* fix(ai-vault): close OpenCode handles when query_only setup fails
Keep #16587's 1500ms local / 0ms WSL timeout. A pragma failure after
open no longer leaks the handle or hides the setup error.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(ai-vault): isolate handle cleanup from usage timeout policy
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: m4air <m4air@Mac.localdomain>
* fix(runtime): GC expired proven-absent leaf PTY verdicts
Sweep TTL-expired provenAbsentLeafPtyVerdicts on consult and insert so
dead leaf ids do not retain Map entries for the process lifetime.
Preserves the 15s no-reprobe cache for still-fresh verdicts.
Fixes#12660
* fix(runtime): reclaim expired leaf PTY verdicts with bounded sweep frequency
---------
Co-authored-by: m4air <m4air@Mac.localdomain>
* fix(claude-accounts): stop path resolution from creating the config directory
getRuntimePaths() created ~/.claude as a side effect of resolving paths, so
the deferred usage refresh materialized it even when Claude was disabled and
no session had ever run. Writers already create the directory themselves
(writeJson, writeRuntimeCredentials, the metadata dir), and the keychain
helpers only use configDir as a service name, so resolution can stay pure.
Fixes#12181
* test(claude-accounts): cover background auth preparation
* test(claude-accounts): prove path reads skip mkdir and writes recreate directories
* Preserve Claude keychain aliases for missing config directories
* fix: avoid ambiguous missing-path keychain aliases
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
Co-authored-by: m4air <m4air@Mac.localdomain>
* fix(browser): move cookie scoping off psl's stale suffix list
psl@1.15.0 is its latest release and ships a Dec-2024 snapshot of the
public suffix list. Measured against the current upstream list, it fails
to recognise 600 of 10,030 suffixes; tldts misses 2.
That gap is a cookie-isolation bug. psl does not know `api.br` is a
suffix, so it falls back to the `br` rule and maps foo.api.br, bar.api.br
and example.api.br all onto the single family `api.br`. Unrelated
registrants then share a removal scope, and a replace-mode import for one
clears the others' cookies. The same holds for seg.ar, co.az, gov.cz and
~597 more.
tldts is called with allowPrivateDomains, without which the PSL's PRIVATE
section is ignored and every *.github.io / *.s3.amazonaws.com / *.vercel.app
tenant collapses into one family — 21 of 49 probed hosts changed family
under the default. The new test pins that boundary.
One deliberate behaviour change: hosts under `.local` (not in the PSL)
were their own family under psl, which returned an all-null parse for
them; they now resolve to the two-label boundary (app.orca.local ->
orca.local), matching what Chromium treats as the registrable domain.
* fix(build): bundle tldts into the main process like psl was
psl sat in BUNDLED_MAIN_DEPENDENCIES, so it was inlined into the main
bundle rather than externalized and copied into resources/node_modules.
Swapping the dependency without moving that entry left a bare tldts
import that afterPack's runtime-closure check rejects.
* fix(build): point the output contract at tldts and drop the psl shim
The contract test still asserted psl was in BUNDLED_MAIN_DEPENDENCIES, so
it failed once the entry became tldts. src/types/psl.ts declared a module
that no longer resolves; tldts ships its own types.
* test(browser): pin the suffix boundaries the tldts swap moved
Three semantic changes shipped untested:
- `.local` is unlisted, and the libraries disagreed on what that means. psl
returned an all-null parse so every `*.orca.local` host was its own family;
tldts stops at `orca.local`. The consequence is wider than the family name —
importDomainAncestors now yields the shared parent, so a replace-mode import
of one host clears non-host-only cookies every sibling shares.
- psl's snapshot had `compute.amazonaws.com` as a literal PRIVATE suffix; the
current list only carries the wildcard, so the bare host is ICANN now.
- The renderer's `psl.isValid` gate had no direct test at all — nothing imported
the module from a test.
Also drops comments that explained a boundary in terms of psl's internals. One
was wrong under tldts: bracketed IPv6 does not reach an error branch, it parses
with the brackets stripped and falls through the unlisted path.
OrcaWinandOrca Worker
Neil
Wooseong Kimandm4air
