feat(*): read, write and deliver files on a registered machine by address

[Handsome-wzw]

Summary

Third of four changes that let a Raven dispatch work to the machines in
its machine registry. #920 is merged; this branch is opened against main
ahead of #921, so the diff here includes #921's commits as well: review
from "read, write and deliver files on a registered machine by address"
on (the commits before it are #921's, carried here until it merges).

What this does:

• The file tools take a path on a registered machine as it is written
  for scp -- user@host:/path, or scp://user@host:port//path when the
  port is not 22 -- and answer it through the machine's daemon
  (raven/agent/tools/remote_files.py, hooked from filesystem.py and
  file_search.py): read_file, list_dir, find and grep run
  Raven's own tools there and bring back the answer, so a read of fifty
  lines of a large file moves those fifty lines; write_file and
  edit_file write there, with the digest of that agent's own last read
  -- the conversation's, or its sub-agent run's -- as the expected
  state, so a file changed since it read it is refused and nothing is
  written, and another agent's read does not stand in for its own. The
  path is resolved against the registry
  only, never this computer's ssh config, so one path names one machine
  on any computer; one that matches no row is refused, not guessed.
• What is shown back as an address is only what the tool says about
  paths -- its errors, its headers and footers, a write's account, a
  diff's two header lines; a read's numbered lines, a search's matches
  and context, and a diff's body come back as they are, so the model
  edits against the bytes the file holds. The shell's refusal of typed
  ssh to a registered machine (raven/agent/tools/shell.py,
  machine_exec.py) reads the program in any spelling -- a path, a
  backslash, and on a Windows host ssh.exe, SSH.EXE or a whole
  C:\...\ssh.exe, with the backslashes the shell there keeps and
  without the quotes it takes off (a quoted piece and a bare one next to
  it making one word), so a quoted destination or port is matched like a
  bare one -- and, with the lane on, names the file tools. scp, sftp
  and rsync to a registered machine stay what they are on main: a copy
  starts nothing there and passes exec's own question like any command,
  and the file tools cannot carry a directory, a binary file or a large
  one, so the copy stays the route for those. A drive-relative or
  extended Windows path (C:file, \\?\C:\..., UNC) is this
  computer's, not a machine nobody registered.
• Permissions (raven/permissions/): a path inside the directories
  Raven's agents work in on that machine -- its session directory, its
  remoteCwd, the row's listed paths -- is read without asking;
  elsewhere a read asks once per machine and directory for the session.
  A write there asks wherever it falls, as a write here does, and its
  grant is for the one file, apart from any read. The daemon checks the
  roots again on the machine, links included.
• deliver_files fetches one file by its address, whole and checked,
  under a 20 MB cap, into <workspace>/pulled/<machine>/<key>/<name>,
  the key a digest of the file's path on the machine, so two paths never
  share a landing: not two files of one name from two directories, and
  not two names this computer's filesystem reads as one (Report.txt
  and report.txt, a trailing dot). The name beside the key is written
  as one this computer keeps (a backslash, what Windows reserves in a
  name, control characters and the percent sign itself as
  percent-codes), and a landing that would not resolve under the
  machine's delivery directory is refused before anything is made; a
  bigger file is named with its size and read there instead. Only a file under the directories this Raven's agents work in
  on that machine is fetched: the tool asks nothing, and a read some
  conversation was allowed is no evidence for this one, so a file
  elsewhere is refused and read there instead. Nothing reclaims
  pulled/: a delivery is opened from its landing for as long as its
  record lasts, and a bound by size or age is left out of this change on
  purpose.

Type

• Fix
• Feature
• Docs
• CI / tooling
• Refactor
• Other

Verification

• uv run pytest tests/test_remote_file_tools.py tests/test_permissions_remote_read.py tests/test_deliver_files_tool.py tests/test_shell_machine_channel.py tests/test_ops_remote_path.py tests/test_permissions_gate.py tests/test_import_cycle_budget.py tests/test_node_server.py tests/test_node_client.py tests/test_subagent_acp_remote.py tests/test_acp_remote.py tests/test_cli_ops_connection_commands.py
  -- all passed on this tree (703 in the run that covered the first
  eight groups, the node's own suite and the real-node cases among them).
  Covered: each tool on a remote path answers as its local tool would,
  through a stood-in link and a real daemon; a path outside the roots is
  refused on both sides; a write with a stale digest is refused and
  writes nothing; the address form on what the tool says about paths,
  and a read's lines, a grep's matches and a diff's body untouched; the
  shell's refusal of typed ssh to a registered machine, by host, by
  alias, in a pipeline, as ssh.exe and SSH.EXE, and with a whole
  Windows path or a quoted destination or port when the host is Windows,
  a copy with scp, sftp or rsync not refused, and the file tools named
  only with the lane on; a fetched name holding the
  other platform's separators lands as one name under the machine's
  directory and nothing lands elsewhere, and a landing that would
  resolve outside fetches nothing; a Windows path form read here with the lane on; the read
  permission inside the roots and the question elsewhere, remembered per
  machine and directory, a write asked wherever it falls and its grant
  kept per file and apart from a read; a read's digest kept per agent,
  so another agent's read lets no stale overwrite through and an agent
  that never read the file expects nothing; a delivery fetched whole
  under a key of its path (two files of one name, two names a
  filesystem reads as one, and the percent-code pair all land apart),
  refused over the cap and refused outside the roots whatever was read
  before.

• uv run pytest on this tree after the merge with main -- 31210 passed,
  231 skipped, 2 xfailed, 4 failed, every one of the four in a test that
  needs what this machine lacks (test_rpc_files.py, the two simulation
  cases and the kimi-code case that fail the same way on main here); the
  groups above also pass under --idle-ceiling-strict, CI's idle ceiling.

• Diff coverage of this change against main after the merge: 95.27% (805 of
  845 executable changed lines), against the 90% gate. The node suite,
  the remote-path tests and the real-node cases among the groups above run
  on the merged tree.

• Real machines (two registered Linux machines): fifty lines from the
  middle of a 5 MB file read through the daemon in 30 to 35 ms, byte for
  byte what this computer reads; list, find and grep answered; a write
  and an edit landed as the local tools would, and a write after the file
  changed was refused; a path outside the roots refused; a file written
  by an agent there fetched back by address. The shell's refusals are
  covered by the tests above.

• scripts/check_source_language.py, scripts/check_commit_messages.py
  and scripts/check_large_files.py on the branch range, commitlint,
  ruff -- all clean.

• Relevant tests pass locally

• Relevant lint / type checks pass locally

• User-facing docs or screenshots are updated when needed

User docs follow once the lane is no longer debug-only.

Risk

Behind the debug lane, as the two changes before it. With it on, a remote
path reaches the machine only through its daemon, inside the roots each
call names and under the read and write questions above; the shell cannot
run a command on a registered machine by address, and a copy to or from it
with scp, sftp or rsync is the plain shell's behind exec's own question, as
on main. A write refused for a stale
digest writes nothing. A delivery fetches at most 20 MB per file into the
workspace, and only from the directories the agents work in on the
machine. Rollback is a plain revert.

• Security impact considered
• Backward compatibility considered
• Rollback path is clear for risky changes

Related Issues

#920 (merged); depends on #921.

[gloryfromca]

Blocking: remote file reads and deliveries need to preserve content and permission isolation, and node installation must comply with the repository's uv-only rule.

I found four blocking issues, marked inline.

Review coverage: I read the full github/main...HEAD diff, AGENTS.md/CLAUDE.md, CONTEXT-MAP.md and the Runtime/UI context files; inspected the stacked commit history, surrounding callers, remote-node lifecycle, permission flow, delivery store, RPC/schema changes, and compatibility behavior with the debug lane disabled. I also checked that tests were added rather than weakened and reviewed the declared package-layer constraint.

