Merge pull request #22 from A3S-Lab/codex/work-office-core-6.3.0

feat(runtime): ship governed office execution in 6.3.0

Author: ZhiXiao-Lin

CHANGELOG.md

@@ -7,6 +7,29 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [6.3.0] - 2026-07-22
+
+### Added
+
+- Added typed model-generation concurrency and admission contracts so hosts can
+  declare and enforce bounded active generations without provider-name checks.
+- Added durable `MemoryObservation` and `MemoryObserver` extension points for
+  auditable preference, skill, and knowledge projections after persistence.
+- Added run-scoped permission and confirmation snapshots plus targeted
+  cancellation and expiry for pending tool approvals.
+
+### Changed
+
+- Serialized completed-turn memory extraction, drained accepted extractions at
+  session close, and preserved canonical duplicate-consolidation results for
+  observers.
+
+### Fixed
+
+- Kept LLM-authored learning titles, summaries, and instructions concise and
+  user-facing, and excluded internal orchestration or handoff procedures from
+  the learning signal contract.
+
 ## [6.2.0] - 2026-07-22
 
 ### Added
@@ -140,15 +163,84 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- Added the Search 2 native `anysearch` and `tavily` providers to the built-in
+  `web_search` engine catalog while preserving the existing default engine
+  selection for ordinary callers. Provider results retain normalized
+  publication dates and stable contributing-engine metadata in JSON output.
+- Added a typed model-generation concurrency contract and shared,
+  cancellation-safe admission gate for structured generation. Providers that
+  do not explicitly advertise safe parallel capacity default to
+  single-flight. `generate_object` starts its active deadline only after
+  admission, holds one permit across bounded schema-repair calls, and records
+  queue wait, capacity, and active timeout in result metadata. A Flow step
+  whose exact tool identity is `generate_object` acquires that same capacity
+  before entering the bounded `program` VM, and the nested call reuses the
+  one-shot identity-checked permit, so the VM deadline also excludes queue
+  wait without permitting a foreign-gate or concurrent-reuse bypass.
+- Added per-run snapshot hooks to `PermissionChecker` and
+  `ConfirmationProvider`. Agent invocations bind the frozen checker and
+  confirmation route into their tool context so delegated, parallel, Skill,
+  and background child runs keep their admitted authority across later
+  session-policy changes.
+- Added an extended `BashSandbox` request/result contract and an
+  `SrtBashSandbox` adapter with timeout, bounded streaming output, explicit
+  environment, network denial, workspace/scratch write limits, protected
+  control metadata, credential-read denial, and no unsandboxed fallback.
+  Verified constructors now accept an exact npm installation and an explicitly
+  selected Node executable so lifecycle-owning hosts do not rediscover either
+  process from `PATH`.
+- Added opt-in `LocalWorkspaceAccessPolicy::CredentialBoundary` enforcement
+  for local and manifest-backed workspace services. Direct file reads,
+  range reads, writes, and indexed or fallback grep now share the local
+  command sandbox's credential and source-hardlink boundary while preserving
+  ordinary package-store hardlinks. Guarded local Git diff first enumerates
+  NUL-delimited changed paths and regenerates output only for allowed files.
 - Delegation tools now publish a deterministic live catalog of visible worker
   names and purposes in both their descriptions and parameter schemas. Workers
   registered after session creation become model-discoverable on the next run;
   hidden or unregistered workers are omitted.
 - Tool implementations can override their complete model-facing definition
   when descriptions or schemas depend on live runtime state.
+- The Code TUI now projects A3S Use's built-in local PP-OCRv6 MCP and Skill
+  surfaces, reports its pinned model and ONNX Runtime status, and provides the
+  explicit `a3s install use/ocr` repair command.
+
+### Removed
+
+- Removed the unused `document_parser.ocr` backend configuration. OCR in Code
+  is owned exclusively by A3S Use and runs locally through PP-OCRv6.
 
