Repository navigation
feat: sync and release minimax Code 0.7.2 - #566
Merged
Merged
Conversation
… requests Add the requestMedia config block, per-endpoint request body budgets, a request image guard, drop-older-images recovery after 413/too-many-images rejections, unified tool image encoding, image-free compaction summaries, and a 64 MiB stdio MCP message limit.
…ia MCODE_BROWSER_USE_SWIFTSHADER
…d the stream idle timeout Read, attachment and browser screenshot images are encoded once to the requestMedia.image limits with a single size note; dimension and nested 413 rejections recover on the first failure; the LLM stream idle bound defaults to 60 minutes for gateways that hold the response.
permission.nativeDelete (default false) routes new Bash deletes through the shell own delete commands instead of the trash: the rm shim is not seeded, the deletion guidance drops recoverable-delete rules for the turn, the Windows execution plan keeps the approved targets and PATH policy, and dynamic targets still need approval. Protected paths stay blocked.
…king The cut-off response is discarded, the request is retried with a hint to reason more briefly up to three times, and a dedicated message is shown when it still does not finish.
…t user A user message carrying a backgroundTaskOrigin host metadata is internal, so reminders are placed after it instead of before it.
An image that cannot be decoded is replaced by a note with its type and size in tool results, and by its file path for attachments, so one bad image no longer fails every later request.
…argets The recoverable-delete rewrite only swaps the executable, so quoting, globs, variables and redirections survive; rm -f no longer stops on missing paths, directory deletion still needs -r, and real failures keep a nonzero status.
…ceipts Terminal Tasks now carry a notification state read from the Turn ingress receipt ledger and the Task row, so the [build-mode] status line counts finished background tasks and sub-agents until their results reach the agent.
run_script drives the current tab for page checks single actions cannot express: held keys, modifier plus mouse input, timed or repeated input, and loops that read page state before deciding where to click. Held keys and buttons are released when a script finishes, fails, times out or is cancelled, and the result carries the return value, logs, the failing line and screenshots. Available only in the TUI headless browser.
…ummaries The checkpoint request can reuse the session's prompt-cache prefix, so compaction is faster and cheaper; a provider that rejects the shared shape falls back to the standalone request. A gateway that reports an oversized request inside a 200 stream now goes straight to compaction recovery, and a checkpoint that hits the same rejection switches to a smaller candidate.
…ckpoint Keep the copy-ready commands, request shapes and failed approaches that the conversation shows, inside Critical Context & Relevant Files, so they are not retried after a compaction. Derive the section list from the prompt itself so the protocol cannot drift between the validator and the delivered prompt.
Tell the checkpoint that later history wins over earlier history, keep only still-actionable asks under Pending User Asks (newest last), and move answered, superseded or withdrawn asks to Completed Work or Key Decisions. Append a host note that marks the verified recent-query list as evidence to check against the sections instead of the current request.
A before-LLM hook that appends a hidden context marker no longer ends the decision pipeline, so the reminders registered after it still run and every marker is committed once, in registration order, with a single history flush. The placement-owned current-user tail records how many markers precede it, so compaction commit metadata still validates against the real message count. A durable replaceMessages after a registered append aborts the request.
Read Plugin agents from both the MiniMax and the compatible package formats, freeze the trusted definition on the Turn capability lease, and pass it to the Task host so `task` can delegate to `<plugin>:<agent>` without an Agent row. Bind the agent's MCP selectors and render its profile at capture time, expose the roster as a system reminder only when the Turn can call `task`, and show the agent count in the plugin list.
Map ACP image content blocks to PNG, JPEG, WebP and GIF attachments, reject unsupported types with a clear message, and replay stored image attachments when a session is loaded again so the transcript keeps its images. Also clear the waiting-for-user turn marker as soon as a later assistant message produces output, so a queued questionnaire answer is consumed instead of leaving the turn stuck on a stale marker.
…s stopped Add `conversation.stopSubAgent` and `conversation.stopAsyncBash` so stopping the main conversation stops the background subagents and background bash it started according to configuration. Fix the target boundary at the stopped Turn's release instead of reading it after the abort returns, so a next Turn admitted in between is neither stopped nor suppressed, and project an AbortError raised by a pre-delivery hook as an aborted Turn rather than a Session error.
…ion by default `conversation.stopSubAgent` now defaults to on: stopping a main conversation is taken as "I am done with this conversation", so the background subagents it started stop with it instead of finishing later and waking the conversation back up with a completion notification. Set the switch to `false` to opt out.