Verification:

• uv run pytest tests/test_node_bundle.py tests/test_node_client.py tests/test_node_install.py tests/test_node_relay.py tests/test_node_server.py tests/test_ops_remote_path.py tests/test_remote_file_tools.py tests/test_permissions_remote_read.py tests/test_deliver_files_tool.py tests/test_cli_ops_connection_commands.py tests/test_acp_client_teardown.py tests/test_acp_remote.py tests/test_rpc_subagents.py tests/test_shell_machine_channel.py tests/test_subagent_acp.py tests/test_subagent_acp_remote.py tests/test_subagent_probe.py tests/test_ops_connection_add.py tests/test_ops_transport.py tests/test_raven_config_tool.py -x - 1,338 passed, 4 skipped (csh/tcsh unavailable).
• uv run pytest tests/test_import_cycle_budget.py tests/test_rpc_schema_match.py tests/test_rpc_import_sync.py tests/test_config_schema.py -x - 495 passed.
• scripts/check_large_files.py, scripts/check_source_language.py, and scripts/check_commit_messages.py via uv run --frozen --extra dev - passed.

The first test attempt stopped in the autouse fixture because the fresh environment lacked the declared everos-memory dev extra; after uv sync --frozen --extra dev --dev, the same suite passed as reported above.

[LivXue]

Windows compatibility review: two additional findings in the file-tool layer, plus the shared Windows node-launch failure.

Scope: complete 69-file PR diff at f67f806ed950469b47d72d2175ffd4be59fd0dca, API base 82c76a82a9a7d312ef6cd75e560404bccd81d292, merge base 829eb28e1db877dffdd3df4f835d707e1f049d3a, including source, callers, tests and surrounding platform guards. Inspected isolated exact-SHA source archives; all changed-file blob hashes and all patch addition/deletion counts matched GitHub.

1. P2 - Recognize Windows executable names in the copy refusal. Reproduced with execution intercepted. machine_exec.py:370 compares a POSIX basename literally against scp/sftp/rsync. For the same registered destination, scp -P 58717 ... is refused by ExecTool, but scp.exe, SCP.EXE and C:\Windows\System32\OpenSSH\scp.exe all reach its executor. Once an exec call is admitted, these normal Windows spellings bypass the new file-tool budget/read checks. Normalize the local executable with Windows path, case and suffix rules, and parse it consistently with the executing shell. No copy or network connection was performed.

2. P2 - Keep drive-relative and extended Windows paths local. Reproduced against the base. remote_path.py:330 only excludes the simple C:/ or C:\ drive forms. With RAVEN_DEBUG_MACHINES=1, the new read_file dispatch rejects both C:review_marker.txt and \\?\C:\...\review_marker.txt as unknown remote machines. Both read the actual scratch file on the exact API base, and on this head with the lane disabled; an ordinary absolute drive path works in every case. Recognize native Windows drive-relative and extended path forms before SCP detection, and cover them through the public file tools.

3. P2 - Shared node SSH argv failure, reproduced here. remote.py:188 is identical to feat(*): a Raven daemon on a registered machine, reached over one watched ssh link #920: the real node command becomes 12 Windows arguments instead of one, preventing the file tools from opening their link. Apply the shared correction described in #920's Windows review. The identical POSIX-only test imports/teardown fixtures also retain feat(*): a Raven daemon on a registered machine, reached over one watched ssh link #920's measured Windows collection and SIGKILL failures (code inspection here).

Native Windows / Python 3.13.12, PYTHONUTF8=1, UV_NO_SYNC=1, isolated user/Raven/temp directories. A pre-synced uv environment supplied the unchanged locked dependencies; imports were asserted to come from each inspected snapshot. Commands ran from the named snapshot root.

uv run python 'C:\Users\livxu\AppData\Local\Temp\raven-windows-review\5f9cc24f22014021985a6c637edc57e3\probe_windows.py' copy 'C:\Users\livxu\AppData\Local\Temp\raven-windows-review\5f9cc24f22014021985a6c637edc57e3\pr922\copy-workspace'
# scp refused; all three Windows .exe spellings reached the intercepted executor
uv run python 'C:\Users\livxu\AppData\Local\Temp\raven-windows-review\5f9cc24f22014021985a6c637edc57e3\probe_windows.py' paths 'C:\Users\livxu\AppData\Local\Temp\raven-windows-review\5f9cc24f22014021985a6c637edc57e3\pr922\paths-workspace'
# lane on: drive-relative and extended paths refused; ordinary absolute path read
uv run python 'C:\Users\livxu\AppData\Local\Temp\raven-windows-review\5f9cc24f22014021985a6c637edc57e3\probe_windows.py' node-ssh
# 12 remote-command arguments instead of 1
uv run pytest 'tests/test_remote_file_tools.py' 'tests/test_permissions_remote_read.py' -n 0 -x --tb=short --basetemp 'C:\Users\livxu\AppData\Local\Temp\raven-windows-review\5f9cc24f22014021985a6c637edc57e3\pr922\file-tests-pytest'
# 38 passed, 3 skipped (POSIX-shell fixtures)
uv run pytest 'tests/test_deliver_files_tool.py' -k 'machine or budget or what_was_not_delivered' -n 0 -x --tb=short --basetemp 'C:\Users\livxu\AppData\Local\Temp\raven-windows-review\5f9cc24f22014021985a6c637edc57e3\pr922\delivery-tests-pytest'
# 3 passed, 23 deselected
uv run pytest 'tests/test_shell_machine_channel.py' -k 'copy or typed_ssh' -n 0 -x --tb=short --basetemp 'C:\Users\livxu\AppData\Local\Temp\raven-windows-review\5f9cc24f22014021985a6c637edc57e3\pr922\shell-tests-pytest'
# 29 passed, 94 deselected

Exact base control, from its snapshot root:

uv run python 'C:\Users\livxu\AppData\Local\Temp\raven-windows-review\5f9cc24f22014021985a6c637edc57e3\probe_windows.py' paths 'C:\Users\livxu\AppData\Local\Temp\raven-windows-review\5f9cc24f22014021985a6c637edc57e3\base\paths-workspace'
# all three path forms read the scratch file, with the lane both on and off

No live SSH/remote filesystem, real transfer, remote install or full suite was exercised. The existing content-rewriting, filename-collision, cross-session approval and installer findings remain separate.

[Handsome-wzw]

All three are in the commits now on this branch. The copy and ssh refusals read the program with the directory, the case and a .exe/.cmd/.bat suffix taken off, and on a Windows host the words are read with their backslashes kept, as the shell there reads them, so scp.exe, SCP.EXE and a whole C:\...\scp.exe are refused like scp (tests, with the host stood in as Windows for the whole-path spellings). A drive-relative path (C:file, on a Windows host) and an extended or UNC path (\\?\C:\..., \\server\share) are this computer's, through read_file with the lane on (test). The ssh argv fix is in the #920 commit this branch carries.

[gloryfromca]

No blockers; this can merge as far as I am concerned.

Reviewed the complete github/main...HEAD change and the final two-file delta at 3b790620c54a. I covered AGENTS.md/CLAUDE.md and CONTEXT-MAP/CONTEXT rules, the diff, direct callers and history, backward compatibility, test-strength changes, and the enforced layer architecture. I also traced the remote-file authorization, path fencing/presentation, collision handling, SSH argv, node socket/record ownership, protocol framing, and Windows path/copy boundaries.

