StateFrame 0.4.38

StateFrame 0.4.38: test runs accept folder paths ending in a slash.

Changes

• Fixed: run_tests now accepts directory selectors written with a trailing slash or a leading ./, for example tests/ or ./tests/. Before, StateFrame refused them before running anything, even though the refusal named the same folder as the closest real path, and a run could stop there.

Known issues (fixes planned)

• When a check is refused before it runs, the run can stop instead of reporting the refusal to the model and continuing. A fix is in progress.
• In-place runs and exported patches can change the line endings or byte-order mark of untouched text files in the edit scope (see KNOWN_LIMITATIONS). A fix is being tested now.
• Linux: checks that run Go or Node programs fail under StateFrame's check memory limit. macOS is not affected.
• The first request of a run can differ between runs in one optional orientation section, depending on local cache state.
• On endpoints without an exact tokenizer, very dense content can be underestimated and push a request past the context limit.

StateFrame 0.4.37

StateFrame 0.4.37: proxy credentials never reach the endpoint.

Changes

• Security: direct requests now remove a caller-supplied Proxy-Authorization header before sending, so a proxy-only credential cannot be forwarded to your endpoint.
• Security: when a request goes through a proxy, the proxy credentials stay with the proxy and are not sent again after a redirect to a different origin.
• How requests are routed is unchanged: StateFrame still connects to your endpoint directly and does not use environment proxy settings.

Known issues (fixes planned)

• In-place runs and exported patches can change the line endings or byte-order mark of untouched text files in the edit scope (see KNOWN_LIMITATIONS). A fix is being tested now.
• Linux: checks that run Go or Node programs fail under StateFrame's check memory limit. macOS is not affected.
• The first request of a run can differ between runs in one optional orientation section, depending on local cache state.
• On endpoints without an exact tokenizer, very dense content can be underestimated and push a request past the context limit.

StateFrame 0.4.36

StateFrame 0.4.36: the request-path randomness check passes again.

Changes

• Tests: the check that every random call on the request path is reviewed now covers the random calls used to build a measurement identity key. Those values never reach request bytes. A planted control proves that a new, unreviewed random call still fails the check.

No change to runtime behavior.

Known issues (fixes planned)

• In-place runs and exported patches can change the line endings or byte-order mark of untouched text files in the edit scope (see KNOWN_LIMITATIONS). A fix is being tested now.
• Linux: checks that run Go or Node programs fail under StateFrame's check memory limit. macOS is not affected.
• The first request of a run can differ between runs in one optional orientation section, depending on local cache state.
• On endpoints without an exact tokenizer, very dense content can be underestimated and push a request past the context limit.

StateFrame 0.4.35

StateFrame 0.4.35: the edit tool no longer advertises a field it always refused.

Changes

• The str_replace tool description offered an edits field that StateFrame's step checks always rejected. It is removed, so models are no longer offered a call shape that cannot work. Every request is 28 bytes smaller.
• A new test checks that every tool description offered to the model only contains fields its step checks accept.

Verified against a full task corpus with no change in outcomes.

Known issues (fixes planned)

• In-place runs and exported patches can change the line endings or byte-order mark of untouched text files in the edit scope (see KNOWN_LIMITATIONS). A fix is being tested now.
• Linux: checks that run Go or Node programs fail under StateFrame's check memory limit. macOS is not affected.
• The first request of a run can differ between runs in one optional orientation section, depending on local cache state.
• On endpoints without an exact tokenizer, very dense content can be underestimated and push a request past the context limit.

StateFrame 0.4.34

StateFrame 0.4.34: automatic retry when a provider rejects a request as too long.

Changes

• When a provider rejects a request for exceeding its context limit (a recognized HTTP 400 from OpenAI, DeepInfra, vLLM, llama.cpp and other common providers), StateFrame now refits the request to the limit the provider reported and retries once.
• If the request still cannot fit, the run stops and the summary says why, instead of showing only "HTTP 400".
• Other HTTP 400 errors (for example a malformed response format) are not retried.

Known issues (fixes planned)

• In-place runs and exported patches can change the line endings or byte-order mark of untouched text files in the edit scope (see KNOWN_LIMITATIONS). A fix is being tested now.
• Linux: checks that run Go or Node programs fail under StateFrame's check memory limit. macOS is not affected.
• The first request of a run can differ between runs in one optional orientation section, depending on local cache state.
• On endpoints without an exact tokenizer, very dense content can be underestimated and push a request past the context limit; the new retry recovers many of these cases.

StateFrame 0.4.33

StateFrame 0.4.33: safer concurrent access to the call-coverage index.

Fixes

• When several threads worked on the same run, a request could pick up a call-coverage index that another thread had not finished connecting to the run's journal. The index is now fully connected before anything else can see it, and reconnecting an index that is already connected costs no extra work.
• A coverage snapshot now gives one consistent view of all its fields; code that needs several fields to agree should read the snapshot.

Measured replay time is unchanged within noise (+1.3% on a 3-minute replay). Requests sent to the model are unchanged.

