is refused as INVALID_PATH instead of rerunning the mutation unanchored against the replacement.
…ore It Is Held (LibreChat-AI#364) Source: ClickHouse/ai@183de78d601012ae94f4887c06c06aee77c3bff3 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: danny-avila <110412045+danny-avila@users.noreply.github.com>
# Conflicts: # .github/workflows/ci.yml # api/Dockerfile # api/src/entrypoint.sh # docs/remote-bridge/README.md # docs/remote-bridge/projects.md # docs/remote-bridge/worker-runbook.md # packages/code/README.md # packages/code/src/cli.test.ts # packages/code/src/cli.ts # packages/code/src/environment.ts # packages/code/src/github.test.ts # packages/code/src/github.ts # packages/code/src/native-pool.test.ts # packages/code/src/native-pool.ts # packages/code/src/native-process.test.ts # packages/code/src/native-process.ts # packages/code/src/native-programmatic.test.ts # packages/code/src/native-programmatic.ts # packages/code/src/native-sandbox.test.ts # packages/code/src/native-sandbox.ts # packages/code/src/process-lock.test.ts # packages/code/src/process-lock.ts # packages/code/src/projects.ts # packages/code/src/protocol.test.ts # packages/code/src/protocol.ts # packages/code/src/root-access.ts # packages/code/src/worker-slots.test.ts # packages/code/src/worker.ts # packages/code/src/workspace-cli.test.ts # packages/code/src/workspace-instances.ts # packages/code/src/workspace-worker.test.ts # packages/code/src/workspace.ts # service/src/bridge/concurrent-store.test.ts # service/src/bridge/index.ts # service/src/bridge/router.test.ts # service/src/bridge/router.ts # service/src/bridge/store.ts # service/src/egress-gateway.ts # service/src/file-server.ts # service/src/job-cancellation.test.ts # service/src/job-cancellation.ts # service/src/minio-client.ts # service/src/preamble.test.ts # service/src/queue.ts # service/src/service/programmatic-router.ts # service/src/service/programmatic-state.ts # service/src/service/replay-state.ts # service/src/types/service.ts # service/src/workers.ts # service/src/workspace-tools/router.test.ts # service/src/workspace-tools/router.ts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Upstream range
58a023da4c47452f5e40114934679d0348c39064..2fa9f0d43e8e38b7d6240bc76e2483c6a47c64c7(13 upstream commits; upstream head taggedv1.10.13).Merge and conflicts
A fresh merge from
apro-deployproduced 51 conflicted files. Each was resolved by carrying forward the exact file from the prior sync merge,sync/2026-10-26; the resulting tree matches that previously resolved tree exactly (0ad0bec824f90cdb91c106a7e1222c313c92a7b2). This retains the existing APRÓ deploy customizations and their previous conflict resolutions..github/workflows/ci.yml— retained the prior sync resolution.api/Dockerfile— retained the prior sync resolution.api/src/entrypoint.sh— retained the prior sync resolution.docs/remote-bridge/README.md— retained the prior sync resolution.docs/remote-bridge/projects.md— retained the prior sync resolution.docs/remote-bridge/worker-runbook.md— retained the prior sync resolution.packages/code/README.md— retained the prior sync resolution.packages/code/src/cli.test.ts— retained the prior sync resolution.packages/code/src/cli.ts— retained the prior sync resolution.packages/code/src/environment.ts— retained the prior sync resolution.packages/code/src/github.test.ts— retained the prior sync resolution.packages/code/src/github.ts— retained the prior sync resolution.packages/code/src/native-pool.test.ts— retained the prior sync resolution.packages/code/src/native-pool.ts— retained the prior sync resolution.packages/code/src/native-process.test.ts— retained the prior sync resolution.packages/code/src/native-process.ts— retained the prior sync resolution.packages/code/src/native-programmatic.test.ts— retained the prior sync resolution.packages/code/src/native-programmatic.ts— retained the prior sync resolution.packages/code/src/native-sandbox.test.ts— retained the prior sync resolution.packages/code/src/native-sandbox.ts— retained the prior sync resolution.packages/code/src/process-lock.test.ts— retained the prior sync resolution.packages/code/src/process-lock.ts— retained the prior sync resolution.packages/code/src/projects.ts— retained the prior sync resolution.packages/code/src/protocol.test.ts— retained the prior sync resolution.packages/code/src/protocol.ts— retained the prior sync resolution.packages/code/src/root-access.ts— retained the prior sync resolution.packages/code/src/worker-slots.test.ts— retained the prior sync resolution.packages/code/src/worker.ts— retained the prior sync resolution.packages/code/src/workspace-cli.test.ts— retained the prior sync resolution.packages/code/src/workspace-instances.ts— retained the prior sync resolution.packages/code/src/workspace-worker.test.ts— retained the prior sync resolution.packages/code/src/workspace.ts— retained the prior sync resolution.service/src/bridge/concurrent-store.test.ts— retained the prior sync resolution.service/src/bridge/index.ts— retained the prior sync resolution.service/src/bridge/router.test.ts— retained the prior sync resolution.service/src/bridge/router.ts— retained the prior sync resolution.service/src/bridge/store.ts— retained the prior sync resolution.service/src/egress-gateway.ts— retained the prior sync resolution.service/src/file-server.ts— retained the prior sync resolution.service/src/job-cancellation.test.ts— retained the prior sync resolution.service/src/job-cancellation.ts— retained the prior sync resolution.service/src/minio-client.ts— retained the prior sync resolution.service/src/preamble.test.ts— retained the prior sync resolution.service/src/queue.ts— retained the prior sync resolution.service/src/service/programmatic-router.ts— retained the prior sync resolution.service/src/service/programmatic-state.ts— retained the prior sync resolution.service/src/service/replay-state.ts— retained the prior sync resolution.service/src/types/service.ts— retained the prior sync resolution.service/src/workers.ts— retained the prior sync resolution.service/src/workspace-tools/router.test.ts— retained the prior sync resolution.service/src/workspace-tools/router.ts— retained the prior sync resolution.Build and tests
packages/code:npm ci && npm test; TypeScript build passed. 1,022 tests: 992 passed, 4 failed, 26 skipped.edits.test.ts; trusted Git LFS filter restoration returned empty values innative-sandbox.test.ts; default workspace CLI test failed with ENOENT inworkspace-cli.test.ts.git diff --check origin/apro-deploy...HEADreports whitespace indocker/nsjail-anonymous-control.patch.npm cireported three high-severity audit findings.Needs a person
Review the four failing tests and confirm whether they reproduce in CI; review the patch-file whitespace report and npm audit findings; review the retained conflict resolutions listed above.