The four earlier blockers are fixed: content is no longer rewritten, fetched paths are collision-free, delivery does not reuse another sessions read evidence, and installation is uv-only. The Windows executable/path/SSH-argv follow-ups are also covered by the final code and regression tests. I found no new blocker or plain error.

Verification:

• uv run --frozen --python 3.12 --all-extras pytest -q: 29,208 passed, 132 skipped, 1 failed. The sole failure is the pre-existing untouched tests/test_cli_theme.py::test_bold_accent_renders_styled_not_bare ANSI/theme assertion; neither that test, theme code, Rich dependency, nor lockfile changes in this PR.
• uv run pytest tests/test_node_server.py -q: 90 passed.
• uv run --frozen --python 3.12 --all-extras ty check raven evolver agents plugins-dist scripts: passed.
• uv run --frozen --python 3.12 lint-imports: 10 contracts kept, 0 broken.
• scripts/check_source_language.py github/main..HEAD: passed.

[LivXue]

Windows compatibility re-review: two runtime regressions reproduced, including a write outside the workspace, plus the shared path-test failure.

Scope: all 71 changed files at 3b790620c54a4828b1067cc957e961668e2591c7; API base 82c76a82a9a7d312ef6cd75e560404bccd81d292, merge base 829eb28e1db877dffdd3df4f835d707e1f049d3a. Rechecked the complete PR scope and revision delta, using blob identity for unchanged previously reviewed files and tracing the affected callers.

1. P1 - Keep fetched remote filenames inside the local delivery directory. Reproduced through deliver_files. deliver.py:100 now appends Path(place).relative_to("/") to the local destination. On a Linux machine, backslashes are legal filename characters; the POSIX root check therefore accepts a filename containing backslash-separated .. text beneath /root/raven-work/. Windows Path reinterprets those characters as separators and parent traversal. With a stubbed node returning five bytes, the real public tool wrote and registered review_escape.txt in the parent of its workspace. All writes were confined to an owned temporary directory. Parse the remote name as POSIX, encode components that are unsafe on Windows, and verify the resolved destination remains under the intended pulled root before creating directories or writing bytes. The prior reviewed head's basename mapping kept the identical input inside its workspace; this regression comes from the new whole-path mapping.

2. P2 - Decode quoted destination and option tokens before matching the registered machine. Reproduced with execution intercepted. machine_exec.py:209 and line 384 use shlex(..., posix=False), which retains the quotes. Only the executable name is unquoted. Thus ssh -p 58717 "root@203.0.113.7" true matches a host with a trailing quote, and scp -P "58717" a.txt root@203.0.113.7:/tmp/a falls back to port 22 because the quoted port fails isdigit(). Four quoted ssh/scp/sftp variants reached the intercepted executor, while their unquoted controls were refused. Normalize all relevant argv tokens consistently with the executing Windows shell before host/port matching. Both quoted and unquoted SSH were refused on the exact API base; all four variants were also refused on the previous reviewed head.

3. P2 - Update the shared a:b.txt test expectation. Reproduced. test_ops_remote_path.py:101 expects an unknown-machine error for what the corrected Windows parser treats as a local drive-relative path. Use a multi-character unknown host or a platform-specific expectation, as in the shared feat(*): a Raven daemon on a registered machine, reached over one watched ssh link #920 finding.

Native Windows / Python 3.13.12. Git fetching failed; the isolated fixed-SHA snapshots were reconstructed and every blob plus the complete Git tree was verified. A fresh environment was created with uv sync --frozen --python 3.13 --extra dev after the first environment-reuse attempt failed before tests ran. Tests used isolated user/Raven/temp/registry paths, PYTHONUTF8=1, UV_NO_SYNC=1, UV_PYTHON=3.13, and UV_PROJECT_ENVIRONMENT=$R/venv; PYTHONPATH selected the tested snapshot and plugin roots, with the loaded source asserted. $R = 'C:/Users/livxu/AppData/Local/Temp/raven-windows-review/2d5904b4d92f4f238e9db27e2ade2ddf'.

uv run pytest tests/test_remote_file_tools.py tests/test_permissions_remote_read.py tests/test_deliver_files_tool.py -n 0 -x --tb=short --basetemp "$R/checks/922-final-files/pytest" --junitxml "$R/checks/922-final-files/junit.xml"
# 70 passed, 3 POSIX-shell skips.
uv run pytest C:/Users/livxu/AppData/Local/Temp/raven-windows-review/2d5904b4d92f4f238e9db27e2ade2ddf/test_windows_resolved_paths.py -s tests/test_acp_client_launch.py tests/test_acp_client_teardown.py -n 0 -x --tb=short --basetemp "$R/checks/922-final-native/pytest" --junitxml "$R/checks/922-final-native/junit.xml"
# 9 passed: one SSH command argument, real local path reads, five executable spellings refused, ACP argv/teardown.
uv run pytest tests/test_ops_remote_path.py -k path_that_names_no_registered_machine -n 0 -x --tb=short --basetemp "$R/checks/922-final-path/pytest" --junitxml "$R/checks/922-final-path/junit.xml"
# 11 passed, 1 failed (a:b.txt), 79 deselected.
uv run pytest C:/Users/livxu/AppData/Local/Temp/raven-windows-review/2d5904b4d92f4f238e9db27e2ade2ddf/test_windows_review_probes.py -k 'not exact_base' -s -n 0 -x --tb=short --basetemp "$R/checks/922-final-probes/pytest" --junitxml "$R/checks/922-final-probes/junit.xml"
# 2 probes passed by confirming the two defects above; 1 base-only case deselected.
# Prior reviewed head f67f806ed950469b47d72d2175ffd4be59fd0dca, imports repinned there:
# REVIEW_EXPECT_DEFECT=0
uv run pytest C:/Users/livxu/AppData/Local/Temp/raven-windows-review/2d5904b4d92f4f238e9db27e2ade2ddf/test_windows_review_probes.py -s -n 0 -x --tb=short --basetemp "$R/checks/922-prior-controls/pytest" --junitxml "$R/checks/922-prior-controls/junit.xml"
# 2 controls passed: no quoted-command bypass and no file outside the workspace.
# Exact API base 82c76a82a9a7d312ef6cd75e560404bccd81d292, imports repinned there:
uv run pytest C:/Users/livxu/AppData/Local/Temp/raven-windows-review/2d5904b4d92f4f238e9db27e2ade2ddf/test_base_windows_ssh.py -s -n 0 -x --tb=short --basetemp "$R/checks/922-base-ssh-checked/pytest" --junitxml "$R/checks/922-base-ssh-checked/junit.xml"
# 1 passed: quoted and unquoted SSH both refused.

The API base has no remote-delivery implementation. The file-transfer probe uses a stub node pool with real local filesystem writes; the command probe replaces execution entirely. No remote connection or transfer occurred. A shell-suite run on the preceding head also stopped after 7 passes at a quoted rsync-option assertion; its parser is unchanged in the final two-file POSIX daemon delta. An initial base-probe collection attempt imported a module absent from that base; the standalone base control above corrected the probe.

The previously reported bare .exe spellings, drive/extended-path misclassification and node argv splitting passed their focused rechecks. No live daemon/agent/installer, full suite, or Windows ACL/junction stress was run.

[gloryfromca]

Blocking: Windows remote delivery can escape the pulled directory, and quoted Windows SSH/copy arguments bypass registered-machine enforcement.

