[mblua]

portable-pty 0.9.0 requests a cursor response on Windows. A hidden local session can wait at startup until a terminal attaches. This pins both consumers to =0.9.0 and handles the first cursor query in the existing reader, using the session parser's current position.

The responder uses a weak reference to the original writer. A response failure disarms it while the reader continues draining; explicit Stop retains ownership of teardown. The host-version probe used by the Windows acceptance tests is classified as the fifth constructor in the existing spawn inventory, with its additional TestOnly classification.

Refs #3029. Keep the issue open for the Linux/Docker verification below.

Candidate b50dee8bf359153e5c069ee755acb8a23dc02d7b contains main c61cfbdeecb3bc20a1a9d7308fd6e67bb2df99d5. Its only change from the tested source 8a95882a55ed594e0f73e2208618f823ce800700 is the inherited main coverage workflow's --maxWorkers=1 argument. All Rust sources, resources, manifests, lockfiles, build/test inputs and structural tools are byte-identical. The following results retain their explicit tested SHA and are reused on that evidence:

• Rust 1.98.1 locked all-targets check passed on 8a95882a. Test binaries were compiled from that source; hashes and sizes were independently verified before and after execution. Independent runtime audit passed, including PTY handle/map cleanup and absence of all six captured child PIDs.
• Windows issue3029: 6 passed, 0 failed/ignored. Host 10.0.26300.9711 recorded consumed/written 1/1 in every integrated session; startup, input, resize, late attach, exit and Stop assertions passed.
• Spawn inventory: exactly 1 passed. Local backend suite: 71 passed, 1 preexisting ignored test; PoisonedChild passed within that suite. Structural guards: 1 + 5 + 3 passed.
• Configuration compatibility: 21 p02_ tests, 1 exact legacy duplicate activation test and all 27 cli_project_registration tests passed.
• CI on 8a95882a: all 26 checks, including all 14 required contexts, succeeded. The actual Linux log from run 38916004321 confirms 6 issue_2683 tests passed with no failures/ignores, including both injected-PATH positive and negative cases. This reconciles the PATH gate; it does not execute the new Unix issue3029 tests.
• Bridge inputs remain unchanged; the explicitly historical 5-test result from 08aac481 is retained, not reported as a new-head execution.

Own diff is seven files; both main integrations were automatic and conflict-free. The implementation retains its independent code/architecture and runtime reviews. The current integration passed focused independent review and the prescribed Node 22 structural POST: all 1211 module pairs match the committed main oracle and records, with the same complete SCC of 89 members and passing arc/cycle guards.

Plan v9 has four exact votes; SHA256 2766755AEBD9631F415FA479152D1CC803783DB94393A6A3B50C1AE31AF48736. The user explicitly approved the additional inventory file.

Fresh CI must complete on b50dee8b; older green runs do not validate this new commit. Every required and triggered check must succeed before merge; ci:full is retained. The updated main coverage pipeline will be reconciled after landing.

PENDING_LINUX_TESTS: execute the three Unix issue3029 behavior tests with the real child fixture and run the real Docker bridge e2e with AGENTSCOMMANDER_RUN_DOCKER_E2E=1. Compile-only, zero-selected or early-return runs do not satisfy these tests. The Unix inventory is not selected by the current Linux/macOS jobs. The landed main SHA and exact commands will be recorded in #3029 for the Linux group; the issue remains open until results are reconciled.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​portable-pty@​0.8.1 ⏵ 0.9.0

View full report

[mblua]

Step9.5 stale-base triage: origin/main advanced from 9f87ec7ff5bc5ecf8cbfabd80a924dc238939485 to 803f272f through #3031. The three incoming commits are 4929a431 (README copy), 6f35c770 (merge main into that docs branch), and 803f272f (PR merge). The complete effective incoming diff is README.md only,13 insertions/6 deletions; the full diff was inspected.

Classification: documentation-only and unrelated to this PTY/dependency change. No Rust source, dependency/lockfile, build configuration, test, workflow, or any of this PR's six paths changed. The reviewed/tested feature head remains 08aac4811c27c7b3c5f5a8782738e691cb309103, verified against the remote PR. Its source/runtime/PRE-POST evidence remains applicable.

Apply the documented documentation-only stale-base exception: retain the current feature head and its CI; no branch update, new review or CI rerun is required for this delta. This is not a claim that CI has passed. All required and triggered checks must still be verified green for that exact head before merge. The working checkout remains on the published PR branch/head throughout CI.

[mblua]

Target delta triage while CI runs on 8a95882a55ed594e0f73e2208618f823ce800700: main advanced from 5903ea6fd5c2ddf66ac6618bab9a48ac361b3a64 to c61cfbdeecb3bc20a1a9d7308fd6e67bb2df99d5 through #3042. The only changed path is .github/workflows/coverage.yml: the main frontend coverage command adds --maxWorkers=1.

This is a workflow/verification change, so Step9.5's unrelated-delta exception does not apply. The checkout remains clean on the published head throughout current CI. After its native completion notice, we will inspect its actual results, integrate main through the existing approved flow, obtain focused independent review and publish the updated head for fresh required CI. Only affected evidence will be refreshed: Rust product/build/test inputs are unchanged by this one-line workflow delta, and existing results retain their explicit source identities. The main coverage pipeline will use the updated command after landing.

No product scope change, new approval request, release or installation. Stop and reader draining remain unchanged. #3029 remains open for the recorded Linux/Docker verification.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud