GDB/AI 1.3.0

Changes since v1.2.0

GDB/AI 1.3.0 combines more native debugging work into one Agent call, preserves richer GDB values, and lets cooperating callers share immutable observations.

Native debugging and shared observations

• Launch can create a session implicitly, install breakpoint locations before execution, and return requested stop observations together with target output. Restart also accepts observation plans. A failed launch retains the newly created session's identity for recovery or cleanup.
• Run, batch, and snapshot requests share bounded inspection plans and stop context. Independent read failures preserve successful results and report incompleteness. Authorized callers can retrieve an immutable observation by ID without new GDB commands, including while control is pending or after the session closes, within retention limits.
• Stack and thread views include available frame arguments. Optional include_locals: true captures typed locals and aggregate contents for the returned frames; standalone locals and profile snapshots retain aggregate values too. Paging, frame budgets, unavailable values, and partial unwind errors remain explicit.
• Memory reads through projected Agent tools now return exact data_hex by default. Hex pairs follow ascending byte addresses without guessing text encoding or integer byte order. Large reads retain bounded previews and exact binary artifacts.
• Qualified concurrent metadata and top-frame register reads reuse bounded same-stop captures. Memory, expressions, and unwound register reads are not cached. Cooperative controller handoff stays within the same authenticated principal.

Correctness, evidence, and SDKs

• Preserve MI3 breakpoint command lists and verify their execution and replay across the supported GDB matrix. Deliver complete MI records before reporting a later framing error, and seed parser fuzzing with individual records.
• Preserve thread ownership across unscoped stop events and reconciliation, partial stdio requests across response interleaving, and operation handles after asynchronous waiter timeouts. Cancellation and close retain their independent control path, including around late replies and checkpoint failures.
• Keep native facts, capture context, completeness, and evidence distinct in compact Agent replies. Preserve precise binary values, variable-object creation context, crash capture identity, promoted snapshot metadata, and successful sibling reads when another read fails.
• Batch journal evidence references and retain readable resource links. Historical observations and differences remain independent of live execution and do not silently re-read the target.
• Add typed common debugging operations and one-call launch examples to the Python and TypeScript SDKs. Real-server verification covers shared history during pending control, controller handoff, both HTTP protocol versions, and both journal durability modes.
• Centralize release input in VERSION. Run python3 scripts/version.py after editing it, or python3 scripts/version.py X.Y.Z to update it and synchronize native package metadata. CI rejects version drift and mismatched release tags. The standard-library script validates all metadata locations before writing and leaves third-party and protocol versions unchanged.

Upgrade and deployment notes

• Projected observation identity is in context.observation_id; completeness is top-level complete. Matching copies are omitted from result. Consume the compact envelope and preserve explicit errors, continuation, truncation, and historical markers.
• Canonical memory calls keep their Base64 default. Set encoding: "base64" on projected calls to retain that representation, or explicitly choose "hex" on either interface. Historical captures retain their original representation.
• Rust and SDK package versions are 1.3.0. The canonical namespace remains gdb.ai/v1; MCP 2025-11-25 and 2026-07-28 remain supported. See the versioned protocol guide and SDK guide.
• Deployment remains a trusted local workspace under the server's OS account. API ownership is not containment for GDB, helpers, or target code; untrusted workloads need an external container or VM boundary. See the security model.

Verification and release assets

• Tag: v1.3.0; source commit: 956cbdb.
• All packaging gates in the tagged CI run passed: version consistency, formatting, required Rust tests, Clippy, canonical schema checks, native runtime comparisons, Python/TypeScript SDK checks, three fuzz campaigns, GDB 9.2–17.2 compatibility, native AArch64 system tests, and Linux kernel 6.1/6.12/6.12-arm64 checks.
• The independent 10,000-cycle real GDB lifecycle soak passed in the tagged CI run. It remains separate from the packaging gate. The complete tagged workflow finished successfully before Release publication.
• Assets contain the static x86-64 Linux musl binary bundle, deterministic source archive, CycloneDX 1.5 SBOM, and SHA256SUMS. GDB itself is not bundled. GitHub build provenance binds all four asset digests to this tag, source commit, and workflow run.
• All downloaded checksums and embedded schema hashes passed. The uncompressed source archive matches git archive of the tagged commit byte for byte. The binary reports 1.3.0, v1.3.0, the source commit above, Rust 1.88.0, and dirty: false; it has no dynamic program interpreter.
• python3 sdk/verify.py /path/to/extracted/gdb-ai also passed against the downloaded static binary: both SDKs, both HTTP protocols, and both history modes, including complete replay of all 16 session journals and shared historical reads during pending control.