The new Windows reproduction changes my standing clean verdict on this unchanged revision. I independently confirmed the reported mechanisms without performing a connection or transfer:

• A remote POSIX filename may legally contain backslashes and repeated .. text. Path(place).relative_to("/") reparses those characters with Windows semantics, and enough such components normalize the destination beyond <workspace>/pulled/<machine> before pull_file creates and replaces the local file.
• With the Windows parser branch enabled, ssh -p 58717 "root@203.0.113.7" true produces host 203.0.113.7", while scp -P "58717" ... falls back to port 22. Both therefore evade a registry match that their ordinary quoted Windows command lines should trigger.
• The a:b.txt expectation is consequently platform-inconsistent after drive-relative paths were made local on Windows.

uv run pytest tests/test_deliver_files_tool.py tests/test_shell_machine_channel.py tests/test_ops_remote_path.py -q still passes on Linux (256 passed), which does not exercise or refute these Windows paths. The Windows findings in comment 6130778655 remain outstanding and need correction before merge.

[Handsome-wzw]

All three are on the branch now (a010ad8 for the two runtime ones, 7b3757c for the test).

1. The landing place of a fetched file is built from the path's POSIX components, each written as one name on this computer -- a backslash, what Windows reserves in a name (<>:"|?*) and control characters become their percent-codes, . and .. too -- and the resolved landing is checked to lie under pulled/<machine>/ before any directory is made or byte written; one that would not is refused in a sentence (_local_name, _landing in deliver.py; tests: a name holding ..\..\..\ lands as one name under the machine's directory with nothing elsewhere, and a landing that resolves outside fetches nothing).
2. On a Windows host every word of the command loses the quotes that shell takes off -- a pair around it, or double quotes inside it -- before the host and port are matched (_words, _unquoted in machine_exec.py), so "root@host", -P "58717", -p"58717" and a quoted rsync -e are read like their bare forms (tests with the host stood in as Windows: all refused, nothing run; the words checked directly).
3. The colon-in-a-name case names a two-letter host (ab:b.txt), which reads as a machine's on every host.

[gloryfromca]

No blockers; this can merge as far as I am concerned.

Confirmed at a010ad8d2e2e: fetched remote paths are now decomposed as POSIX paths, encoded component-by-component, and containment-checked before any filesystem mutation; quoted Windows SSH/SCP/SFTP/rsync arguments are normalized before registered-machine enforcement; and the corrected drive-relative test uses an actually ambiguous Windows spelling. The focused regressions pass.

[gloryfromca]

No blockers; this can merge as far as I am concerned.

Reviewed the exact 3b790620c54a...a010ad8d2e2e delta, the affected delivery and command-parsing callers, commit history, backward compatibility, and the regression changes. I also rechecked the repository rules, runtime terminology, import architecture, and that tests were strengthened rather than weakened. The prior Windows path-escape and quoted-command bypass mechanisms are closed.

Verification: uv run pytest tests/test_deliver_files_tool.py tests/test_shell_machine_channel.py tests/test_ops_remote_path.py -q (264 passed); targeted ty checks passed; all 10 import contracts were kept; source-language and git diff --check checks passed. All review threads I opened remain resolved.

[LivXue]

Windows compatibility re-review: the original traversal and whole-word quoting reproductions now pass; two boundary cases remain.

Scope: the complete 71-file PR at a010ad8d2e2e6ce3a899844ab89884058b14388b, API base 82c76a82a9a7d312ef6cd75e560404bccd81d292, merge base 829eb28e1db877dffdd3df4f835d707e1f049d3a. All 4,379 snapshot blobs matched the head tree. Rechecked the five-file revision delta, callers, full PR scope and existing discussions, retaining blob-identity evidence for unchanged previously reviewed files.

1. P2 - Make the local filename encoding collision-free. Reproduced. _local_name, deliver.py:134 encodes a backslash as %5C but leaves literal percent signs unchanged. The distinct POSIX files /root/raven-work/a\b.txt and /root/raven-work/a%5Cb.txt therefore land at the same Windows path. Calling the real deliver_files with both paths, with only the remote pool replaced, performed two writes and returned one delivery containing the second file's bytes; the first registration retained the first file's size. The identical probe on predecessor 3b790620c54a4828b1067cc957e961668e2591c7 returned two files with their correct bytes. This encoding regression is new in this revision and extends the earlier collision discussion with a different trigger. Escape the escape character too, or use a collision-resistant key derived from the remote path, while retaining the containment check.

2. P2 - Preserve adjacent quoted/unquoted segments when tokenizing Windows commands. Reproduced. _words, machine_exec.py:124 still uses shlex(posix=False), which splits "root@"203.0.113.7 into two words and "587"17 into two words. Removing quotes afterward cannot restore their boundaries. Both ssh -p 58717 "root@"203.0.113.7 true and ssh -p "587"17 root@203.0.113.7 true reached an intercepted executor despite that host/port being registered. A harmless argv-printing child launched through native cmd.exe received -p 58717 root@203.0.113.7 true in both cases; the exact API-base ExecTool refused both. Use Windows tokenization that preserves adjacent segments and backslashes, and test against native argv. This is new evidence for the earlier quoting finding; its original whole-word quoted variants are now correctly refused.

Native Windows / Python 3.13.12, isolated user/Raven/temp directories, run-owned uv environment, UV_NO_SYNC=1, PYTHONUTF8=1; imports checked against each snapshot. Exact commands from the current head:

$R = 'C:\Users\livxu\AppData\Local\Temp\raven-windows-review\abf44f96254d43bc81b1be33079fb26b'
uv run pytest tests/test_deliver_files_tool.py -n 0 -x --tb=short --basetemp "$R\checks\922-delivery\pytest" --junitxml "$R\checks\922-delivery\junit.xml"
# 29 passed.
uv run pytest tests/test_ops_remote_path.py -n 0 -x --tb=short --basetemp "$R\checks\922-paths\pytest" --junitxml "$R\checks\922-paths\junit.xml"
# 91 passed.
uv run pytest tests/test_shell_machine_channel.py -k 'windows or words' -n 0 -x --tb=short --basetemp "$R\checks\922-shell\pytest" --junitxml "$R\checks\922-shell\junit.xml"
# 18 passed, 126 deselected.
uv run pytest "$R\test_windows_previous_findings.py" -k 'not exact_base' -s -n 0 -x --tb=short --basetemp "$R\checks\922-fixes\pytest" --junitxml "$R\checks\922-fixes\junit.xml"
# 2 passed, 1 deselected: original quoting controls and traversal probe.
uv run pytest "$R\test_windows_new_findings.py" -k collision -s -n 0 -x --tb=short --basetemp "$R\checks\922-collisions\pytest" --junitxml "$R\checks\922-collisions\junit.xml"
# 1 failed: expected two preserved artifacts, got one with overwritten bytes.
uv run pytest "$R\test_windows_new_findings.py" -k quote -s -n 0 -x --tb=short --basetemp "$R\checks\922-quotes\pytest" --junitxml "$R\checks\922-quotes\junit.xml"
# 1 failed: both variants reached the intercepted executor.

Controls, with imports switched and checked against the named isolated snapshot:

# Predecessor 3b790620c54a4828b1067cc957e961668e2591c7:
uv run pytest "$R\test_windows_new_findings.py" -k collision -s -n 0 -x --tb=short --basetemp "$R\checks\922-prior-collision\pytest" --junitxml "$R\checks\922-prior-collision\junit.xml"
# 1 passed: two distinct deliveries with correct bytes.
# API base 82c76a82a9a7d312ef6cd75e560404bccd81d292:
uv run pytest "$R\test_base_quoted_host.py" -s -n 0 -x --tb=short --basetemp "$R\checks\922-base-quotes\pytest" --junitxml "$R\checks\922-base-quotes\junit.xml"
# 1 passed: both SSH variants refused before execution.

