[pull] main from HKUDS:main - #24

Windows consoles default to GBK/cp936, so rich rendering or model output
that emits non-GBK text crashes with UnicodeEncodeError. Reconfigure stdio
to UTF-8 before the parser/Console are set up.

No behavior change on UTF-8-locale systems (the reconfigure is a no-op
there); copied verbatim from the working tree (e1e00cc5, cli hunk only).

hooks.json / .claude settings.json are written as UTF-8 JSON, but
Path.read_text() defaults to the locale encoding, so on a GBK/cp936 Windows
console a config containing non-GBK bytes is mis-decoded (or raises) before
parsing. Read explicitly as UTF-8; no behavior change on UTF-8 locales.

#128)

Both execute_commands and execute_single_command in command_executor.py
now run screen_command() before delegating to the sandbox, matching the
existing pattern in code_implementation_server.py.

This closes the gap identified in #128 where command_executor had no
pre-execution screening at all. The blocklist itself is not the security
boundary (the sandbox is), but it now catches obviously destructive
commands consistently across both MCP tools.

Changes:
- Import screen_command from core.harness.command_guard
- Add blocked_reason check in execute_commands loop
- Add blocked_reason check at top of execute_single_command

Signed-off-by: raymondginger2018-sudo <[email protected]>

The screen_command denial path in execute_single_command wrapped the text= f-string across two source lines. A short-quoted string cannot contain a literal newline, so the module did not parse at all: ruff reported six invalid-syntax errors, ruff format could not parse the file, and the 3.12/3.13/3.14 test jobs died during collection.

Escape the newline instead - same rendering, mirrors how the batch path reports the reason - and keep the trailing comma so the exploded call stays ruff-format stable.

Verified with the CI-pinned ruff 0.15.21: ruff check and ruff format --check both clean, py_compile OK, and execute_single_command("rm -rf /") returns the two-line block message.

`import deepcode` must bind to `deepcode.py` (setup.py declares
`py_modules=["deepcode"]` and the `deepcode=deepcode:main` console script), but the
repository root also carried a tracked `__init__.py`, making the checkout directory a
package of the same name. pytest's default prepend import mode resolves the package
root by walking up while `__init__.py` exists (`tests/__init__.py` -> repo root), and
then inserts that root into `sys.path`; with the repo checked out into a directory
literally named `deepcode` (as on this machine) the earlier `sys.path` entry wins and
`import deepcode` yields the directory package instead of `deepcode.py`:

    AttributeError: module 'deepcode' has no attribute 'main'

That broke 6 tests locally (tests/test_cli_logging_bootstrap.py, 5 cases;
tests/test_version_metadata.py, 1 case) and would break any source checkout on a
case-insensitive filesystem whose directory name matches the module. Upstream CI is
unaffected only by accident: it checks out `DeepCode`, which does not match the
module name on a case-sensitive filesystem.

Delete the root `__init__.py` and the matching `include __init__.py` from
MANIFEST.in (pre-commit's check-manifest keeps the two in sync). Nothing imports the
root package and the sdist no longer ships a file that turns the unpacked checkout
into a shadowing package.

Verified: tests/test_cli_logging_bootstrap.py + tests/test_version_metadata.py ->
7 passed (6 failed before); `python -c "import deepcode"` resolves to deepcode.py.

`Database._harden_files` repaired the ACL of every database file on every
connect, read and transaction. On Windows that is three `icacls` spawns per
file, so a single test-suite run created tens of thousands of processes.
Under that much process-creation pressure `_winapi.CreateProcess` was
observed to block for minutes -- and it is not covered by
`subprocess.run`'s own `timeout`, which only starts counting once the child
exists -- so the caller could hang indefinitely. On 2026-09-13 that is what
left the suite producing no output until morning.

Two changes, both fail-safe:

* `_harden_files` repairs each database file at most once per process. New
  `-wal`/`-shm` siblings are created inside the already restricted
  directory and inherit its ACL, which is the same "restrict at creation,
  not per open" rule `ensure_private_directory()` already follows and
  `tests/test_private_storage_acl_once.py` pins.

* `_run_icacls` now runs the spawn on a daemon worker thread that the
  module is willing to abandon after `_ICACLS_TIMEOUT_SECONDS + 5`, so a
  stuck creation degrades to "ACLs left as they are" -- the fail-safe the
  rest of the module already promises -- instead of wedging the caller.

`[tool.pytest.ini_options]` gains `faulthandler_exit_on_timeout = true` so
a future stall stops the run with thread stacks rather than hanging.

`cli/tui/text.py` renders workspace paths with `as_posix()`, so a path
reads the same on Windows as it does in the transcript examples and in what
the user types (`tools/foo.py`).

The lint-and-format CI job runs ruff-format with the version pinned in
.pre-commit-config.yaml (astral-sh/ruff-pre-commit v0.15.21). Two lines in
tests/test_private_storage_acl_once.py exceeded the 88-column budget:

* the signature of test_icacls_is_abandoned_when_the_spawn_itself_blocks
* the ps._run_icacls("trusted-icacls.exe", ..., "/grant:r", "u:F") call

ruff check did not flag them because E501 is not in its default select set,
so the formatter was never run locally. Formatting with the pinned version
reproduces the CI diff byte for byte; the change is line-wrapping only
(8 passed before and after).

…ntry point

Removes the tracked root __init__.py and drops it from MANIFEST.in so a checkout
named 'deepcode' on a case-insensitive filesystem no longer shadows deepcode.py.
Contributed by raymondginger2018-sudo.

…ase open

Hardens each database file at most once per process, bounds the icacls spawn end
to end on a daemon worker, enables faulthandler_exit_on_timeout for the test
suite and renders TUI workspace paths with as_posix().
Contributed by raymondginger2018-sudo.

Headless 'deepcode loop' reconfigures stdio to UTF-8 early and hooks config is
read as UTF-8 regardless of the console code page.
Contributed by raymondginger2018-sudo.

Applies the existing destructive-command screen to the legacy command executor
before native or sandboxed execution (refs #128).
Contributed by raymondginger2018-sudo.

Adds a bounded VS Code theme import (single local JSON/JSONC file, mapped onto
the existing appearance tokens) with settings UI, i18n and tests (closes the
contract discussed in #152). Repair: pin the new jsonc-parser lockfile entry to
registry.npmjs.org.
Contributed by lihuiyang1024.

Registers Amazon Bedrock as a region-scoped OpenAI-compatible provider template
(AWS_BEARER_TOKEN_BEDROCK, user-supplied /openai/v1 base URL), seeds the exact
Claude Sonnet 4.6 inference IDs in the offline catalog and documents setup.
Repair: re-place the Bedrock section in docs/guide/models.md after the
connection-test example that changed on main.
Contributed by lihuiyang1024.

# Conflicts:
#	docs/guide/models.md

cargo audit flagged rustls 0.23.42 for accepting TLS 1.3 handshake messages
across encryption level boundaries. Update the Tauri lockfile to the fixed
release (rustls-webpki follows to 0.103.15); no source changes.

- Security CI: the dependency and license audit consults live advisory
  databases, so it now runs weekly and on demand only and opens or updates
  the issue 'Dependency audit failed on main' on failure. Secret scanning
  and PR dependency review keep running on every push and PR.
- Desktop CI: the four platform bundles build weekly and on demand; pushes
  and PRs run the quality gates only.
- Python CI: pushes to main run the suite on 3.13; pull requests and manual
  runs keep the full 3.12-3.14 matrix.
- ci_scope: top-level Markdown, docs/, assets/, website/ and issue templates
  no longer trigger runtime suites.
- docs/CI.md describes the new cadence.