Full changelog: v1.2.0...v1.3.0

GDB/AI 1.2.0

Changes since v1.1.1

GDB/AI 1.2.0 improves compound debugging calls, session correctness, bounded evidence handling, and the Python and TypeScript SDKs. Review the upgrade notes below before deploying with an existing configuration or MCP client.

Agent interface and inspection

• Combine run control, byte-exact input, stop-or-exit waits, requested observations, and target output in one call. Projected continue and step now wait for a stop or exit by default; asynchronous operation remains available explicitly. Add direct restart and richer bounded probes.
• Expose eleven default MCP tools, including inspection batching and probes. Compact projected replies omit repeated state and healthy defaults while preserving errors, truncation, continuation, and evidence-gap information. Bound large replies after projection and preserve artifact ownership.
• Add bounded symbol/type facts, paged mappings, thread stacks captured at one stop, ABI argument views, ordered expression batches, address-expression memory reads, and GDB-side searches over large memory ranges.
• Return native GDB helper output with raw command replies, including output preceding errors. Consecutive raw commands defer registry reconciliation until a structured operation needs that state.

Correctness and reliability

• Preserve literal launch arguments across supported GDB versions, resolve relative targets from workspace roots, validate executable inputs, and preserve supported environment values exactly. Runtime selection remains the caller's responsibility.
• Keep interrupt and cancellation ordering independent of ordinary mutation waits. Preserve stops at deadline boundaries, known exit codes, and parent state across child exits; isolate reused inferior generations and retire closed sessions promptly. GDB hangups no longer terminate the server.
• Preserve binary PTY input, restore EOF behavior, support prompt-synchronized input steps, and drain the current PTY generation before returning exit. Control-heavy output uses lossless binary encoding; resource ranges retain byte-exact UTF-8 and binary content.
• Retain operation results after response delivery failures, isolate reused HTTP request reservations, and honor stateless request metadata. Sessionless HTTP requests default to the stateless protocol path.
• Coalesce concurrent artifact verification and event resynchronization, reject blocking special-file inspection inputs, and mark abandoned stored sessions failed after restart instead of presenting them as live targets.

Performance and history

• Reduce full-state copying in session publication, request admission, coordination reads, and inspection. Reuse journal encoding buffers, incrementally frame fragmented MI records and verify replay evidence, decode C-string spans in bulk, and copy ring-buffer reads in bounded spans.
• In the default performance history mode, coalesce checkpoints and keep live debugging available after history-storage failures, with explicit evidence gaps. Durable mode retains required evidence writes and fails the session when those writes fail. Replay distinguishes complete journals from prefixes; it does not restore or execute an inferior.
• Release builds now use opt-level = 3, fat LTO, and one codegen unit. Portable CPU targets and panic unwinding are retained. These settings trade longer compilation for optimization opportunities; no universal runtime speedup or Agent-accuracy improvement is claimed.

SDKs and target coverage

• Synchronize Rust packages, fuzz dependency locks, both SDK packages, and MCP client identities to 1.2.0.
• Bring Python and TypeScript to parity for canonical calls, projected tools, resource discovery, and bounded resource reads. Add optional stateless 2026-07-28 support while retaining the sessionful 2025-11-25 default.
• Preserve structured RpcError data, close/abort evidence, and monotonic revisions. Forward explicit idempotency keys without automatically changing the request fingerprint; reuse HTTP sessions and tolerate already-evicted sessions on disconnect. Accept base URLs and complete /mcp endpoints.
• Keep Python dependency-free on Python 3.10+ and TypeScript on Node.js 22+ native fetch. Include typing declarations, installation guidance, and a required real-server SDK check covering both protocols and history modes.
• Extend conditional Linux kernel inspection with stripped-target bootstrap, runtime symbols/modules, page-table views, and bounded kernel logs. Symbol-free bootstrap and page-table paths remain limited to supported x86-64 QEMU targets; typed traversal requires matching symbols.
• Add native GDB comparisons for V8/Node.js, PHP/CGI, Clang, and LLVM MCJIT. These checks qualify the tested builds and helpers, not a separate language debugger or every runtime/GDB combination. Stabilize the GDB compatibility build/cache recipe and legacy x86 XSAVE handling.
• Update the 10,000-cycle lifecycle soak to verify closure through canonical response state after nested-state deduplication, retaining the check on every session close.