The two new probes intentionally assert the required behavior and fail at this head. All writes stayed inside the probe workspace; no SSH connection or remote transfer occurred. The shared node-client test race is tracked on #920 and its blobs are unchanged here. Live SSH/daemon/install operation and the full suite were not exercised.

[gloryfromca]

No blockers; suggestions only, and they are marked inline.

I independently reproduced both boundary cases at a010ad8d2e2e: _local_name maps a\\b.txt and a%5Cb.txt to the same local name, while Windows tokenization splits adjacent quoted/unquoted host or port segments and therefore derives no destination or the wrong destination.

These are valid follow-ups, so my previous clean stance becomes nonblocking. At this late review round neither reaches the blocker bar: the collision requires two specially paired POSIX filenames on a cross-platform delivery, and the command bypass requires deliberately segmenting a single host or port across quote boundaries; ordinary filenames and the normal bare or whole-word-quoted command forms work. The focused repository suite still passes: 264 passed.

[Handsome-wzw]

Both are on the branch now (598cc8d). A percent sign in a fetched name is written out as %25 too, so a\b.txt and a%5Cb.txt land as two files (test). On a Windows host the words are read with POSIX quoting and only the backslash kept as a path's own, so "root@"host and "587"17 are one word each, as that shell's argv has them (_words checked against those forms, and the ExecTool refusing both commands with the host stood in as Windows). The reconnect test race is fixed in 418923f on #920 and carried here.

[gloryfromca]

No blockers; this can merge as far as I am concerned.

Confirmed at 2e9f7dd1105d: percent signs are now encoded before local landing, so the two reported remote names remain distinct; adjacent quoted and bare Windows command segments now form the host and port that the registered-machine guard checks; and the reconnect assertion remains scoped to the new client while tolerating a following heartbeat. The focused suite passes.

[gloryfromca]

No blockers; suggestions only, and they are marked inline.

Reviewed the new 10-file delta at 43f2eca16730 and reconciled it with the previously reviewed PR scope. The revised contract now matches the implementation: remote.shown() delegates to RemotePath.display(), which uses the registry user, host and port while excluding the key, and the ACP and CLI completion notices both use that path renderer. The corrections to the built-in-agent guidance also match the tools this revision actually exposes.

Coverage included AGENTS.md and the relevant CONTEXT.md terms, the revision diff and full PR diff inventory, affected callers and history, backward compatibility, test-strength changes, and the existing architecture constraints. No runtime behavior changed and no test was weakened. uv run pytest tests/test_acp_remote.py tests/test_subagent_acp_remote.py tests/test_subagent_cli_remote.py -q passed with 168 passed and 4 environment skips. git diff --check github/main...HEAD passed, and git merge-tree --write-tree github/main HEAD was clean against efe0f46aed75.

The previously recorded nonblocking follow-ups are unchanged.

[Handsome-wzw]

A round of timing probes on this head, on a registered Linux machine, each run from one script against the real node (heartbeat 120 s, so the probe decides when a dead link is noticed). Ten probes; one wording defect found, fixed in 2542f2d, and the rest passed as they are.

• Two conversations, one file: A read v1, the file became v2, B read it; A's whole-file write was refused ("changed after it was read; nothing was written", the file still v2); C, who never read it, wrote; B's write was then refused against C's; A read again and wrote. The digest is the reader's own, as the change says.
• write_file with the link already dead (relay killed, unnoticed): answered in 0.42 s through a new link, the file written. With the relay killed 5 ms into a 1.2 MB write: "Error: the Raven node on machine 'RavenX 2' (ravenx2) stopped" in 0.01 s, the file as it was (4 bytes, never partial).
• A link inside the root pointing outside it: a file link to /etc/hostname, a directory link to /etc, and a file under that link were each refused ("is outside allowed", the path shown as scp writes it); grep and find over the root found nothing through the link; the hostname never leaked.
• deliver_files with the relay killed between chunk 1 and 2 of a 5 MiB file: delivered whole in 1.75 s, the next chunk having made a new link. Killed 3 ms into chunk 2: "Could not deliver: ... (the Raven node on machine 'RavenX 2' (ravenx2) stopped)" in 0.22 s, no .raven-part left, nothing partial landed.
• The 20 MiB budget: exactly 20 MiB delivered whole in 3.7 s; 20 MiB + 1 byte refused, and the refusal read "20.0 MB is over the 20.0 MB limit". Fixed in 2542f2d: when the two figures round alike the sentence gives the bytes ("20,971,521 bytes is over the 20,971,520-byte (20.0 MB) limit for a file brought back from machine ..."), with a test at the edge that failed before it.
• One file read and written on the daemon at once: page reads during a 1.35 MB write, page and digest agreeing every time (the daemon's file gate).
• The lane switched off in the middle of the session: a read answers "File not found: ravenx2:raven-work/...", the path read as a local one as on main; a write lands under the workspace as a file of that spelling and nothing reaches the machine; deliver_files refuses; remote.machine refuses in one sentence; a link already open still answers a ping. Observed, as designed: with the lane off a path on a machine is a local path.

The script ends by cancelling whatever still runs on the machine through the protocol and listing what runs there: empty after each run. The test group passes with the new case, and the diff coverage of the fix is 100%.

Also carried here, as 8ba32ef: #921's test fixture fix from the same round (the stand-in machine closes the ACP pool before its links at teardown, so no agent or daemon outlives a test; b17c305 there). The remote test groups pass on this head (135) and leave nothing behind.

[gloryfromca]

Blocking: make daemon discovery read complete process command lines and rebase this head onto current main.

The production change is sound: the strict byte budget is unchanged, the one-byte-over case now reports exact byte counts, and the focused delivery assertions cover both sides of the boundary. The new lifecycle test is not sound at this head, however, and the refreshed target branch no longer merges cleanly.

uv run pytest tests/test_deliver_files_tool.py tests/test_subagent_acp_remote.py -q produced 77 passes and one failure in the newly added lifecycle test. Running that test alone failed identically. Under PDB the daemon and agent were live, but the default-width ps output ended before the directory marker; requesting a wide process listing exposed the complete daemon argv. This satisfies the late-round blocker bar: this commit introduces the failing detector, the ordinary focused/CI test path reaches it, and the suite has no working way through without correcting the detector.

After git fetch github main, git merge-tree --write-tree github/main HEAD also exits 1 with conflicts in raven/acp_client/client.py and raven/agent/subagent/backends/cli_agent.py; GitHub reports the PR as dirty too. The branch must be rebased and those conflicts resolved before it can merge.

Coverage included AGENTS.md and the relevant CONTEXT.md contract, the complete PR diff inventory and exact three-file revision delta, affected callers and history, backward compatibility, test-strength changes, lifecycle/concurrency cleanup, and the existing architecture constraints. Patch-risk assessment bound 43f2eca16730..8ba32ef81ae6 at SHA-256 151aae39523f8ddd9f6b9812fc1963f849638a15c03395820b07c4a65e9f41f9; recommendation: revise.

[LivXue]

Windows compatibility re-review at 8ba32ef81ae6eb1dd9ac3154b0ca2c28294c2913, base ee969dbc41a4b00978b4430aae9590a5ebfba010.

Reconciled the complete 76-file base-to-head diff with the previous Windows review, inspected the subsequent contract/message/test changes and reachable callers, and refreshed all comments, reviews and threads. Inspected the exact-byte delivery message change. git diff --check passed.

1. P2, reproduced at this head - remote CLI command grammar. cli_agent.py:608 uses the Windows host's argv builder for a POSIX destination. The real _exec_there method sends sh -c 'hostname; pwd; cat' as POSIX argv ["sh","-c","'hostname;","pwd;","cat'"], splitting the script and breaking remote execution. Parse/build for the destination's POSIX grammar. This used a recording endpoint, without SSH.

