Skip to content

chore: sync dev to main for v1.0.39 - #518

Merged
LeXwDeX merged 13 commits into
mainfrom
chore/517-sync-v1-0-39
Sep 2, 2026
Merged

chore: sync dev to main for v1.0.39#518
LeXwDeX merged 13 commits into
mainfrom
chore/517-sync-v1-0-39

Conversation

@LeXwDeX

@LeXwDeX LeXwDeX commented Sep 2, 2026

Copy link
Copy Markdown
Owner

Closes #517

Why

Summarize the problem or need this delivery addresses.

What changed

  • Describe each meaningful change.

Evidence

  • Point at the proof: tests, checks, verification runs.

Checklist

  • Why, What changed, and Evidence are filled in.
  • specgit finish exits 0.

chore: sync main to dev after v1.0.37 notes fix
The 200ms bound around a 40ms connectTimeout flaked at 288ms on a loaded
linux runner (raw setTimeout, no TestClock possible). 2000ms still separates
fail-fast from hang — a hang trips the test timeout instead — and the
Stalled error-class assertion remains the semantic check.
Closes the dependabot high advisory (alert 110): mysql2 < 3.22.0 leaks
plaintext credentials on an auth-plugin downgrade to mysql_clear_password.
The RouteProbe seam test mirrors the production subscription shape, so
removing an onCleanup wrapper from the real Session/Prompt routes left it
green. Mount the actual route components inside the production provider
stack and assert the SDK event bus returns to its baseline listener count
after unmount; verified red when either wrapper is removed. The two bridge
lint suppressions carry reasons (restoration point; overloaded on widened
through bind).
win32 taskkill /T /F vs negative-pid kill existed as diverging copies in
util/process.stop and the hook execShell killGroup. Extract killGroupPid
(POSIX group signal; win32 awaits the taskkill exit code and throws, leaving
fallback and logging to callers) and reuse it in both. The SDK sync copy
stays as documented in #503. No behavior change: same signals, ordering, and
grace constants; the #500 process-group regression suite passes.
test: make the memory stall timing assertion load-tolerant
Series file for the next stable derived from graphagent-v1.0.38: the
leftover-hardening train (#512-#515) accepted on dev via PR #516. Render
verified locally with release-notes.ts.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

chore: sync dev to main for v1.0.39

1 participant