 ### Fixed
 
+- Preferred the semantic HTML `<main>` element before falling back to `<body>`
+  in `web_fetch`, removing site navigation and footer chrome from ordinary
+  evidence pages while preserving the existing bounded conversion and SSRF
+  boundary. The oversized fetch test module now lives in its own concern file.
+- Decoded Anthropic and OpenAI-compatible SSE response bodies with one
+  incremental UTF-8 decoder per stream. Multibyte text split across arbitrary
+  network chunks now reaches event parsing intact instead of producing Unicode
+  replacement characters in streamed research and conversation output.
+- Made provider generation admission session-owned. Rebuilding an `AgentLoop`
+  for each concurrent host-direct tool call now reuses the same typed capacity
+  gate, so separate DynamicWorkflow calls cannot each manufacture an
+  independent single-flight slot.
+- Extended the local SRT credential boundary to existing `.env*` files at
+  every governed source-tree depth and read/write-masked pre-existing
+  multi-link source files, closing nested credential and hardlink-alias reads.
+- Closed the built-in workspace-tool path around the local command sandbox:
+  guarded `read`, `grep`, `write`, `edit`, and `patch` operations can no
+  longer expose or mutate protected credential files or source hardlink
+  aliases.
+- Hardened read-only Git output: diff targets cannot be interpreted as
+  options, guarded diffs omit sensitive and multi-link paths, and displayed
+  remote URLs remove embedded HTTP credentials, query strings, and fragments.
+- Auto-mode hosts can declare confirmation unavailable before Core emits a
+  confirmation event. Unexpected parent or tool-owned escalation therefore
+  fails closed instead of opening HITL or being automatically authorized.
+- Propagated the parent sandbox and confirmation boundary into delegated,
+  workflow, and Skill child runs. Child-local allow rules and automatic
+  confirmation can narrow execution but can no longer replace the host
+  boundary, and explicit Bash host escalation is now tool-declared.
 - Live MCP additions and removals now refresh task delegation, and natural
   language action tokens can select matching MCP tools without requiring the
   caller to know their underscored protocol names.
@@ -1482,43 +1574,15 @@ conflicts. They now `switch` / `match` on `error_kind.type` instead.
 
 - **HWPX Table Extraction**: Added structured table extraction from Korean HWPX documents. Parses `tbl/tr/tc` XML hierarchy and includes `structured_payload` for `tables[]` output.
 
-- **Vision OCR Provider**: New OCR backend supporting OpenAI-compatible vision APIs for document OCR fallback.
-
-  ```hcl
-  document_parser {
-    ocr {
-      enabled  = true
-      model    = "openai/gpt-4.1-mini"
-      api_key  = "sk-..."
-      base_url = "https://api.openai.com/v1"  # optional
-      prompt   = "Extract all text from this document..."
-      max_images = 8
-      dpi     = 144
-    }
-  }
-  ```
-
-  Provider priority: External provider > Vision API (if model+api_key configured) > Builtin tesseract
-
 #### Search Ranking
 
 - **Tabular Query Intent Detection**: Automatically detects when queries relate to tables (keywords: table, column, row, spreadsheet, excel, csv, cell, data, record, etc.) and boosts table line matches by +10 keyword hits plus 1.3x relevance multiplier.
 
 - **Heading Inheritance Boost**: When search matches appear under headings that also match the query, those matches receive a relevance boost (up to 1.3x). Looks backwards to find the closest preceding heading.
 
-### Changed
-
-#### Configuration
-
-- `DocumentOcrConfig` extended with new fields:
-  - `provider: Option<String>` - Backend selection ("vision" or "builtin")
-  - `base_url: Option<String>` - Custom API endpoint
-  - `api_key: Option<String>` - API authentication
-
 #### Dependencies
 
 - Added `calamine = "0.26"` for XLSB parsing
-- Added `reqwest/blocking` feature for Vision API HTTP calls
 