2. P2, reproduced at this head - IPv6 tunnel destination. remote.py:401 turns http://[::1]:8000/v1 into 127.0.0.1:41234:::1:8000. Windows OpenSSH's offline -G -F nul parser rejects the captured real tunnel argv (exit 255); the bracketed control exits 0. Bracket the destination IPv6 host in -L so remote OpenAI endpoints on IPv6 loopback can connect.

3. P2, code-reading carry-forward - POSIX copy fixture. test_shell_machine_channel.py:837 still uses true ...; touch .... This unchanged fixture previously failed its marker assertion on Windows; it was not rerun here. Use a portable stand-in or platform-specific setup. This is not evidence that production SCP is refused.

The CLI/tunnel findings remain additions relative to the PR base, unchanged by these follow-ups. The contract wording and delivery wording changes introduce no additional Windows defect found in the inspected scope.

Exact native Windows verification commands and results

Python 3.13.12; isolated detached head, fresh uv environment, verified source imports, separate home/temp/token paths. Setup: uv sync --frozen --python 3.13 --all-packages --extra dev. Tests ran with PYTHONUTF8=1, UV_NO_SYNC=1, and UV_PROJECT_ENVIRONMENT=$R/envs/922. Scratch probes are outside the checkout.

$R = 'C:/Users/livxu/AppData/Local/Temp/raven-windows-review/fcff8ede0d4e4d30a901faa90a675728'
$cases = @(
  'tests/test_ops_remote_path.py',
  'tests/test_acp_remote.py::test_a_path_on_the_machine_is_shown_the_way_scp_writes_it',
  'tests/test_acp_remote.py::test_an_address_a_model_reads_is_scp_shaped_by_address_and_never_by_id',
  'tests/test_acp_remote.py::test_the_files_note_names_what_came_with_the_task_by_address_and_nothing_else',
  'tests/test_subagent_cli_remote.py::test_the_roster_names_the_machine_for_every_kind_and_hands_it_no_paths',
  'tests/test_subagent_cli_remote.py::test_a_built_in_row_cannot_name_a_machine_and_is_told_so',
  'tests/test_rpc_subagents.py::test_a_built_in_agent_is_refused_a_machine_in_one_sentence',
  'tests/test_subagent_acp_remote.py::test_a_dispatch_runs_on_the_machine_in_a_directory_made_there_and_says_where',
  'tests/test_subagent_cli_remote.py::test_a_cli_dispatch_runs_on_the_machine_in_a_directory_made_there_and_says_where',
  'tests/test_subagent_acp_remote.py::test_the_pool_closed_before_the_links_leaves_no_agent_and_the_daemon_goes_idle'
)
uv run pytest @cases -n 0 -x --tb=short --basetemp "$R/checks/922-updated/pytest" --junitxml "$R/checks/922-updated/junit.xml"
# 98 passed, 3 skipped
uv run pytest "$R/test_windows_remote_cli.py" -s -n 0 -x --tb=short --basetemp "$R/checks/922-cli-current/pytest" --junitxml "$R/checks/922-cli-current/junit.xml"
# 1 failed: remote command argv differs as described above
uv run pytest "$R/test_windows_remote_ipv6.py" -s -n 0 -x --tb=short --basetemp "$R/checks/922-ipv6-current/pytest" --junitxml "$R/checks/922-ipv6-current/junit.xml"
# 1 failed: forwarding specification rejected; bracketed control passes
uv run pytest tests/test_deliver_files_tool.py -n 0 -x --tb=short --basetemp "$R/checks/922-deliver/pytest" --junitxml "$R/checks/922-deliver/junit.xml"
# 32 passed

Coverage limits: three POSIX-shell cases skipped, including the new daemon teardown test; its Linux failure is already discussed. No real SSH/remote installation, POSIX daemon end-to-end run, full repository suite or Windows ACL audit.

[gloryfromca]

Blocking: make daemon discovery request complete process command lines.

The merge with current main now resolves cleanly, and I found no additional defect in the two formerly conflicting ACP/sub-agent files. The standing daemon-discovery blocker is unchanged, however: the exact-head focused test still fails with box.daemons() returning no process before cleanup is exercised.

Validation:

• uv run pytest -n0 tests/test_subagent_acp_remote.py::test_the_pool_closed_before_the_links_leaves_no_agent_and_the_daemon_goes_idle -q -s: failed (1 failed) at the same daemon-discovery unpack.
• git diff --check github/main...HEAD: passed.
• git merge-tree --write-tree github/main HEAD: passed against d106a5c6ef32.

I covered the current-base final comparison and merge resolution, the affected callers and history, AGENTS/CONTEXT constraints, backward compatibility, test assertions and weakening risk, and the remote-process architecture boundary. The immutable final diff is d106a5c6ef32...63eb101e379d (76 files, SHA-256 06c45c356e01fce46228dc5aaf2fcd66526a824515a84c4560950e43b6a89b46); the patch-risk assessment validates as revise.

[gloryfromca]

No blockers; suggestions only, and they are marked inline.

Confirmed the daemon-discovery fix at 32e6ee9adb54. The new long-command regression and the previously failing cleanup case pass, the complete remote-ACP module passes (47 tests), and an independent narrow-versus-wide ps probe reproduces the control and the fix. git diff --check and merge-tree against current main also pass.

The existing nonblocking Windows follow-ups remain: destination-POSIX quoting for remote CLI commands from Windows, brackets around IPv6 tunnel hosts, and portability of the POSIX copy fixture. This one-file revision introduces no additional issue.

I reviewed the revision delta, its fixture caller and process-discovery behavior, the test assertions for weakening, current-base mergeability, relevant history, repository rules, compatibility implications, and the previously recorded architecture constraints. All threads I opened are settled.

[LivXue]

Windows compatibility re-review at 32e6ee9adb547eb7b507a16e18c811722d1f6466, base d106a5c6ef329c6bc61f29be538818dff4afaa86.

Reconciled the complete 76-file base-to-head diff with the previous review: 59 files remain byte-identical; inspected the other 17 files against the new base and prior head, including upstream changes and the ACP endpoint/process-cleanup integration. Also inspected the remote CLI merge and POSIX daemon-discovery test update. All discussion pages and current threads were checked; git diff --check passed.

Native checks: 187 passed, 36 skipped; the two existing runtime defect probes still fail as described below. No additional Windows defect found in the merge resolution or daemon-fixture delta.

1. P2, reproduced - remote CLI grammar. cli_agent.py:640 still uses the Windows host's argv builder for the POSIX destination. The real _exec_there sends sh -c 'hostname; pwd; cat' as POSIX argv ["sh","-c","'hostname;","pwd;","cat'"], splitting the script. Parse/build for the destination grammar. The recording-endpoint probe makes no SSH connection.

2. P2, reproduced - IPv6 tunnel destination. remote.py:401 turns http://[::1]:8000/v1 into 127.0.0.1:41234:::1:8000. Windows OpenSSH's offline -G -F nul parser rejects the captured tunnel argv (255); the bracketed control succeeds (0). Bracket the IPv6 destination in -L so this endpoint can be reached.

3. P2, code-reading carry-forward - POSIX copy fixture. test_shell_machine_channel.py:837 remains unchanged and uses true ...; touch ..., the previously reproduced Windows marker-assertion failure. Use a portable stand-in or platform-specific setup. Not rerun here; this does not prove production SCP is refused.

The CLI/tunnel paths are absent from the new base; these remain PR additions, not regressions introduced by this merge/follow-up.