Upgrade and security notes

• Defaults have changed: ordinary sessions use lab_mutation, bubblewrap is disabled by default, the kernel provider is enabled, and an empty remote allowlist accepts parsed GDB endpoints. Set an appropriate observer/control profile, sandbox mode, and nonempty endpoint allowlist when required.
• GDB and its children inherit OS resource limits unless positive caps are configured. limits.process_file_bytes is independent of artifact quotas. Configure explicit limits or an external container/VM boundary for untrusted workloads; evidence quotas do not constrain target file writes.
• Raw console administration accepts native GDB commands only after explicit authorization. GDB helpers and probe trigger processes run with host-account permissions. Target auto-load remains disabled and HTTP remains loopback-only; a bearer token does not enable a non-loopback listener.
• MCP-created sessions use fixed caller control without renewable write leases. Canonical clients retain revision and lease coordination. An omitted projected stop_id binds the current stop; an explicit ID remains a stale-stop check.
• MCP clients should consume structuredContent and tolerate omitted defaults. Canonical clients should use the envelope's state rather than depend on an identical nested result.state. Waiter timeout does not cancel execution: retain operation_id and inspect its status before considering another call.
• The canonical namespace remains gdb.ai/v1. Use the versioned protocol guide, security model, and SDK guide when upgrading.

Verification and release assets

• Tag: v1.2.0
• Source commit: 3676f60
• Tagged CI and release provenance: the required Rust tests, Clippy, schema checks, Python/TypeScript SDK tests and real-server checks, native runtime comparisons, fuzz campaigns, GDB 9.2–17.2 matrix, AArch64 system tests, and Linux kernel 6.1/6.12/6.12-arm64 checks passed.
• The 10,000-cycle real GDB lifecycle soak passed both locally and in the tagged CI run, with eight concurrent sessions. This long-running check remains independent of the packaging gate.
• The qualified bundle contains a static x86-64 musl binary, deterministic source archive, CycloneDX 1.5 SBOM, SHA-256 checksums, and GitHub build provenance. All downloaded artifact checksums passed; the binary reports v1.2.0, the source commit above, and dirty: false.
• Both SDKs also passed all 16 real GDB sessions against the downloaded static release binary, across both HTTP protocols and both history modes, including complete journal replay.

The tag was corrected before Release publication from 172000a to 3676f60 for the soak-only assertion fix. Refresh any previously fetched v1.2.0 tag that still resolves to the earlier commit; release artifacts use the final source commit above.

Full changelog: v1.1.1...v1.2.0

GDB/AI 1.1.1

Changes since v1.1.0

• Fixed false artifact-integrity failures during concurrent content-addressed publication. Removing the temporary hard link changes inode ctime without changing content, so cache fingerprints now use stable identity and content metadata.
• Synchronized the Rust workspace, fuzz workspace, Python SDK, and TypeScript SDK version metadata to 1.1.1.

Verification

• Exact tag: v1.1.1
• Commit: 3e1a17e
• CI: Rust tests, Clippy, schemas, SDKs, fuzz campaigns, GDB 9.2–17.2, AArch64 system tests, and Linux kernel 6.1/6.12/6.12-arm64 passed.
• The release bundle contains a static x86-64 musl binary, deterministic source archive, CycloneDX SBOM, SHA-256 checksums, and GitHub build provenance.

Full diff: v1.1.0...v1.1.1

GDB/AI 1.1.0

GDB/AI 1.1.0

Changes since v1.0.0: 84 commits, 46 files changed, 3,904 insertions and 627 deletions.

Added

• Added stateless MCP 2026-07-28 requests for stdio, Unix streams, and Streamable HTTP while retaining the stateful MCP 2025-11-25 transport.
• Added MCP client configuration examples for Codex, Claude Code, OpenHands, Kimi CLI, and DeepSeek-compatible harnesses.
• Added operation ownership across queued commands, composite observations, transactions, cancellation, and unknown command outcomes.
• Added bounded Unix client concurrency and independent concurrent session creation.