 ### Fixed
 

Cargo.lock

@@ -280,7 +280,7 @@ object-only backend that cannot execute it.
 | Workspace search | `glob`, `grep` | Bounded matching with explicit result metadata and continuation |
 | Code Intelligence | `code_symbols`, `code_navigation`, `code_diagnostics` | Saved-file semantic metadata and locations with bounded results; source retrieval and mutation stay in the existing file tools |
 | Commands and source control | `bash`, `git` | Bounded output, cancellation, process-group termination on Unix, and typed Git operations |
-| Web evidence | `web_search`, `web_fetch` | AnySearch by default, optional Tavily and conventional engines, normalized sources, SSRF protections, extraction, and bounded pages |
+| Web evidence | `web_search`, `web_fetch` | Ranked multi-engine search, including native AnySearch and Tavily providers, normalized sources, semantic `<main>` extraction with `<body>` fallback, SSRF protections, and bounded pages |
 | Structured output | `generate_object` | Schema-constrained model generation with validation and repair |
 | Composition | `batch`, `program` | Safe batch scheduling and sandboxed JavaScript programmatic tool calling |
 | Delegation | `task`, `parallel_task` | Foreground/background workers, bounded parallelism, partial results, and task tracking |
@@ -317,10 +317,10 @@ language/bootstrap injection variables. It keeps stdout and stderr distinct
 under one global capture limit. Its deadline covers output draining and the
 child's complete lifetime, including a process that closes both streams before
 it exits; timeout or cancellation terminates the Unix process group. It never
-searches `PATH` for a sandbox runtime and never falls back to the host runner
-when its explicitly provisioned runtime is missing or fails. The embedding host
-remains responsible for choosing whether an unavailable sandbox causes an
-interactive escalation or a deterministic denial.
+ searches `PATH` for a sandbox runtime and never falls back to the host runner
+ when its explicitly provisioned runtime is missing or fails. The embedding host
+ remains responsible for choosing whether an unavailable sandbox causes an
+ interactive escalation or a deterministic denial.
 
 Shell isolation does not automatically govern in-process workspace tools.
 Interactive hosts should construct `LocalWorkspaceBackend` or
@@ -427,7 +427,20 @@ Confirmation managers, hooks, budget guards, security providers, stream
 sanitization, retention limits, circuit breakers, duplicate-call guards, and
 no-progress detection compose around the same invocation path. Trusted direct
 host calls skip model-facing permission prompts, so an embedding application
-must authorize its callers.
+must authorize its callers. Only built-in control-plane orchestrators may carry
+that authority into host-selected nested calls. A public custom tool's
+`InvocationRuntime`, and every model sub-run created from a direct host context,
+produce ordinary governed invocations instead of inheriting ambient trust.
+
+Delegated tasks, workflow steps, and Skill child runs retain the parent sandbox
+and intersect their local permission policy with the parent checker. A
+child-local `Ask` follows that worker's `auto_approve`, `deny_on_ask`, or
+`inherit_parent` policy, while an `Ask` introduced by the parent remains under
+the parent confirmation provider. If both scopes ask, both remain effective and
+the same provider is de-duplicated. Tool-owned confirmation after both policies
+allow is also governed by the parent, so a child-local auto-approver cannot
+waive a host escalation boundary. Cancellation and timeout settle only the
+matching confirmation ID; unrelated concurrent prompts remain pending.
 
 ### Workspace backends
 
@@ -466,8 +479,15 @@ transcript data, not as a new source of executable instructions.
 The memory layer separates working, short-term, and durable long-term state.
 It supports relevance and recency scoring, typed memories, relations,
 successful and failed pattern capture, file or custom stores, optional pruning,
-and context injection. Significant completed turns can use the active model to
-extract a bounded set of durable memories; hosts can disable or tune extraction.
+and context injection. By default, every completed non-empty session turn is
+sent to the active model for a semantic value judgment; the model returns an
+empty set when nothing is reusable. Automatic extraction writes only validated
+semantic or procedural memories and never mechanically persists tool results or
+turn history. Streaming turns register extraction before publishing their final
+event, run through a FIFO background queue, and graceful session close drains
+already-accepted work for a bounded period. Stored extractor metadata records
+source, confidence, scope, reason, workspace, session, and schema version.
+Hosts can disable extraction or tune its input and output bounds.
 
 ### Models and MCP
 
@@ -477,6 +497,26 @@ reasoning, tool calls, usage, images, retries, cancellation, and streaming where
 the provider supports them. Structured generation uses native response formats
 when available and a schema-validated prompt fallback otherwise.
 