Known issues (fixes planned)

• In-place runs and exported patches can change the line endings or byte-order mark of untouched text files in the edit scope (see KNOWN_LIMITATIONS). A fix is being tested now.
• Linux: checks that run Go or Node programs fail under StateFrame's check memory limit. macOS is not affected.
• The first request of a run can differ between runs in one optional orientation section, depending on local cache state.
• On endpoints without an exact tokenizer, very dense content can be underestimated and push a request past the context limit.

StateFrame 0.4.32

StateFrame 0.4.32: fix for runs stopping with "serialized continuation limits were removed or changed".

Fixes

• A run with a turn limit (the default is 32 turns) could stop with "serialized continuation limits were removed or changed". This happened when a request had to be rebuilt after a turn had already been counted but before the request was sent: the rebuilt request reused the original's identity, so StateFrame's pre-send check compared it against out-of-date limits and refused it. The rebuilt request now gets its own identity, so the check compares it against the right limits. The check itself is as strict as before.
• Verified with 20 requests on a hosted OpenAI-compatible endpoint with no errors.

Requests sent to the model are otherwise unchanged.

Known issues (fixes planned)

• In-place runs and exported patches can change the line endings or byte-order mark of untouched text files in the edit scope (see KNOWN_LIMITATIONS). A fix is being tested now.
• Linux: checks that run Go or Node programs fail under StateFrame's check memory limit. macOS is not affected.
• The first request of a run can differ between runs in one optional orientation section, depending on local cache state.
• On endpoints without an exact tokenizer, very dense content can be underestimated and push a request past the context limit.

StateFrame 0.4.31

StateFrame 0.4.31: clearer errors when the check sandbox fails to start.

Changes

• When the sandbox that runs checks fails to start, or fails its startup import check, the error now includes the process's exit status (when it can be proven) and the last part of its log, instead of only a low-level "Broken pipe" or communication error. This makes failures caused by things like a full disk or quota much easier to diagnose.
• Nothing else about startup, retries or cleanup changed.

Requests sent to the model are unchanged.

Known issues (fixes planned)

• In-place runs and exported patches can change the line endings or byte-order mark of untouched text files in the edit scope (see KNOWN_LIMITATIONS). A fix is being tested now.
• Linux: checks that run Go or Node programs fail under StateFrame's check memory limit. macOS is not affected.
• The first request of a run can differ between runs in one optional orientation section, depending on local cache state.
• On endpoints without an exact tokenizer, very dense content can be underestimated and push a request past the context limit.

StateFrame 0.4.30

StateFrame 0.4.30: credentials are stripped on cross-origin redirects.

Security

• When a server redirects a request to a different scheme, host or port, StateFrame now removes authentication, API-key and cookie headers before following the redirect, so credentials meant for your provider are not sent to another server.

Fixes

• Requests from routed runs can now follow allowed redirects. If your API endpoint redirects before replying, the request completes, and credentials are still removed when the redirect leaves the original origin.
• Every redirect hop keeps the original request deadline, so StateFrame does not start a new request after the deadline has passed.

Requests sent to the model are unchanged. Verified on a hosted OpenAI-compatible endpoint.

Known issues (fixes planned)

• In-place runs and exported patches can change the line endings or byte-order mark of untouched text files in the edit scope (see KNOWN_LIMITATIONS). A fix is being tested now.
• Linux: checks that run Go or Node programs fail under StateFrame's check memory limit. macOS is not affected.
• The first request of a run can differ between runs in one optional orientation section, depending on local cache state.
• On endpoints without an exact tokenizer, very dense content can be underestimated and push a request past the context limit.

StateFrame 0.4.29

StateFrame 0.4.29: repo maps no longer leak between projects.

Fixes

• Privacy: in environments with an existing, writable /workspace directory (some containers, devcontainers and hosted dev environments), two projects at the same git commit could reuse each other's repository map: file names and function and class signatures, not file contents. Older releases cached maps in a shared folder under /workspace, keyed only by commit. StateFrame no longer uses that folder: the orientation map is always built from the project itself, and the optional disk cache is written only under STATEFRAME_HOME and is keyed by the project root and the contents of its files.
• Default macOS and Linux setups were not affected: there a normal user cannot create /workspace, so nothing was cached. Affected releases: 0.1.0 through 0.4.28, only in the environments above.
• If you used StateFrame on more than one project in such an environment, you can delete the repo_map_cache folder that older releases created under /workspace. Nothing reads it anymore.

There are no other changes to StateFrame's behaviour.

Known issues (fixes planned)

• In-place runs and exported patches can change the line endings or byte-order mark of untouched text files in the edit scope (see KNOWN_LIMITATIONS). A fix is being tested now.
• Linux: checks that run Go or Node programs fail under StateFrame's check memory limit. macOS is not affected.
• The first request of a run can differ between runs in one optional orientation section, depending on local cache state.
• On endpoints without an exact tokenizer, very dense content can be underestimated and push a request past the context limit.