Exact native Windows verification commands

Python 3.13.12; detached exact-head checkout, verified source imports, fresh uv environment and isolated home/temp/token paths. Setup succeeded: uv sync --frozen --python 3.13 --all-packages --extra dev. Tests used PYTHONUTF8=1, UV_NO_SYNC=1, and UV_PROJECT_ENVIRONMENT=$R/envs/922. Scratch probes stay outside the checkout.

$R = 'C:/Users/livxu/AppData/Local/Temp/raven-windows-review/2a3b9a778d94475783ca7bb0f0c52730'
$hostCases = @(
  'tests/test_ops_remote_path.py',
  'tests/test_acp_client_launch.py',
  'tests/test_acp_client_teardown.py',
  'tests/test_node_bundle.py',
  'tests/test_node_client.py',
  'tests/test_node_server.py',
  'tests/test_node_relay.py',
  'tests/test_filesystem_tools.py::test_a_page_is_the_lines_splitlines_gives_whatever_the_chunk_edge',
  'tests/test_filesystem_tools.py::test_a_line_longer_than_a_chunk_is_whole_on_its_page_and_only_counted_off_it',
  'tests/test_filesystem_tools.py::test_a_long_line_is_looked_at_once_whatever_its_length',
  'tests/test_filesystem_tools.py::test_read_file_pages_a_file_without_holding_all_of_it',
  'tests/test_subagent_acp.py::test_close_without_killpg_ends_the_tree_through_taskkill',
  'tests/test_subagent_acp.py::test_close_without_killpg_kills_nothing_by_the_pid_of_an_exited_launcher',
  'tests/test_subagent_acp_remote.py::test_the_pool_closed_before_the_links_leaves_no_agent_and_the_daemon_goes_idle',
  'tests/test_subagent_acp_remote.py::test_the_daemon_lookup_reads_whole_command_lines_whatever_the_terminal_width'
)
uv run pytest @hostCases -n 0 -x --tb=short --basetemp "$R/checks/922-host/pytest" --junitxml "$R/checks/922-host/junit.xml"
# 151 passed, 36 skipped
$killCases = @(
  'tests/test_subagent_third_party.py::test_cli_backend_cancel_without_killpg_ends_the_tree_through_taskkill',
  'tests/test_subagent_third_party.py::test_cli_backend_timeout_without_killpg_still_reports_the_timeout',
  'tests/test_subagent_third_party.py::test_cli_backend_timeout_without_killpg_ends_the_launcher_when_taskkill_does_not_answer',
  'tests/test_subagent_third_party.py::test_cli_backend_without_killpg_kills_nothing_by_the_pid_of_an_exited_launcher'
)
uv run pytest @killCases -n 0 -x --tb=short --basetemp "$R/checks/922-cli-kill/pytest" --junitxml "$R/checks/922-cli-kill/junit.xml"
# 4 passed: native cancellation/timeout and exited-launcher checks
uv run pytest "$R/test_windows_remote_cli.py" -s -n 0 -x --tb=short --basetemp "$R/checks/922-cli-quote/pytest" --junitxml "$R/checks/922-cli-quote/junit.xml"
# 1 failed: remote argv split
uv run pytest "$R/test_windows_remote_ipv6.py" -s -n 0 -x --tb=short --basetemp "$R/checks/922-ipv6/pytest" --junitxml "$R/checks/922-ipv6/junit.xml"
# 1 failed: forwarding specification rejected; bracketed control passes
uv run pytest tests/test_deliver_files_tool.py -n 0 -x --tb=short --basetemp "$R/checks/922-deliver/pytest" --junitxml "$R/checks/922-deliver/junit.xml"
# 32 passed

Limits: no real SSH/remote installation, POSIX daemon end-to-end execution, full repository suite or Windows ACL audit. The new ps -ww regression and daemon teardown case skip at the POSIX-shell guard on this host; their Linux success was not reproduced here. Git HTTPS transport failed; GitHub's Git data API supplied missing objects, each SHA verified before checkout. This did not reduce the source diff.

[Handsome-wzw]

Carries 4ebe198 from #921 (an openai row's files named by address, a cli command split for the machine's shell from a Windows host, an IPv6 endpoint's forward bracketed; the before and after runs are on that PR). The copy test's fixture is portable in a093a86: python touches the marker in place of true and touch, with the copy command's words as its arguments, so the four cases run on a Windows host as they do here.

[gloryfromca]

No blockers; this can merge as far as I am concerned.

Confirmed at a093a86641c5: remote CLI commands are split with the destination node's POSIX grammar even on a Windows host; IPv6 endpoint literals remain bracketed in the SSH -L specification and work through the stand-in tunnel; the copy fixture uses the current Python executable instead of POSIX-only utilities; and OpenAI rows on a machine describe task files by address without claiming they were copied.

Validation: the two complete affected suites pass (156 tests), including all four copy spellings, the Windows-host splitter stand-in, IPv6 formatting and loopback forwarding, and the remote OpenAI file-note contract. git diff --check and merge-tree against current main pass.

I reviewed the seven-file revision delta, affected callers and callees, prior findings and history, repository rules and domain contracts, local/backward compatibility, assertion strength, Windows/POSIX behavior, and the remote command/tunnel/file-address architecture boundaries. The prior nonblocking follow-ups are resolved, no new finding remains, and all threads I opened are settled.

[0xKT]

Merge conflict: @Handsome-wzw #920 and #940 have merged into main, advancing the tip to ea9bb50, and this PR no longer merges onto it cleanly. Re-running the merge check against the live tip:

git merge-tree --write-tree ea9bb502 a093a866

reports add/add conflicts in raven/node/client.py, raven/node/protocol.py, raven/node/server.py and raven/ops/remote_path.py (this PR carries its own copy of the node subsystem and remote_path that #920 just landed), plus content conflicts in raven/acp_client/remote.py, CONTEXT.md, tests/test_acp_remote.py, tests/test_node_client.py, tests/test_node_server.py and tests/test_ops_remote_path.py. The judge has cleared the current head, so a rebase onto the latest main, resolving these against the now-merged #920 code, is the one step left before this can enter the acceptance lane. Posted by the review board after re-running the merge check.

[gloryfromca]

Blocking: rebase onto current main and resolve the integration conflicts.

Independently confirmed against live main at ea9bb502cba1: git merge-tree --write-tree github/main HEAD exits 1. The conflicts include CONTEXT.md, raven/acp_client/remote.py, add/add collisions in the node and remote-path implementations, and their corresponding tests. My clean stance on a093a86641c5 is therefore superseded until the branch is reconciled with the code that landed from #920/#940.

[LivXue]

No blockers in the reviewed scope.

This supersedes my summary at 2ff2c78, which opened Blocking:. Both blockers filed in that round are fixed at this head, and so is the Blocker I filed on #921 at raven/agent/subagent/backends/__init__.py:103, which this PR carries. This round files no new finding.

Scope: I reviewed only the raven/agent/** portion of this PR -- 14 of 76 changed files, seven under raven/agent/tools/ and seven under raven/agent/subagent/. The seven under raven/agent/subagent/ have the same content as #921 at 4ebe198. The remaining 62 files were read as context but are not covered by this verdict.

What I examined: the changes since 2ff2c78 -- the copy refusal removed from shell.py and machine_exec.py, the read digest keyed by its reader in remote_files.py, deliver.py, the paged read_file in filesystem.py, the raven_config.py hints, and the machine lane widened to every kind under raven/agent/subagent/ with its later fixes (the written address rule, a command for a machine split by shlex.split, an openai row's files named by address) -- against the permission defaults and session keys under raven/permissions/ and raven/ops/remote_path.py.