+Anthropic and OpenAI-compatible SSE transports decode UTF-8 incrementally
+across raw network chunks before splitting events. A multibyte character may
+therefore cross any transport boundary without being replaced or corrupting the
+event payload.
+
+`LlmClient::model_generation_concurrency` is the typed admission contract for
+structured model transactions. The default is conservative single-flight;
+providers may explicitly report a larger finite bound.
+Each `AgentSession` owns one cancellation-safe gate and reuses it across
+conversation loops, host-direct calls, and rebuilt direct-tool runtimes.
+`generate_object` waits on that gate before starting its active deadline,
+retains the permit through schema repairs, and reports the queue wait
+separately in metadata. `DynamicWorkflowRuntime` recognizes the exact
+`generate_object` Flow step identity and acquires the same capacity before
+starting its bounded `program` VM. The nested generation reuses that one-shot
+identity-checked permit, so neither the generation deadline nor the Program
+deadline includes admission queue time, parallel nested calls cannot reuse one
+reservation, and concurrent host-direct workflows cannot create independent
+provider gates.
+
 If an established response stream closes before its final response, Core
 restarts the same LLM turn with the same message snapshot up to ten times. The
 delay grows exponentially from one second and is capped at thirty seconds, with
@@ -490,7 +530,11 @@ MCP connections support stdio, HTTP SSE, streamable HTTP, and OAuth client
 credentials. Global managers can seed new sessions and refresh cached tools;
 session managers can connect, disconnect, and live-add or remove isolated
 servers. Tools remain source qualified so separate servers do not silently
-share ownership.
+share ownership. A local stdio server leads a dedicated Unix process group.
+Transport close or drop stops its pipe tasks, fails pending requests, reaps the
+direct child, and terminates descendants; stderr is drained independently so a
+diagnostic-heavy server cannot block the protocol pipe. This lifecycle
+containment does not make the configured server an untrusted sandbox.
 
 Hosts can add or replace a Skill in a running session with
 `AgentSession::add_skill`, inspect the effective names with `skill_names`, and

README.md

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-code-core"
-version = "6.2.0"
+version = "6.3.0"
 edition = "2021"
 authors = ["A3S Lab Team"]
 license = "MIT"

core/Cargo.toml

@@ -54,7 +54,6 @@ mod tool_completion_runtime;
 mod tool_execution_runtime;
 mod tool_guard_runtime;
 mod tool_invoker;
-mod tool_memory_runtime;
 mod tool_result_runtime;
 mod tool_turn;
 mod turn_context;
@@ -82,6 +81,13 @@ pub(crate) struct AgentConfig {
     pub permission_policy: Option<PermissionPolicy>,
     /// Optional confirmation manager for HITL (Human-in-the-Loop)
     pub confirmation_manager: Option<Arc<dyn ConfirmationProvider>>,
+    /// Child-local resolution policy for `Ask` decisions.
+    ///
+    /// This marker remains separate from `confirmation_manager` because both
+    /// `deny_on_ask` and `inherit_parent` intentionally start without a
+    /// child-local provider and must be distinguished when the parent boundary
+    /// is composed into a delegated run.
+    pub confirmation_inheritance: Option<crate::subagent::ConfirmationInheritance>,
     /// Serializable confirmation policy used to build the manager, when available.
     pub confirmation_policy: Option<crate::hitl::ConfirmationPolicy>,
     /// Serializable queue configuration used to build the optional command queue.
@@ -192,6 +198,7 @@ impl std::fmt::Debug for AgentConfig {
             .field("permission_checker", &self.permission_checker.is_some())
             .field("permission_policy", &self.permission_policy.is_some())
             .field("confirmation_manager", &self.confirmation_manager.is_some())
+            .field("confirmation_inheritance", &self.confirmation_inheritance)
             .field("confirmation_policy", &self.confirmation_policy.is_some())
             .field("queue_config", &self.queue_config.is_some())
             .field("context_providers", &self.context_providers.len())
@@ -241,6 +248,7 @@ impl Default for AgentConfig {
             permission_checker: None,
             permission_policy: None,
             confirmation_manager: None,
+            confirmation_inheritance: None,
             confirmation_policy: None,
             queue_config: None,
             context_providers: Vec::new(),
@@ -823,6 +831,7 @@ impl SessionCommand for ToolCommand {
 #[derive(Clone)]
 pub(crate) struct AgentLoop {
     llm_client: Arc<dyn LlmClient>,
+    model_generation_admission: crate::llm::ModelGenerationAdmission,
     tool_executor: Arc<ToolExecutor>,
     tool_context: ToolContext,
     config: AgentConfig,