Performance and Agent context

• Reduced a representative 12-call automatic-debug workflow from about 40.8 KB to 11.4 KB of MCP responses.
• Deduplicated equivalent tool schemas and reduced the default tools/list response from 20,773 bytes to about 17,989 bytes.
• Bounded around-mode disassembly to the requested instruction count; the measured 17-instruction response fell from 16.9 KB to 3.9 KB.
• Made breakpoint mutation responses constant-size instead of repeating the complete breakpoint registry; 64 inserts fell from 591 KiB to 38 KiB.
• Replaced complete session-state responses with bounded stop and coordination context where detailed state is available on demand.
• Removed duplicate MI replies, capability tables, state, lossless I/O encodings, and successful text summaries from MCP presentation.
• Reused handshake safety settings during expression evaluation, reducing the default path from at most 10 MI round trips to 5.
• Replaced quadratic memory pattern search and generic hexadecimal conversion with linear scans and direct nibble conversion.
• Avoided repeated request, state, JSON, journal, caller payload, MI argument, command buffer, and idempotency hash copies.
• Reused PTY ring allocations, artifact digests, verified publications, and delivered operation responses.

Reliability and race fixes

• Prevented cancelled or superseded JSON-RPC requests from delivering stale responses after a client reuses a request ID.
• Preserved operation results when cancellation races with completion and kept cancellation bound to the operation that owns a resume.
• Enforced deadlines while commands wait for actor admission, composite observation locks, capability refresh, and transaction ownership.
• Preserved cancellation across observation commands and compensating cleanup commands.
• Closed session admission during shutdown and serialized idempotency-lock, maintenance-lock, and durable lease transitions.
• Failed sessions closed when state persistence fails instead of continuing with unrecorded authoritative state.
• Kept rejected, expired, and closed operations from retaining resume or session ownership.
• Preserved HTTP cancellation while an operation is being admitted and protected reused HTTP and stream pending request IDs.

Runtime evidence and state correctness

• Attributed memory and disassembly observations to the stop that produced them.
• Preserved unrelated inferior stop context and committed snapshots during enrichment failures.
• Bound persisted consistency limitations and attributed minimal snapshots to the stopped thread.
• Preserved address gaps in partial memory reads, rejected wrapped ranges, and bounded decoded backend responses.
• Serialized PTY spool capture with finalization, invalidated completeness after late or dropped output, and reported terminal PTY errors.
• Isolated artifact temporary cleanup from session startup and reused complete content-addressed publications safely.
• Guarded probe breakpoint cleanup before persistence and preserved results when audit completion logging fails.
• Bounded fallback responses even when artifact publication is unavailable.

Packaging and documentation

• Bumped the Rust workspace and Python/TypeScript SDKs to 1.1.0.
• Kept the Linux x86-64 release binary statically linked with musl and independent of the host glibc version.
• Removed README.md from the binary bundle because its repository-relative media belongs to the complete source archive.
• Updated protocol and README documentation for stateless MCP and compact Agent output.

Verification

• 167 local unit and integration tests passed, including GDB launch, attach, core, gdbserver, AArch64/QEMU, kernel, PTY, cancellation, and artifact paths.
• Clippy passed with warnings denied; Python and TypeScript SDK tests and schema checks passed.
• The explicitly ignored 10,000-cycle soak test was not run.

Full diff: v1.0.0...v1.1.0

GDB/AI 1.0.0

GDB/AI 1.0.0 is the first stable release of the Agent Interface built on GDB and its native GDB/MI protocol.

Highlights

• Persistent, isolated GDB sessions with separate MI control and inferior PTY channels.
• Bounded, stop-scoped observations for stacks, variables, registers, memory, disassembly, events, and runtime evidence.
• Structured breakpoint and execution control with explicit revisions, deadlines, interruption, cancellation, and unknown-outcome fencing.
• MCP stdio, Unix, and loopback Streamable HTTP transports, plus the canonical JSON-RPC API and Python/TypeScript SDKs.
• Local launch, attach, core files, gdbserver/remote targets, x86-64, AArch64, and capability-gated kernel inspection.
• Content-addressed artifacts, bounded journals, replay, quotas, retention, policy enforcement, write leases, and audit records.

The release was qualified with Rust 1.88.0, GDB 9.2 through 17.2 (MI3/MI4), AArch64 system tests, and the public kernel matrix. These claims describe the interface and verified control plane; they do not claim a general improvement in Agent task success rates.

Linux binary

• gdb-ai-1.0.0-x86_64-unknown-linux-musl.tar.gz contains a static PIE binary and does not depend on the host glibc version.
• SHA256SUMS verifies the binary archive, source archive, and CycloneDX SBOM.
• Run gdb-ai doctor after installation to check the local GDB and target environment.