Confirmed findings: none in this round.

My previous round's findings, at this head:

• The scp, sftp and rsync refusal is gone (shell.py, Blocker). With recording stand-ins for the clients on PATH, the four copy commands I used last round ran with the machine lane on and with it off; at 2ff2c78 the same four were refused. A plain ssh to the machine is still refused, and the refusal again says scp and rsync to it are fine.
• A write on a registered machine now asks (raven/permissions/rules.py, Blocker). default_tier returned ask for write_file and edit_file on all four remote paths that note measured, mode="append" included, and a write grant is keyed by the one file it names. Reads are unchanged.
• The digest a write expects is keyed by its reader (remote_files.py). Through the stand-in ssh and a real node, with three conversations, another agent's read no longer lets a stale overwrite through.
• Nothing reclaims pulled/, now on purpose, as the _landing docstring says (deliver.py).
• The design ids C28 and C30 are gone from raven/, tests/, CONTEXT.md, docs/ and docs-site/.

These were measured at 6970b45. The files they rest on are unchanged since, except deliver.py, whose only change is the wording of its size refusal, and the C28/C30 search is empty at this head.

The notes I filed on #921, at this head:

• The address rule (backends/__init__.py:103, Blocker): the five sites it named -- the AgentMeta.machine docstring, _WAY_IN and Machine in raven/acp_client/remote.py, and the two sentences of the CONTEXT.md entry -- now state the rule with its format. remote.shown gives scp://worker@203.0.113.7:58717//home/worker/raven-work/t1 off port 22 and worker@203.0.113.7:/home/worker/raven-work/t1 on it: the registry's address, no machine id, no key. test_an_address_a_model_reads_is_scp_shaped_by_address_and_never_by_id passes, and fails when shown names the path by the machine's id.
• An openai row's attachments (openai_api.py:287, Nonblocking): a row on a machine now names the files that came with its task by address, as the acp and cli lanes do. test_the_files_that_came_with_an_openai_row_s_task_are_named_by_address_and_not_copied passes, and fails with the local note restored.

The three findings of the Windows review on this PR (cli_agent.py, remote.py and test_shell_machine_channel.py, last reported at 32e6ee9) are addressed by a2cee17 and a093a86: a command for a machine is split with shlex.split whatever this computer is, an IPv6 tunnel host is bracketed, and the copy fixture no longer runs true and touch. The splitter test passes, and fails with this computer's splitter restored. I checked these on Linux only; the native Windows run has not been repeated at this head.

Verification:

• At this head, six test files over what the commits since 6970b45 change (test_subagent_cli_remote.py, test_subagent_acp_remote.py, test_acp_remote.py, test_deliver_files_tool.py, test_shell_machine_channel.py, test_node_client.py), run in an environment whose imports resolve to this head: 386 passed, 7 skipped (no csh, tcsh or zsh on this machine, and an OpenSSH older than 9.2). At 6970b45, 13 test files across the same areas: 782 passed, 1 skipped.
• lint-imports at this head: 10 kept, 0 broken.
• The reproductions were run on Linux, through the PR's stand-in ssh and its real Raven node where a node is involved. No connection to a real machine was made.

Checked and deliberately not reported:

• test_a_cancel_ends_the_agent_s_whole_process_tree_on_the_machine failed once in CI at 6970b45 and passes at this head, in CI and in the run above. Under load it failed 2 of 18 runs at 0fa61f1 and 0 of 18 at 6970b45, so I did not treat it as a defect of this change; I did not establish whether a cancel came late or was lost.

The branch now conflicts with main: #920 landed its own copy of the node and remote-path subsystem this PR also adds, and the tip was checked at ea9bb50. git merge-tree --write-tree ea9bb502cba1 a093a86641c5 exits 1, with add/add conflicts in raven/node/client.py, raven/node/protocol.py, raven/node/server.py and raven/ops/remote_path.py, and content conflicts in raven/acp_client/remote.py, CONTEXT.md and their tests -- the same list 0xKT and gloryfromca reported. Nothing under raven/agent/ is in that list, so it does not change the verdict above, which is scoped to those 14 files. It does mean the file tools will read through #920's copy of raven/ops/remote_path.py once this branch is rebased onto main; that file is not this PR's, and the checks above were run against this PR's copy.

[Handsome-wzw]

Rebased the integration: origin/main (ea9bb50) is merged into this branch as de6e70e, plain push, no rebase and no force.

How it was resolved: the ten files main carries from the node service on this head are byte-identical to the node branch's final head, so this branch's own read, write and deliver changes were kept whole on top of them, and the follow-ups main took afterwards are retained beside them. Checked file by file, and the merge result against both sides matches exactly what each side alone had.

Validation on the merged tree, and the ten real-machine probes will follow in a comment.

[Handsome-wzw]

A round of timing probes on this head, on a registered Linux machine, each run from one script against the real node (heartbeat 120 s, so the probe decides when a dead link is noticed). Ten probes, 10 PASS:

• Two conversations, one file: a read's digest is its reader's own, and the whole-file write of the one who read an older version is refused with nothing written.
• write_file with the link already dead (relay killed, unnoticed): answered in 0.31 s through a new link, the file written. Killed 5 ms into a 1.2 MB write: refused in 0.01 s, the file as it was, never partial.
• A link inside the root pointing outside it: a file link, a directory link and a file under that link each refused, and grep and find over the root find nothing through them.
• deliver_files with the relay killed between chunks of a 5 MiB file: delivered whole in 1.34 s on a new link. Killed 3 ms into the second chunk: refused in 0.13 s, no .raven-part left, nothing partial landed.
• The budget at the edge: exactly 20 MiB delivered whole in 2.8 s; 20 MiB + 1 byte refused, and the sentence gives both figures in bytes.
• One file read and written on the daemon at once: page and digest agreed every time.
• The lane switched off mid-session: a read of an address answers as a local path, a write lands inside the workspace and nothing reaches the machine, deliver_files refuses, machine() refuses in one sentence, and a link already open still answers a ping.

The script cancels whatever still runs on the machine through the protocol and lists what is left: empty. The node installed for the run was removed afterwards.

Merge commit de6e70e; node digest a058d39a402a.

[gloryfromca]

No blockers; this can merge as far as I am concerned.

Confirmed at de6e70eb6c07: the branch merges cleanly with current main (ea9bb502cba1). The ten formerly conflicting node, remote-path, context, and test files preserve the already-reviewed branch blobs; nine of the thirteen effective merge additions are byte-identical to main. The remaining probe.py and associated test integrations preserve both sides and add current-main's newest-measurement-wins guard without disturbing the registered-machine paths.

Validation: 981 exact-head focused tests passed with four expected unavailable-shell skips across node client/server, remote paths, ACP transport, remote file tools and delivery, capability probing, Windows environment handling, remote CLI, and shell-machine behavior. git diff --check and current-main merge-tree pass.

I covered the current-base final comparison, conflict resolutions against both parents, callers and history, repository and domain rules, backward compatibility, test weakening, remote authorization/filesystem boundaries, destination command and tunnel parsing, node recovery/concurrency, and the capability-snapshot merge. The immutable 50-file comparison is ea9bb502cba1...de6e70eb6c07 (SHA-256 9ab11e18e8e79c3acacf455084490146af8f49ea9fb2b4b3301b21111ff4e77f); the validated patch-risk recommendation is merge / human_review_required because the remote-runtime impact is high and native Windows was not rerun after this merge. No source-visible defect remains, the integration blocker is cleared, and all threads I opened are settled.

[LivXue]

Approving at de6e70e. The scope and the evidence are in my summary comment above.