…stent Stop losing transcript entries when history is refreshed after an edit, stop repeating the same warning on every redraw, and report a clipboard read failure with a stable error code plus a stage/reason diagnostic, so the private cause never reaches the transcript or the observability record.
…nswer alive Register the plan review fallback reporter so a written plan always reaches the review entry even when lifecycle reconciliation fails, and resolve a questionnaire's owned-action handler at use time for every long-lived facade instead of only the TUI, so a reply sent before startup reconciliation reaches the workflow that owns it. Clip a long held-rows hint to the pane width so a narrow terminal no longer fails the differential redraw guard and stops the TUI.
Plan Review now displays the plan file path and binds Ctrl+O to a full-plan view while an interaction is active, leaving Ctrl+O as the details toggle otherwise. Closing the full view preserves the selected action and the feedback draft.
…ation layer Move the cascade orchestration out of the compatibility package so the stop path no longer depends on the v1 background-task module layout, and keep the behaviour unchanged: the switches still decide what a stop tears down and the delivery suppression window still closes when the cascade completes.
…ser PATH Skip PATH integration when the data directory lives under the system scratch directory or belongs to a development profile, so a temporary or per-branch dataDir no longer persists a doomed `bin` into the user's shell rc or `HKCU\Environment`. Write the export with a portable `$HOME`-relative path and recognise an equivalent existing entry, and build paths with explicit platform semantics so Windows drives and POSIX separators are handled correctly.
… begin contract `userStop.begin` returns its handle synchronously so the delivery window is open before the abort, and the handle now carries `markBoundary`. Update the harness and the two overriding cases accordingly, and add the small plugin package tree helper the new plugin-agent package tests write their fixtures with.
…egistry Keep the existing capability gate order so the registry diff shows only the newly registered test files.
Press d on a custom connection in /provider to delete it. The confirmation page accepts only y; any other key, including Enter, cancels. Deleting removes the saved API key and every model of that connection, and the list refreshes after a successful delete.
…resh Login gates now read the account without membership, so a submission no longer waits on up to four serial quota requests once the cache expires. The status line keeps the quota already shown for the same signed-in Token Plan account until the membership refresh replaces it.
…on labels The option schema now tells the model to set the machine-readable `recommended` field instead of writing (Recommended) into the label, which duplicated the recommendation badge.
…s a model service error A Messages stream that saw message_start and message_stop but never a non-empty stop_reason now throws instead of ending as a normal finish, so the turn surfaces a model service error (50113) and keeps the content received so far. The classifier skips its numeric heuristics for that wording, so the event counts and timings in the diagnostics are not misread as rate limiting, credits, or a timeout.
…rwriting The macOS branch now drives one JXA script instead of an Apple Event: the native trash mode goes through CoreServices and only falls back to FileManager when the framework or symbol is unavailable, so the per-file Finder sound is gone and a permission failure is no longer retried through another backend. Inside the sandbox the item is moved with an exclusive rename, which refuses an existing name and retries with a UUID suffix, so a same-named file is never overwritten and the source is kept when the move fails.
… at startup Startup now reloads every built-in Agent source to the bundled content of the current version, keeping only its model group, and archives a damaged file beside it as .agent.md.corrupted.<sha256>.raw before rewriting it from the template. A source that disappears while the runtime runs is reseeded from the same template on use, so a built-in Agent can still reply; a file that stays unreadable stops the Turn with a copyable repair instruction instead of a generic config error.
A Turn whose lease is held by another live Runtime is no longer steerable, queueable, or stoppable from this process: the active-run snapshot marks it as running elsewhere, the composer keeps the draft instead of sending or queuing, rewind and edit are refused, and an explicit stop reports that the other process owns the Turn instead of pausing a Goal it never reached. Leaving the Session stays a no-op. The Session refreshes when the other process finishes.
…not be saved A terminal settlement that still fails after its retry left the in-process Turn owner registered, so a stop timed out and every later send or rewind of the Session failed until the Runtime restarted. The owner is now released (and the product Turn abandoned instead of settled) unless discarded steering of that Turn is still unpersisted, the failure is logged, and the next admission recovers the pending settlement inside its own transaction and applies the same Queue pause. A rejected Host run also projects its failure once more while it still holds the durable lock.
Whether PTC applies is now fixed by the mode stored on the Session (set at creation and after a compaction) instead of a per-request flag, so the prompt prefix of a Session no longer changes between Turns and prompt caching stays stable. Subagents, including Explore, follow their own Session mode. The per-request PTC admission module, the queue ptcEligible propagation and the surface/role gate on the prompt section are gone; a prefix fingerprint is recorded per Turn for observability.
…g fails A rejected counter endpoint no longer re-probes on every LLM call. Failure state is scoped to the adapter, model, endpoint and credentials (hashed), so a missing or unimplemented endpoint and rejected credentials stop probing immediately, a repeated validation rejection stops that configuration, and transient network or server failures back off up to 30 minutes and resume on their own without a restart. Calibration probes without tools first, so an unavailable counter no longer uploads the much larger tool definitions.
A Turn can outlive one OAuth access token. The Matrix client now reads the host auth per request instead of the Turn-start snapshot, and with a live getter plus an invalidator a 401 asks the host to recover the rejected token and retries once with the refreshed one. An explicit MATRIX_TOKEN, a missing getter or invalidator, or a token the host did not refresh still returns the original 401.
…lugin tools The agent.md tool selectors now follow one rule for built-in, custom and plugin agents: a tool whose name starts with mcp__ is filtered by mcpServers, every other tool by tools, and disallowedTools removes any tool. A native-scope tools list no longer limits MCP or Plugin tools, the canonical Explore/Verifier MCP ceiling is gone, and a built-in web_search is owned by its own Feature instead of the allowlist. A Task capability snapshot bounds internal tools and Skills only.
…ool calls when reading a Session A tool call made from inside a run_code program skips the model-visible output caps: the program gets the whole result in output and data instead of a file receipt, bounded by 8 MiB per Bash output or text read and by the 16 MiB PTC bridge per result. Top-level calls keep every cap unchanged. Reading a Session now returns message text in full with one summary per tool call (name, status, parent call, args preview, result size); args, results and thinking are opt-in and each cut to max_output_chars.
… the BYOK contracts
hetaoBackend
added
enhancement
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Replace backtracking regexes over untrusted input with linear scans (trailing-char trims, tagged-block removal, stack-frame parsing, selector error detection), anchor the Vertex AI host match, derive the token-counter credential fingerprint with scrypt instead of a fast hash, and escape code-breaking characters in the generated PTC tool setup.
run_code resolves quickjs-worker.js beside the bundled caller, and the worker's release-sync QuickJS variant loads emscripten-module.wasm beside itself. Neither was emitted by scripts/build.mjs, so every run_code call from the built CLI failed with worker_error. Add the worker as a build entry, copy the wasm, and cover both with an artifact test.
…erges Parse the user-provided-context block and its requested-change comments with index scans instead of lazy regexes, and skip __proto__/constructor/ prototype keys when merging request patches and local config updates.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Change
Brings the reviewed shared-source changes for the 0.7.2 line into this repository and releases them as 0.7.2 (root
package.jsonandpackages/tui/package.json). Every commit was applied file by file onto the public projection with a three-way merge that keeps the standalone adaptations; no upstream history was merged or cherry-picked.User-visible highlights, grouped as in the changelog:
run_codelets the Agent combineread,grep,bashand other calls in one sandboxed program and bring back only the filtered results. Off by default, enabled under Preferences in/settings(beta.ptc) or per process withmcode --ptc/mcode exec --ptc. It applies to new Sessions and the next compaction, is decided only by the Session's tool-call mode so the prompt prefix stops changing between turns, and keeps permissions, approvals and cancellation behaving as they do for direct calls.Tabfills it in. Configurable under Preferences and withpromptSuggestion.enabled.run_scriptfor page checks single actions cannot express, available in the TUI headless browser.Ctrl+O.*.app.json), official Marketplace plugins can declare subagents, the plugin MCP tool-count limit is gone, and more than 64 MCP tools load on demand throughtool_search.requestMediainconfig.yamlis the single image resize for tool results and attachments, images stay within per-request count and byte budgets, and an oversized request drops older images and resends once with the newest image kept.permission.nativeDeleteopts into the shell's native delete commands,rmmoved to the trash keeps-fand ignores redirects, unresolvable targets go through normal approval, and the root/home recursive-delete guard no longer trips on heredoc bodies.PATH, macOS Trash stops playing the Finder sound per file, and direct connections stay on HTTP/1.1 somcode execcannot hang on Node 26.stop_reason),web_search401 in long turns, a Session stuck running after a failed settlement, undecodable images poisoning later requests,mcode initproject resolution,edit replace_allon BOM/CRLF files, built-in agent config restored to factory content, cross-process Sessions becoming read-only,/providerconnection deletion,/statusaccount name and quota countdown, and more.packages/tui/CHANGELOG.mdcarries the full list.docs/tui-capabilities.mdgains sections for Programmatic Tool Calling, prompt suggestions, local delete and the request media budget; the capability target moves to 0.7.2 indocs/tui-capabilities.md,docs/open-source-status.md,docs/verification.mdanddocs/release-audit.md.One new dependency:
quickjs-emscripten@0.31.0(pinned), the JS engine for therun_codesandbox. Its MIT notices are recorded inpackages/tui/THIRD_PARTY_NOTICES.mdandrelease/dependency-licenses.json.Validation
pnpm verifyfull profile at the reviewed commit with a clean tracked tree):check:sourcePASS,check:tsconfigPASS,export source previewPASS,test:release-toolsPASS,lint:tuiPASS,typecheckPASS,buildPASS,check:standalonePASS,test:artifactPASS,typecheck:code-sdkPASS,test:code-sdkPASS,test:status-contractPASS,test:smokePASS,test:byokPASS,test:policyPASS,test:sandboxPASS.test:capabilities: 6494 passed, 17 skipped, 1 failed. The single failure ispackages/tui/test/unit/update-runtime.test.ts"heals receipts pinned to a Homebrew Cellar keg": the fixture copies the local Homebrewnodebinary into a temp directory and dyld cannot findlibnode.147.dylib. It reproduces identically on unmodifiedmain(50448ab) in a clean worktree on this machine, so it is environmental and not introduced here.test:windowsandtest:release-packageare platform/archive SKIPs.perf:fullapplies — this touches history construction, session storage, streaming and the tool execution loop. Theperformancecheck withSuite: fullfor this head has not run yet; it will be linked here once it does.CI / follow-up fixes on this branch
Three commits after the original sync cleared the red CodeQL check and a packaging gap that
pnpm verifyalone cannot catch (the capability suite injects aworkerFactory, so a missing dist worker stays green):fa26aa2— CodeQL high alerts introduced by the sync: replace backtracking regexes over untrusted input with linear scans, anchor the Vertex AI host match, derive the remote token-counter credential fingerprint with scrypt instead of a fast hash of the secret, and escape code-breaking characters in the generated PTC tool-setup script.eebc459— PTC packaging.scripts/build.mjsdid not emitdist/quickjs-worker.jsor copyemscripten-module.wasmbeside it. Everyrun_codecall from the built CLI failed withworker_error(Cannot find module '.../dist/quickjs-worker.js', thenENOENT .../emscripten-module.wasm). The worker is now a build entry, the release-sync wasm is copied next to it, andtest/public-artifact.test.mjsstarts the built worker through a real tool call. Local live check:mcode exec --ptcagainst MiniMax-M3.1-Flash-Preview failed/timeout before the fix and completed correctly after.0bd2c5a— remaining CodeQL highs in prompt-suggestion context cleaning (tagged-block / requested-change parsing via index scans) plus__proto__/constructor/prototypeguards on request-patch and local-config merges.Post-fix
pnpm verify(Node 24.22.2): all steps PASS, includingtest:capabilities6493 passed / 19 skipped. GitHub checks on0bd2c5a: CodeQL, verify (ubuntu/macOS/Windows), install matrix, build, performance, verification — all success. One pre-existing medium CodeQL alert onmain(js/stack-trace-exposureviajson()inhost-helpers.ts) is tracked separately and not in this PR.Publication and contribution checks
release/public-source.json; new tests are declared intest/vitest-suites.jsonwhere applicable.Maintainer handoff
Publication scope or license changes: none beyond the added
quickjs-emscriptendependency, whose MIT notices are recorded.Shared-source port: pending for a few capabilities that have no landing site in this projection and are deliberately not faked here: Goal request/time limits and
/goal edit(they need the Goal service layout this projection does not ship), the asynchronous-question queue (needs the questionnaire service), the Windowsagent-shellsubsystem, the long-session memory-peak optimization (needs the observability wiring), and the Git Bash interpreter-heredoc path check (this projection never parses heredoc bodies as shell).mcode appand Computer Use stay out of scope: they depend on packages outside the published roots.release/extraction.jsonkeeps its recordedsourceRevision, as for earlier bounded ports.Need help on this PR? Tag
@codesmith-botwith what you need.